<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing SOC Training Exercises

## Attack Simulation APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| MITRE Caldera | `POST /api/v2/operations` | Start attack operation |
| MITRE Caldera | `GET /api/v2/operations/{id}` | Check operation status |
| Atomic Red Team | PowerShell `Invoke-AtomicTest` | Execute ATT&CK technique |
| AttackIQ | `POST /v1/assessments/{id}/run` | Launch assessment |

## SIEM Test Event APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk | `POST /services/receivers/simple` | Inject test events |
| Elastic | `POST /{index}/_doc` | Index test events |
| Sentinel | `POST /api/logs` | Send custom log data |

## Training Management APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| LMS | `POST /api/v1/courses/{id}/enroll` | Enroll analyst in training |
| LMS | `GET /api/v1/users/{id}/progress` | Track completion |
| Confluence | `POST /wiki/rest/api/content` | Store exercise reports |

## Scoring and Tracking

| Platform | Endpoint | Purpose |
|---|---|---|
| CTFd | `GET /api/v1/scoreboard` | CTF standings |
| CTFd | `GET /api/v1/users/{id}/solves` | Individual progress |
| Custom | `POST /api/v1/assessments` | Record skill assessment |

## Agent Script

```bash
# List exercise types and skill domains
node agent.js list

# Plan a training exercise
node agent.js plan --type purple_team --objective "Validate ransomware detection" --participants 6

# Score analyst performance
node agent.js score --analyst "analyst-1" --scores '{"detection_speed":4,"triage_accuracy":5,"investigation_depth":3,"containment_speed":4,"documentation":3,"communication":4,"procedure_compliance":5}'
```
