<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing SOC Metrics Analysis

## SIEM Reporting APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk ES | `POST /services/search/jobs` | Run metrics search |
| Splunk ES | `GET /services/search/jobs/{sid}/results` | Retrieve metrics data |
| Elastic | `POST /.kibana/api/saved_objects/_find` | List dashboards |
| Elastic | `POST /api/reporting/generate/csv` | Export metrics CSV |
| Sentinel | `POST /providers/Microsoft.OperationalInsights/workspaces/{id}/query` | Run KQL query |

## Incident Tracking APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| ServiceNow | `GET /api/now/stats/incident` | Aggregate incident metrics |
| Jira | `GET /rest/api/3/search` | Query incident tickets with JQL |
| PagerDuty | `GET /analytics/metrics/incidents/all` | Incident response metrics |

## Dashboard APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk | `POST /services/data/ui/views` | Create/update dashboard |
| Grafana | `POST /api/dashboards/db` | Create metrics dashboard |
| Kibana | `POST /api/saved_objects/dashboard` | Save dashboard object |

## Agent Script

```bash
# List metric definitions and SLA targets
node agent.js metrics

# Calculate SLA compliance
node agent.js sla --severity critical --total 500 --within-sla 485

# Calculate analyst throughput
node agent.js throughput --analyst "analyst-1" --alerts 45 --hours 8
```
