<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Privileged Identity Threat Hunting

## PAM Platform APIs

### CyberArk Privileged Access

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/Accounts` | GET | List privileged accounts |
| `/api/Accounts/{id}/Password/Retrieve` | POST | Retrieve account password (audited) |
| `/api/LiveSessions` | GET | List active privileged sessions |
| `/api/Recordings/{id}` | GET | Retrieve session recording |
| `/api/Activities` | GET | Privileged activity audit log |

### BeyondTrust Password Safe

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/v3/ManagedAccounts` | GET | List managed accounts |
| `/api/v3/Requests` | GET | List access requests |
| `/api/v3/Sessions` | GET | Active session inventory |
| `/api/v3/Activities` | GET | Activity audit trail |

## Active Directory Queries

### Key Event IDs

| Event ID | Log | Description |
|----------|-----|-------------|
| 4624 | Security | Successful logon |
| 4625 | Security | Failed logon |
| 4672 | Security | Special privileges assigned |
| 4768 | Security | TGT requested (AS-REQ) |
| 4769 | Security | TGS requested (service ticket) |
| 4662 | Security | Directory object accessed (DCSync) |
| 4728 | Security | Member added to security group |

### LDAP Queries for Service Accounts

| Query | Purpose |
|-------|---------|
| `(&(objectClass=user)(servicePrincipalName=*))` | All accounts with SPNs |
| `(&(objectClass=user)(adminCount=1))` | Protected admin accounts |
| `(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))` | Pre-auth disabled (AS-REP roastable) |
| `(&(objectClass=user)(pwdLastSet<=<timestamp>))` | Stale password accounts |

## Behavioral Analytics Platforms

| Platform | API | Detection Capability |
|----------|-----|---------------------|
| Microsoft Sentinel UEBA | REST API | Entity behavior profiling |
| Exabeam | REST API | Session-based anomaly detection |
| Securonix | REST API | Peer group analytics |
| Splunk UBA | REST API | Threat chain detection |
