<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Red-Blue Debrief Sessions

## Data Collection Formats

### Red Team Log Schema

```json
{
  "timestamp": "2026-01-15T10:00:00Z",
  "technique": "T1059.001",
  "description": "Executed PowerShell encoded command",
  "operator": "operator-1",
  "success": true
}
```

### Blue Team Response Schema

```json
{
  "timestamp": "2026-01-15T10:07:00Z",
  "action": "alert_triage",
  "technique": "T1059.001",
  "description": "SIEM alert acknowledged and triaged",
  "analyst": "analyst-1"
}
```

## Ticketing APIs

### Jira REST API

| Endpoint | Method | Description |
|---|---|---|
| `/rest/api/2/issue` | POST | Create issue |
| `/rest/api/2/search` | POST | Search issues via JQL |
| `/rest/api/2/issue/{key}` | GET | Get issue details |

### GitHub Issues API

| Endpoint | Method | Description |
|---|---|---|
| `/repos/{owner}/{repo}/issues` | POST | Create issue |
| `/repos/{owner}/{repo}/issues` | GET | List issues |

## Agent Script

```bash
# Collect exercise data
node agent.js collect-data --red-log red.json --blue-log blue.json \
  --siem-alerts alerts.json --output debrief_data.json

# Build timeline
node agent.js build-timeline --data debrief_data.json --output timeline.json

# Classify findings
node agent.js classify-findings --timeline timeline.json --output findings.json

# Generate report
node agent.js generate-report --findings findings.json \
  --timeline timeline.json --output reports/debrief.json

# Create remediation tickets
node agent.js create-tickets --findings findings.json \
  --ticketing-url https://jira.internal/rest/api/2 --project SECOPS
```
