<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing SOC Automation Workflows

## SOAR Platform APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk SOAR | `POST /rest/playbook_run` | Trigger playbook execution |
| Splunk SOAR | `GET /rest/action_run/{id}` | Check action status |
| Splunk SOAR | `POST /rest/container` | Create case/container |
| Cortex XSOAR | `POST /incident` | Create incident |
| Cortex XSOAR | `POST /incident/{id}/playbook` | Trigger playbook |
| Sentinel | `POST /incidents/{id}/runPlaybook` | Execute Logic App |

## Containment Action APIs

| Action | Platform | Endpoint |
|---|---|---|
| Isolate Host | CrowdStrike | `POST /devices/entities/host-group-actions/v1` |
| Isolate Host | Defender | `POST /api/machines/{id}/isolate` |
| Block IP | Palo Alto | `POST /restapi/v10.1/Objects/Addresses` |
| Disable Account | Azure AD | `PATCH /users/{id} {"accountEnabled": false}` |

## Enrichment Service APIs

| Service | Endpoint | Purpose |
|---|---|---|
| VirusTotal | `GET /api/v3/{type}/{id}` | IOC reputation |
| AbuseIPDB | `GET /api/v2/check` | IP abuse report |
| Shodan | `GET /shodan/host/{ip}` | Host intelligence |
| WHOIS | `GET /v1/domain/{domain}` | Domain registration |

## Agent Script

```bash
# List playbook templates
node agent.js playbooks

# Assess automation readiness
node agent.js assess --type host_isolation --approval-gate --rollback --tested

# Generate playbook scaffold
node agent.js scaffold --type enrichment
```
