<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Testing Incident Response Procedures

## SIEM Alert Query APIs

### Splunk

| Endpoint | Method | Description |
|---|---|---|
| `/services/search/jobs` | POST | Create search job |
| `/services/search/jobs/{sid}/results` | GET | Get results |
| `/services/notable_update` | POST | Update notable event status |

### Elastic Security

| Endpoint | Method | Description |
|---|---|---|
| `/api/detection_engine/signals/search` | POST | Search signals |
| `/api/detection_engine/signals/status` | POST | Update signal status |

## Ticketing Integration

### Jira REST API

| Endpoint | Method | Description |
|---|---|---|
| `/rest/api/2/search` | POST | Search issues by JQL |
| `/rest/api/2/issue` | POST | Create incident ticket |
| `/rest/api/2/issue/{key}/transitions` | POST | Transition issue status |

## Agent Script

```bash
# Create exercise scenario
node agent.js create-exercise --name "Ransomware Drill" \
  --type live-fire --techniques T1566.001 T1059.001 T1486 \
  --output exercises/ransomware.yaml

# Measure response times
node agent.js measure-response --exercise exercises/ransomware.yaml \
  --siem-url https://splunk:8089 --output results/metrics.json

# Evaluate playbook adherence
node agent.js evaluate-playbook --exercise exercises/ransomware.yaml \
  --results results/metrics.json

# Generate after-action report
node agent.js generate-aar --exercise exercises/ransomware.yaml \
  --results results/metrics.json --output reports/aar.json
```
