<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Threat Hunting Hypothesis

## MITRE ATT&CK Mapping

| Tactic | ID | Common Data Sources |
|---|---|---|
| Initial Access | TA0001 | Email logs, proxy, Sysmon EID 1 |
| Execution | TA0002 | Sysmon EID 1, EID 4104, WMI logs |
| Persistence | TA0003 | Registry (EID 12/13), EID 4698 |
| Lateral Movement | TA0008 | EID 4624, EID 7045, Sysmon EID 3 |
| Exfiltration | TA0010 | DNS logs, proxy, DLP |
| Command and Control | TA0011 | DNS, proxy, JA3/JA3S |

## Hunt Query Platforms

| Platform | Language | Documentation |
|---|---|---|
| Splunk | SPL | `docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference` |
| Microsoft Sentinel | KQL | `learn.microsoft.com/en-us/azure/data-explorer/kusto/query/` |
| Elastic | EQL/KQL | `elastic.co/guide/en/elasticsearch/reference/current/eql.html` |

## Agent Script

```bash
# Generate a hunting hypothesis
node agent.js generate --technique T1059.001 --tactic execution --data-source "Sysmon EID 1"

# Build hunt query for Splunk
node agent.js build-query --technique T1059.001 --platform splunk

# Create hunt report
node agent.js report --hunt-id HUNT-001 --hypothesis "PowerShell download cradles" \
  --finding "3 suspicious instances found" --status confirmed

# List data sources for a tactic
node agent.js data-sources --tactic lateral_movement
```
