<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Validating SIEM Detection Rules

## sigma-cli

### Validation Commands

| Command | Description |
|---|---|
| `sigma check <rule.yml>` | Validate rule syntax and required fields |
| `sigma convert -t <backend> <rule.yml>` | Convert to target SIEM query |
| `sigma list targets` | List available backends |
| `sigma list pipelines` | List processing pipelines |

### Backend Targets

| Backend | Query Language | Pipeline |
|---|---|---|
| `splunk` | SPL | `splunk_cim`, `splunk_sysmon` |
| `elasticsearch` | Lucene/EQL | `ecs_windows`, `ecs_zeek` |
| `microsoft365defender` | KQL | Built-in |
| `qradar` | AQL | `qradar_fields` |

## Splunk REST API

### Search Jobs

```bash
# Create search job
curl -k -u admin:changeme -d "search=search index=main | head 10" \
  https://splunk:8089/services/search/jobs

# Get search results
curl -k -u admin:changeme \
  "https://splunk:8089/services/search/jobs/<sid>/results?output_mode=json"
```

## Elasticsearch Search API

```bash
# Execute query
curl -s "http://elastic:9200/logs-*/_search" \
  -H 'Content-Type: application/json' \
  -d '{"query": {"match": {"process.name": "mimikatz.exe"}}}'
```

## Agent Script

```bash
# Validate rule
node agent.js validate rules/lsass_access.yml

# Convert to Splunk
node agent.js convert rules/lsass_access.yml -t splunk -p splunk_cim

# Test against sample data
node agent.js test-rule --rule rules/lsass_access.yml --test-data tests/lsass_test.json

# Batch test all rules
node agent.js batch-test --rules-dir rules/ --tests-dir tests/
```
