<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Analyzing Container Runtime Threats — API Reference

## Agent CLI

```bash
# Run audit
node scripts/agent.js --action audit --output results.json

# Filter by severity
node scripts/agent.js --action audit --severity critical --output critical.json

# Target specific namespace
node scripts/agent.js --action audit --namespace production --output prod-audit.json
```

## Output Format

```json
{
  "tool": "runtime-threat-analyzer",
  "version": "1.0",
  "timestamp": "ISO8601",
  "total_findings": 0,
  "by_severity": {"critical": 0, "high": 0, "medium": 0, "low": 0},
  "findings": []
}
```

## Finding Schema

| Field | Type | Description |
|-------|------|-------------|
| `type` | string | Finding category |
| `severity` | string | critical, high, medium, low |
| `desc` | string | Human-readable description |
| `namespace` | string | Kubernetes namespace |
| `pod` | string | Pod name (if applicable) |
| `container` | string | Container name (if applicable) |

## kubectl Commands

```bash
# List pods with security context details
kubectl get pods -A -o json | jq '.items[] | {
  ns: .metadata.namespace,
  pod: .metadata.name,
  containers: [.spec.containers[] | {
    name: .name,
    privileged: .securityContext.privileged,
    runAsNonRoot: .securityContext.runAsNonRoot
  }]
}'

# Check namespace labels
kubectl get namespaces --show-labels

# Describe resource
kubectl describe pod POD_NAME -n NAMESPACE
```

## References

- [Falco Documentation](https://falco.org/docs/)
- [Cilium Tetragon](https://tetragon.io/docs/)
- [Sysdig OSS](https://github.com/draios/sysdig)
- [MITRE ATT&CK Containers Matrix](https://attack.mitre.org/matrices/enterprise/containers/)
