<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Detection Retrospective Analysis

## Agent Tools

| Tool | Description |
|---|---|
| Analyze Quality | `analyze_quality(alerts_path, period)` — Analyze alert quality metrics for a time period. |
| Assess Coverage | `assess_coverage(rules_dir, framework)` — Assess detection coverage against a framework. |
| Generate Report | `generate_report(metrics_path, output_format)` — Generate retrospective analysis report. |

## CLI Usage

```bash
# Analyze quality
node agent.js quality --alerts-path data/alerts.json --period 2026-Q1
```

```bash
# Assess coverage
node agent.js coverage --rules-dir rules/ --framework mitre-attack
```

```bash
# Generate report
node agent.js report --metrics-path metrics/q1.json --output-format markdown
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
