<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Alert Triage

## SIEM Alert Queue APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk ES | `GET /services/notable_update` | Update notable event status |
| Splunk ES | `POST /services/notable_update` | Change disposition/owner |
| Elastic | `POST /api/detection_engine/signals/status` | Update alert status |
| Sentinel | `PUT /incidents/{id}` | Update incident status/owner |

## Threat Intel Enrichment APIs

| Source | Endpoint | Rate Limit |
|---|---|---|
| VirusTotal | `GET /api/v3/{type}/{id}` | 4 req/min (free) |
| AbuseIPDB | `GET /api/v2/check` | 1000/day (free) |
| URLhaus | `POST /api/v1/url/` | Unlimited |
| GreyNoise | `GET /v3/community/{ip}` | 50/day (free) |
| Shodan | `GET /shodan/host/{ip}` | 1 req/sec |

## Disposition Codes

| Code | Label | Action |
|---|---|---|
| `TP` | True Positive | Escalate, contain |
| `BTP` | Benign True Positive | Close, allowlist |
| `FP` | False Positive | Close, tune rule |
| `IND` | Indeterminate | Escalate to T2 |

## Agent Script

```bash
# List enrichment sources
node agent.js sources

# Generate triage checklist
node agent.js triage --alert-id ALERT-001 --src-ip 10.0.0.5 --user jdoe --severity high

# Classify alert
node agent.js classify --alert-id ALERT-001 --disposition true_positive --notes "Confirmed C2 callback"
```
