<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Detecting Identity-Based Attacks

## Identity Provider APIs

### Microsoft Entra ID — Sign-In Logs

| Endpoint | Description |
|---|---|
| `GET /auditLogs/signIns` | Query sign-in events |
| `GET /auditLogs/directoryAudits` | Directory change events |
| `GET /identityProtection/riskDetections` | Identity risk detections |
| `GET /identityProtection/riskyUsers` | Users flagged as risky |

### Okta — System Log API

| Endpoint | Description |
|---|---|
| `GET /api/v1/logs` | System log events |
| `GET /api/v1/logs?filter=eventType eq "user.authentication.sso"` | SSO events |
| `GET /api/v1/logs?filter=eventType eq "user.session.start"` | Session starts |

### Key Event Types

| Provider | Event | ATT&CK |
|---|---|---|
| Entra ID | `Sign-in failure` | T1110 |
| Entra ID | `Risky sign-in` | T1078 |
| Okta | `user.authentication.auth_via_mfa` | T1621 |
| Okta | `policy.evaluate_sign_on` | T1078 |

### Agent Script

```bash
# Detect password spray
node agent.js detect-spray --log-path /var/log/auth.json --threshold 10

# Detect MFA fatigue
node agent.js detect-mfa-fatigue --log-path /var/log/mfa.json --window 5

# Map ATT&CK techniques
node agent.js map-techniques --scope identity
```
