<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing User Reporting Workflows

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js configure-button --platform m365` | Generate report button config |
| `node agent.js generate-playbook --platform thehive` | Generate SOAR playbook |
| `node agent.js triage-checklist` | SOC analyst triage checklist |
| `node agent.js feedback-templates` | Reporter feedback email templates |
| `node agent.js reporter-stats --period monthly` | Reporter statistics template |

### Examples

```bash
# Deploy report button for M365
node agent.js configure-button --platform m365

# Generate TheHive phishing triage playbook
node agent.js generate-playbook --platform thehive

# Get SOC triage checklist with M365 search commands
node agent.js triage-checklist

# Generate reporter acknowledgment templates
node agent.js feedback-templates
```

## M365 PowerShell Commands

| Command | Purpose |
|---|---|
| `Set-ReportSubmissionPolicy` | Configure report button destination |
| `New-ComplianceSearch` | Search mailboxes for phishing email |
| `New-ComplianceSearchAction -Purge` | Remove phishing from all mailboxes |
| `Get-QuarantineMessage` | Review quarantined messages |

## SOAR Platforms

| Platform | Integration | Use Case |
|---|---|---|
| TheHive | Webhooks + Cortex | Open-source incident management |
| Cortex XSOAR | Playbooks | Enterprise automation |
| Tines | No-code workflows | Lightweight automation |
| Swimlane | Low-code | SOAR with case management |
