<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Monitoring Architecture — API Reference

## agent.js CLI

```bash
# Assess monitoring coverage
node scripts/agent.js --action assess --scope all

# Design monitoring architecture
node scripts/agent.js --action design --siem elastic --sources cloud,network,endpoint

# Generate detection rules
node scripts/agent.js --action detections --framework sigma --output rules.json

# Map MITRE ATT&CK coverage
node scripts/agent.js --action coverage --rules rules.json
```

## Sigma CLI

```bash
# Convert Sigma to Elasticsearch
sigma convert -t elasticsearch -p ecs_windows rule.yml

# Convert Sigma to Splunk SPL
sigma convert -t splunk -p splunk_cim rule.yml

# Convert Sigma to KQL (Sentinel)
sigma convert -t microsoft365defender rule.yml

# Validate Sigma rule
sigma check rule.yml
```

## Elasticsearch / Elastic Security

```bash
# Create detection rule
curl -X POST "https://siem:9200/api/detection_engine/rules" \
  -H "kbn-xsrf: true" -H "Content-Type: application/json" \
  -d '{"name":"Rule","type":"query","query":"event.action:*","severity":"high"}'

# Search security events
curl -X POST "https://siem:9200/security-logs-*/_search" \
  -d '{"query":{"bool":{"must":[{"match":{"event.category":"authentication"}},{"match":{"event.outcome":"failure"}}]}}}'
```

## Splunk SPL Quick Reference

```spl
| Search for failed logins
index=auth sourcetype=syslog action=failure
| stats count by src_ip, user
| where count > 10

| Search for lateral movement
index=windows EventCode=4624 Logon_Type=3
| stats dc(dest) as unique_hosts by src_ip
| where unique_hosts > 5
```

## Log Source Priority

| Priority | Source | Rationale |
|----------|--------|-----------|
| P1 | Authentication logs | Detect credential compromise |
| P1 | EDR telemetry | Detect endpoint compromise |
| P1 | Cloud audit logs | Detect cloud misuse |
| P2 | Network flow logs | Detect lateral movement |
| P2 | DNS logs | Detect C2 communication |
| P3 | Application logs | Detect application attacks |
| P3 | Email logs | Detect phishing |
