<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Suricata Rule Engineering

## Agent Tools

| Tool | Description |
|---|---|
| Author Rule | `author_rule(msg, protocol, content, sid)` — Author a Suricata rule skeleton. |
| Validate Rule | `validate_rule(rule_path)` — Validate Suricata rule syntax. |
| Test Pcap | `test_pcap(rule_path, pcap_path)` — Test a rule against a pcap file. |

## CLI Usage

```bash
# Author rule
node agent.js author --msg "MALWARE C2 Beacon" --protocol http --content "GET" "/beacon" --sid 2026001
```

```bash
# Validate
node agent.js validate --rule rules/c2_beacon.rules
```

```bash
# Test pcap
node agent.js test --rule rules/c2_beacon.rules --pcap samples/c2_traffic.pcap
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
