<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Detection as Code

## Sigma CLI Commands

| Command | Purpose |
|---|---|
| `sigma check <path>` | Validate rule syntax |
| `sigma convert -t splunk <path>` | Convert to Splunk SPL |
| `sigma convert -t elasticsearch <path>` | Convert to Elastic |
| `sigma convert -t microsoft365defender <path>` | Convert to KQL |
| `sigma list backends` | List available backends |
| `sigma list pipelines` | List processing pipelines |

## YARA Commands

| Command | Purpose |
|---|---|
| `yara <rule> <target>` | Scan target with rule |
| `yara -c <rule> <target>` | Count matches only |
| `yara -w <rule> /dev/null` | Validate rule syntax |

## Splunk Deployment API

| Endpoint | Purpose |
|---|---|
| `POST /services/saved/searches` | Create saved search |
| `POST /services/saved/searches/{name}` | Update saved search |
| `DELETE /services/saved/searches/{name}` | Delete saved search |
| `POST /services/saved/searches/{name}/dispatch` | Run immediately |

## Elastic Detection API

| Endpoint | Purpose |
|---|---|
| `POST /api/detection_engine/rules` | Create detection rule |
| `PUT /api/detection_engine/rules` | Update detection rule |
| `DELETE /api/detection_engine/rules` | Delete detection rule |
| `POST /api/detection_engine/rules/_bulk_create` | Bulk create rules |

## Agent Script

```bash
# List Sigma rule templates
node agent.js list

# Generate a Sigma rule
node agent.js generate --title "Suspicious Certutil Download" \
  --description "Detects certutil downloading files" \
  --category process_creation --field CommandLine \
  --values "urlcache" "split" "http" --level high \
  --tags "t1105" "defense_evasion"

# Validate a rule
node agent.js validate sigma/windows/proc_creation_win_certutil.yml

# Generate CI/CD pipeline
node agent.js pipeline --platform github
```
