<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building SOC Playbooks

## Playbook Schema Fields

| Field | Type | Description |
|---|---|---|
| `name` | string | Human-readable playbook name |
| `id` | string | Unique playbook identifier (PB-SOC-NNN) |
| `severity` | enum | low, medium, high, critical |
| `sla_minutes` | int | Max response time in minutes |
| `trigger` | object | Alert conditions that activate playbook |
| `steps` | list | Ordered triage and response actions |
| `escalation` | object | Escalation criteria and targets |

## SOAR Platform APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| XSOAR | `POST /incident` | Create incident from playbook |
| XSOAR | `POST /playbook/run` | Execute playbook by ID |
| Phantom | `POST /rest/playbook_run` | Trigger Phantom playbook |
| Tines | `POST /api/v1/stories/{id}/trigger` | Execute Tines story |
| TheHive | `POST /api/v1/case` | Create case from playbook |

## Agent Script

```bash
# List available playbook templates
node agent.js list

# Get a specific playbook
node agent.js get phishing

# Generate custom playbook
node agent.js generate --alert-type ransomware --severity critical --sla 10 \
  --steps isolate_endpoint collect_artifacts identify_variant notify_management
```
