<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting ICS Insider Threats — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-ics-insider-threats.

## Tools

### `splunk-api`

SIEM queries

**Usage:**
```bash
curl -k https://splunk:8089/services/search/jobs
```

**Key Flags:**
  - /search/jobs: searches
  - /saved/searches: rules

---

### `wevtutil`

Windows Event Log

**Usage:**
```bash
wevtutil qe Security
```

**Key Flags:**
  - EventID 4624: logon
  - EventID 6416: USB

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Never execute write operations against production ICS without explicit authorization

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82: Guide to OT Security
