<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Endpoint Threat Hunting

## Threat Hunting APIs

### osquery Tables for Hunting

| Table | Description |
|---|---|
| `processes` | Running processes with cmdline and parent |
| `listening_ports` | Open network listeners |
| `scheduled_tasks` | Windows scheduled tasks |
| `startup_items` | Autostart entries |
| `registry` | Windows registry key/value queries |
| `file` | File metadata and hashes |
| `logged_in_users` | Currently logged-in users |
| `dns_resolvers` | Configured DNS servers |

### Velociraptor Hunting Artifacts

| Artifact | Description |
|---|---|
| `Windows.System.Pslist` | Process listing |
| `Windows.Detection.Autoruns` | Autorun enumeration |
| `Windows.EventLogs.Evtx` | Event log queries |
| `Windows.Search.FileFinder` | File search by name/hash/yara |
| `Linux.Detection.AnomalousFiles` | Unusual files in system paths |

### Agent Script

```bash
# Generate hunt query for technique
node agent.js generate-query --technique T1059.001

# Stack count analysis
node agent.js stack-count --data-file processes.json --field name

# Create Sigma rule from finding
node agent.js finding-to-sigma --title "Suspicious LOLBin" --technique T1218 --indicator "mshta vbscript"
```
