<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Automating Detection Validation

## CI/CD Pipeline Stages

| Stage | Tool | Trigger |
|---|---|---|
| Lint | `sigma check` | On commit to rules/ |
| Convert | `sigma convert` | On commit to rules/ |
| Unit test | Custom test harness | On commit to rules/ |
| Deploy | SIEM API | On merge to main |
| Scheduled test | Atomic Red Team | Weekly cron |
| Regression check | Baseline comparison | After scheduled test |

## GitHub Actions

### Workflow Triggers

```yaml
on:
  push:
    paths: ['rules/**/*.yml']
  pull_request:
    paths: ['rules/**/*.yml']
  schedule:
    - cron: '0 6 * * 1'  # Weekly Monday 6am UTC
```

### Self-Hosted Runner Requirements

| Requirement | Purpose |
|---|---|
| PowerShell 7+ | Invoke-AtomicRedTeam execution |
| Atomic Red Team | Test framework |
| Network access to lab | Target hosts reachable |
| SIEM API access | Metrics collection |

## Regression Detection

| State | Previous | Current | Classification |
|---|---|---|---|
| Stable pass | ✓ | ✓ | No change |
| Regression | ✓ | ✗ | Alert — detection lost |
| Improvement | ✗ | ✓ | New detection working |
| Stable fail | ✗ | ✗ | Known gap |

## Agent Script

```bash
# Initialize CI pipeline
node agent.js init-pipeline --ci github-actions --siem-targets splunk,elasticsearch

# Create test schedule
node agent.js create-schedule --techniques T1003.001,T1059.001 --frequency weekly

# Batch validate (CI mode)
node agent.js batch-validate --rules-dir rules/

# Run scheduled tests
node agent.js run-scheduled --config schedule.json

# Check for regressions
node agent.js check-regression --current results.json --baseline baseline.json
```
