<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Automated Threat Hunting — API Reference

## Splunk Search API

```python
import requests

SPLUNK_URL = "https://splunk:8089"
SPLUNK_TOKEN = "Bearer your-token"

# Submit search job
resp = requests.post(f"{SPLUNK_URL}/services/search/jobs", headers={
    "Authorization": SPLUNK_TOKEN,
}, data={
    "search": 'search index=windows EventCode=4624 LogonType=3 | stats count by src_ip dest_ip',
    "output_mode": "json",
    "earliest_time": "-24h",
    "latest_time": "now",
})

# Get search results
sid = resp.json()["sid"]
results = requests.get(f"{SPLUNK_URL}/services/search/jobs/{sid}/results",
    headers={"Authorization": SPLUNK_TOKEN}, params={"output_mode": "json"})
```

## Elasticsearch Query (KQL)

```python
from elasticsearch import Elasticsearch

es = Elasticsearch("https://elastic:9200", api_key="key")

resp = es.search(index="winlogbeat-*", body={
    "query": {"bool": {"must": [
        {"match": {"event.code": "4624"}},
        {"match": {"winlog.event_data.LogonType": "3"}},
    ]}},
    "aggs": {"by_source": {"terms": {"field": "source.ip", "size": 50}}},
    "size": 0,
})
```

## Microsoft Sentinel KQL

```
SecurityEvent
| where EventID == 4624 and LogonType == 3
| summarize LogonCount=count() by SourceIP=IpAddress, DestIP=Computer
| where LogonCount > 10
| sort by LogonCount desc
```

## Sigma Rule Conversion

```bash
# Convert to Splunk
sigma convert -t splunk -p splunk_cim rule.yml

# Convert to Elastic
sigma convert -t elasticsearch -p ecs_windows rule.yml

# Convert to Sentinel
sigma convert -t microsoft365defender rule.yml
```

## MITRE ATT&CK Tactic Reference

| Tactic | ID | Common Techniques |
|--------|----|-------------------|
| Lateral Movement | TA0008 | T1021 (Remote Services), T1047 (WMI) |
| Persistence | TA0003 | T1053 (Scheduled Task), T1547 (Boot/Logon) |
| Credential Access | TA0006 | T1003 (OS Credential Dumping), T1558 (Kerberoasting) |
| Exfiltration | TA0010 | T1048 (Exfil Over Alt Protocol), T1567 (Cloud Storage) |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Hunt completed — no findings |
| 1 | Hunt completed — findings detected |
| 2 | Hunt query execution failed |
