<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Insider Threat Awareness

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js indicators --category behavioral --format training` | Generate behavioral indicator training materials |
| `node agent.js scenarios --risk-level high --department finance` | Build department-specific insider threat scenarios |
| `node agent.js reporting --channels anonymous,manager,security` | Design insider threat reporting workflow |
| `node agent.js assess --maturity current --framework nittf` | Assess program maturity against NITTF framework |

### Examples

```bash
# Generate behavioral indicator training materials
node agent.js indicators --category behavioral --format training

# Build department-specific insider threat scenarios
node agent.js scenarios --risk-level high --department finance

# Design insider threat reporting workflow
node agent.js reporting --channels anonymous,manager,security

# Assess program maturity against NITTF framework
node agent.js assess --maturity current --framework nittf
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| Microsoft Purview | `purview-dlp --policy-status` | Data loss prevention monitoring |
| Securonix UEBA | `securonix --risk-scores --department finance` | User behavior analytics |
| EthicsPoint | `ethicspoint --report-stats --quarter Q1` | Anonymous reporting platform |

## Compliance Frameworks

| Standard | Training Requirement |
|---|---|
| NITTF | National Insider Threat Task Force maturity framework |
| CISA Insider Threat | CISA insider threat mitigation guidance |
| CERT Insider Threat | Carnegie Mellon CERT insider threat best practices |
| NIST SP 800-53 PS | Personnel security controls family |
