<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Endpoint Logging Configuration

## Logging Configuration APIs

### Sysmon Event IDs

| Event ID | Description |
|---|---|
| 1 | Process creation |
| 3 | Network connection |
| 6 | Driver loaded |
| 7 | Image loaded (DLL) |
| 8 | CreateRemoteThread |
| 10 | ProcessAccess |
| 11 | FileCreate |
| 12-14 | Registry events |
| 19-21 | WMI events |
| 22 | DNS query |
| 23 | FileDelete (archived) |
| 26 | FileDeleteDetected |

### auditd Rule Syntax

| Rule | Description |
|---|---|
| `-w <path> -p <perms> -k <key>` | File watch rule |
| `-a always,exit -F arch=b64 -S <syscall>` | Syscall audit rule |
| `-a always,exit -F exe=<path>` | Executable-specific rule |

### osquery Configuration

| File | Description |
|---|---|
| `/etc/osquery/osquery.conf` | Main configuration |
| `/etc/osquery/osquery.flags` | Daemon startup flags |
| `/var/log/osquery/osqueryd.results.log` | Query results output |

### Agent Script

```bash
# Check Sysmon status
node agent.js check-sysmon

# Check auditd rules
node agent.js check-auditd

# Validate logging pipeline
node agent.js validate-pipeline
```
