<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Log Source Onboarding

## Splunk Data Ingestion APIs

| Endpoint | Purpose |
|---|---|
| `POST /services/data/inputs/tcp/raw` | Create TCP input |
| `POST /services/data/inputs/udp` | Create UDP input |
| `POST /services/data/inputs/monitor` | Create file monitor input |
| `POST /services/collector/event` | HTTP Event Collector (HEC) |
| `GET /services/data/indexes` | List indexes |
| `POST /services/data/indexes` | Create index |

## Elastic Ingestion APIs

| Endpoint | Purpose |
|---|---|
| `PUT /_ingest/pipeline/{id}` | Create ingest pipeline |
| `PUT /{index}/_mapping` | Update index mapping |
| `POST /_bulk` | Bulk index documents |
| `GET /_cat/indices` | List indices |

## Sentinel Data Connectors

| Connector | Log Source |
|---|---|
| `CEF` | Common Event Format devices |
| `Syslog` | Linux/network devices |
| `Windows Security Events` | Windows via AMA agent |
| `Microsoft 365` | Office 365 audit logs |
| `AWS CloudTrail` | AWS API activity |

## CIM Data Models

| Model | Key Fields |
|---|---|
| `Authentication` | src, dest, user, action |
| `Network_Traffic` | src, dest, dest_port, bytes, action |
| `Endpoint.Processes` | dest, user, process, parent_process |
| `Web` | url, http_method, status, src, dest |

## Agent Script

```bash
# List log source templates
node agent.js list

# Get specific source details
node agent.js get palo_alto_firewall

# Generate onboarding checklist
node agent.js onboard --name "Zscaler Proxy" --format json \
  --transport api-poll --index proxy --volume-gb 5.2
```
