<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Configuring Sysmon Monitoring

## Sysmon CLI

| Command | Description |
|---|---|
| `sysmon64 -accepteula -i config.xml` | Install with config |
| `sysmon64 -c config.xml` | Update running config |
| `sysmon64 -c` | Display current config |
| `sysmon64 -u` | Uninstall Sysmon |
| `sysmon64 -s` | Print config schema |
| `sc query sysmon64` | Check service status |

## PowerShell Queries

```powershell
# Recent Sysmon events
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 20

# Process creation events (EID 1)
Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-Sysmon/Operational"; Id=1} -MaxEvents 10

# Network connections (EID 3)
Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-Sysmon/Operational"; Id=3} -MaxEvents 10
```

## Agent Script

```bash
# Parse Sysmon config
node agent.js parse sysmonconfig.xml

# Validate config
node agent.js validate sysmonconfig.xml

# List Event IDs
node agent.js list-eids

# Generate rule fragment
node agent.js generate-rule --event-type ProcessAccess --match include \
  --condition "TargetImage:is:C:\Windows\System32\lsass.exe"
```
