<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Detection Rule Tuning

## Sigma CLI

### Commands

| Command | Description |
|---|---|
| `sigma convert -t <backend> -p <pipeline> <rule>` | Convert rule to SIEM query |
| `sigma check <rule>` | Validate rule syntax |
| `sigma list backends` | List available backends |
| `sigma list pipelines` | List processing pipelines |

### Backends

| Backend | Pipeline | Output |
|---|---|---|
| `splunk` | `splunk_cim` | Splunk SPL query |
| `elasticsearch` | `ecs_windows` | Elasticsearch DSL |
| `microsoft365defender` | `sentinel_asim` | KQL query |

## Splunk REST API

| Endpoint | Method | Description |
|---|---|---|
| `/services/search/jobs` | POST | Create search job |
| `/services/search/jobs/{sid}/results` | GET | Get search results |
| `/services/saved/searches` | GET | List saved searches |
| `/services/saved/searches/{name}` | PATCH | Update saved search |

## Elastic Security API

| Endpoint | Method | Description |
|---|---|---|
| `/api/detection_engine/rules` | GET | List detection rules |
| `/api/detection_engine/rules` | POST | Create detection rule |
| `/api/detection_engine/rules` | PATCH | Update detection rule |
| `/api/detection_engine/rules/_find` | GET | Search rules |

## Agent Script

```bash
# Baseline alert rates
node agent.js baseline --siem-url https://splunk:8089 --days 7 --top 20

# Tune a Sigma rule with filter
node agent.js tune --rule rules/powershell.yml \
  --add-filter 'ParentImage|endswith:\CcmExec.exe' --output rules/tuned/powershell.yml

# Validate rule syntax
node agent.js validate --rule rules/tuned/powershell.yml

# Convert to Splunk SPL
node agent.js convert --rule rules/tuned/powershell.yml --backend splunk

# Compare before/after tuning
node agent.js compare --rule "Suspicious PowerShell" \
  --siem-url https://splunk:8089 --before 7 --after 1
```
