<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Testing Endpoint Detection Coverage

## Sysmon Events

| EID | Name | Key Fields |
|---|---|---|
| 1 | ProcessCreate | `Image`, `CommandLine`, `ParentImage`, `User` |
| 3 | NetworkConnect | `Image`, `DestinationIp`, `DestinationPort` |
| 7 | ImageLoad | `Image`, `ImageLoaded`, `Signature` |
| 8 | CreateRemoteThread | `SourceImage`, `TargetImage`, `StartFunction` |
| 10 | ProcessAccess | `SourceImage`, `TargetImage`, `GrantedAccess` |
| 11 | FileCreate | `Image`, `TargetFilename` |
| 12 | RegistryAddDel | `Image`, `TargetObject` |
| 13 | RegistrySetValue | `Image`, `TargetObject`, `Details` |
| 22 | DNSQuery | `Image`, `QueryName`, `QueryResults` |

## Wazuh API

### Alert Query

```bash
# Get alerts matching ATT&CK technique
curl -sk "https://wazuh:55000/alerts?q=rule.mitre.id~T1003.001&limit=10" \
  -H "Authorization: Bearer $TOKEN"
```

### Agent Status

```bash
# List agents and status
curl -sk "https://wazuh:55000/agents?select=id,name,status" \
  -H "Authorization: Bearer $TOKEN"
```

## Agent Script

```bash
# Test single technique
node agent.js test-endpoint --technique T1003.001 --edr wazuh

# Batch test
node agent.js batch-test --techniques T1003.001,T1059.001,T1053.005 --edr wazuh

# Check Sysmon config
node agent.js check-sysmon
```
