<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Network Detection Signatures

## Agent Tools

| Tool | Description |
|---|---|
| Author Signature | `author_signature(name, protocol, pattern)` — Author a network detection signature. |
| Analyze Pcap | `analyze_pcap(pcap_path, protocol_filter)` — Analyze a pcap file for detection development. |
| Test Signature | `test_signature(script_path, pcap_path)` — Test a Zeek script against pcap data. |

## CLI Usage

```bash
# Author signature
node agent.js author --name "DNS_Tunnel" --protocol dns --pattern "query_len > 50"
```

```bash
# Analyze pcap
node agent.js analyze --pcap-path captures/traffic.pcap --protocol-filter "dns"
```

```bash
# Test signature
node agent.js test --script-path scripts/dns_tunnel.zeek --pcap-path captures/tunnel.pcap
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
