<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Detection-as-Code Pipeline

## sigma-cli

| Command | Description |
|---|---|
| `sigma check <rule>` | Validate rule syntax |
| `sigma convert -t <backend> [-p <pipeline>] <rule>` | Convert to SIEM query |
| `sigma list targets` | List conversion backends |

## Splunk REST API (Saved Searches)

| Endpoint | Method | Description |
|---|---|---|
| `/servicesNS/{user}/{app}/saved/searches` | POST | Create saved search |
| `/servicesNS/{user}/{app}/saved/searches/{name}` | POST | Update saved search |
| `/servicesNS/{user}/{app}/saved/searches/{name}` | DELETE | Delete saved search |

## Elastic Security Rules API

| Endpoint | Method | Description |
|---|---|---|
| `/api/detection_engine/rules` | POST | Create detection rule |
| `/api/detection_engine/rules` | PUT | Update detection rule |
| `/api/detection_engine/rules/_bulk_create` | POST | Bulk create rules |

## Agent Script

```bash
# Validate all rules
node agent.js validate rules/

# Batch convert to Splunk
node agent.js convert rules/ -t splunk -p splunk_cim

# Check ATT&CK coverage
node agent.js coverage rules/

# Show changed rules
node agent.js diff --base-ref HEAD~1
```
