{"name":"EDR Bot API","version":"1.0.0","description":"EDR Security Bot API with index building, streaming and non-streaming endpoints","endpoints":{"build_index":{"method":"POST","path":"/build-index","description":"Build FAISS index from JSON files in S3 (always rebuilds from scratch)","request_body":{"s3_json_paths":["array of S3 paths to JSON files"]},"example":{"s3_json_paths":["s3://bucket-name/path/to/file1.json","bucket-name/path/to/file2.json"]},"response":{"status":"success/error","message":"string","documents_processed":"integer","index_vectors":"integer","s3_location":"string"}},"build_index_from_local":{"method":"POST","path":"/build-index-from-local","description":"Upload local JSON files to S3 and build FAISS index","request_body":{"local_file_paths":["array of local file paths"],"s3_upload_path":"optional S3 path prefix for uploaded files"},"example":{"local_file_paths":["/path/to/local/file1.json","/path/to/local/file2.json"],"s3_upload_path":"edr_data/"},"response":{"status":"success/error","message":"string","documents_processed":"integer","index_vectors":"integer","s3_location":"string","uploaded_files":["array of S3 paths where files were uploaded"]}},"event_ingestion":{"base_path":"/api/v1/events","description":"Security event ingestion API for AI SOC","endpoints":{"ingest_batch":"POST /api/v1/events/ingest - Ingest batch of events","ingest_single":"POST /api/v1/events/ingest/single - Ingest single event","query":"POST /api/v1/events/query - Query events with filters","list":"GET /api/v1/events/ - List events","get":"GET /api/v1/events/{event_id} - Get specific event","update_status":"PATCH /api/v1/events/{event_id}/status - Update event status","stats":"GET /api/v1/events/stats/summary - Get event statistics","sources":"GET /api/v1/events/sources - List supported sources"},"webhooks":{"wazuh":"POST /api/v1/events/webhook/wazuh","crowdstrike":"POST /api/v1/events/webhook/crowdstrike","email":"POST /api/v1/events/webhook/email","cloudtrail":"POST /api/v1/events/webhook/cloudtrail","generic":"POST /api/v1/events/webhook/generic"}},"context_assembly":{"base_path":"/api/v1/context","description":"Context Assembly Engine for AI SOC reasoning","endpoints":{"assemble":"POST /api/v1/context/assemble - Assemble full context for event","assemble_summary":"POST /api/v1/context/assemble/summary - Get context summary","get_case_context":"GET /api/v1/context/case/{case_id} - Get context for case","ioc_lookup":"POST /api/v1/context/ioc/lookup - Lookup IOC in threat intel","threat_actor":"POST /api/v1/context/threat-actor - Get threat actor info","providers":"GET /api/v1/context/providers - List context providers","enrich_entities":"POST /api/v1/context/enrich/entities - Enrich entities","analyze_behavior":"POST /api/v1/context/analyze/behavior - Analyze behavior","similar_cases":"POST /api/v1/context/similar-cases - Find similar cases"}},"tool_orchestration":{"base_path":"/api/v1/tools","description":"Tool Orchestration Layer for AI SOC reasoning","endpoints":{"list_tools":"GET /api/v1/tools/ - List all available tools","get_tool":"GET /api/v1/tools/{tool_id} - Get tool definition","execute":"POST /api/v1/tools/execute - Execute a tool","pending_approvals":"GET /api/v1/tools/pending-approvals - List pending approvals","approve":"POST /api/v1/tools/approve/{approval_id} - Approve response action","deny":"POST /api/v1/tools/deny/{approval_id} - Deny response action","audit":"GET /api/v1/tools/audit/{case_id} - Get tool audit log","health":"GET /api/v1/tools/health - Tool service health check","ioc_lookup":"POST /api/v1/tools/ioc-lookup - Quick IOC lookup","search_logs":"POST /api/v1/tools/search-logs - Quick log search"}},"decision_output":{"base_path":"/api/v1/decision","description":"Decision & Output Layer for verdicts and reports","endpoints":{"make_decision":"POST /api/v1/decision/make - Make final decision for case","risk_score":"POST /api/v1/decision/risk-score - Calculate risk score","confidence_score":"POST /api/v1/decision/confidence-score - Calculate confidence score","dispositions":"GET /api/v1/decision/dispositions - List valid dispositions","summary":"POST /api/v1/decision/summary - Generate case summary","report":"POST /api/v1/decision/report - Generate investigation report","ticket":"POST /api/v1/decision/ticket - Generate ITSM ticket content","notify":"POST /api/v1/decision/notify - Send notifications","notification_channels":"GET /api/v1/decision/notification-channels - List channels","notification_routing":"GET /api/v1/decision/notification-routing - Get routing rules","health":"GET /api/v1/decision/health - Decision service health"}},"learning_feedback":{"base_path":"/api/v1/learning","description":"Learning & Feedback Loop for continuous improvement","endpoints":{"submit_feedback":"POST /api/v1/learning/feedback - Submit analyst feedback","get_feedback":"GET /api/v1/learning/feedback/{case_id} - Get feedback for case","list_feedback":"GET /api/v1/learning/feedback - List feedback with filters","feedback_stats":"GET /api/v1/learning/feedback/stats - Get feedback statistics","pending_feedback":"GET /api/v1/learning/feedback/pending - Get pending feedback cases","get_signals":"GET /api/v1/learning/signals - Get learning signals","get_signal":"GET /api/v1/learning/signals/{signal_id} - Get specific signal","pending_signals_count":"GET /api/v1/learning/signals/pending/count - Count pending signals","record_case":"POST /api/v1/learning/metrics/record-case - Record case for metrics","get_metrics":"GET /api/v1/learning/metrics - Get performance metrics","metrics_summary":"GET /api/v1/learning/metrics/summary - Get metrics summary","tool_metrics":"GET /api/v1/learning/metrics/tools - Get tool usage metrics","case_volume":"GET /api/v1/learning/metrics/volume - Get case volume by hour","trigger_update":"POST /api/v1/learning/model-update - Trigger model update","get_update_status":"GET /api/v1/learning/model-update/{update_id} - Get update status","list_updates":"GET /api/v1/learning/model-updates - List model updates","error_patterns":"GET /api/v1/learning/error-patterns - Get error patterns","health":"GET /api/v1/learning/health - Learning service health"}},"workflow_orchestrator":{"base_path":"/api/v1/workflow","description":"End-to-End Workflow Orchestrator - Single API to process alerts through all phases","endpoints":{"process":"POST /api/v1/workflow/process - Process alert through all phases (sync)","process_async":"POST /api/v1/workflow/process/async - Process alert asynchronously","process_batch":"POST /api/v1/workflow/process/batch - Process multiple alerts in batch","list":"GET /api/v1/workflow/list - List all workflows","get":"GET /api/v1/workflow/{workflow_id} - Get workflow status and results","delete":"DELETE /api/v1/workflow/{workflow_id} - Delete a workflow record","batch_status":"GET /api/v1/workflow/batch/{batch_id} - Get batch processing status","stats":"GET /api/v1/workflow/stats/summary - Get workflow statistics","health":"GET /api/v1/workflow/health - Workflow service health"},"phases":{"1":"Data Ingestion - Normalize raw events","2":"Context Assembly - Enrich with threat intel, behavioral analysis","3":"Reasoning Engine - AI hypothesis generation and testing","4":"Tool Orchestration - Execute tools (called by Phase 3)","5":"Decision & Output - Scoring, reports, notifications","6":"Learning - Register for feedback collection"}},"dashboard":{"base_path":"/api/v1/dashboard","description":"Dashboard API for event listing with analysis status and analysis trigger","endpoints":{"list_events":"GET /api/v1/dashboard/events - List events with analysis status","get_event":"GET /api/v1/dashboard/events/{event_id} - Get event details","get_stats":"GET /api/v1/dashboard/stats - Get dashboard statistics","analyze_event":"POST /api/v1/dashboard/analyze - Trigger analysis for an event","analyze_batch":"POST /api/v1/dashboard/analyze/batch - Trigger batch analysis","analysis_status":"GET /api/v1/dashboard/analyze/{event_id}/status - Get analysis job status","list_jobs":"GET /api/v1/dashboard/jobs - List analysis jobs","health":"GET /api/v1/dashboard/health - Dashboard service health"},"analysis_status_values":{"not_started":"Event has not been analyzed yet (pending, ignored)","in_progress":"Event is currently being analyzed (processing)","completed":"Analysis is complete (analyzed, escalated, resolved, false_positive)"}}}}