<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Alert Fatigue Reduction

## SIEM Rule Management APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk ES | `POST /services/saved/searches/{name}` | Modify correlation search |
| Splunk ES | `POST /services/notable_update` | Bulk close FP notables |
| Elastic | `PUT /api/detection_engine/rules` | Update detection rule |
| Elastic | `POST /api/detection_engine/rules/_bulk_action` | Bulk disable rules |
| Sentinel | `PUT /alertRules/{id}` | Update analytics rule |

## Risk Scoring APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk RBA | `POST /services/data/transforms/lookups/risk_lookup` | Update risk modifiers |
| Elastic | `PUT /api/detection_engine/rules` | Set risk_score field |
| Sentinel | `PUT /incidents/{id}` | Adjust incident severity |

## Alert Suppression Configuration

| Platform | Method | Scope |
|---|---|---|
| Splunk ES | `throttle` in correlation search | Per-entity window |
| Elastic | Rule `max_signals` + `throttle` | Per-rule suppression |
| Sentinel | Fusion rule grouping | Cross-rule dedup |

## Agent Script

```bash
# List tuning actions
node agent.js actions

# Analyze a noisy rule
node agent.js analyze --rule "Brute Force Login" --total 5000 --tp 50 --fp 4200 --days 30

# Calculate fatigue risk score
node agent.js fatigue --alerts-per-shift 120 --fp-rate 75.0 --repeat-rate 40.0
```
