<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Email Incident Response

## Triage Commands

```bash
# Extract headers from .eml
grep -E "^(From|To|Subject|Date|Return-Path|Message-ID):" reported.eml

# Extract URLs
grep -oE 'https?://[^ ">\)]+' reported.eml | sort -u

# Hash attachments
node agent.js triage --eml reported.eml
```

## Exchange Online — Message Trace

```powershell
Get-MessageTrace -SenderAddress "attacker@evil.com" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
```

## Exchange Online — Compliance Search and Purge

```powershell
New-ComplianceSearch -Name "IR-001" -ExchangeLocation All -ContentMatchQuery 'from:attacker@evil.com'
Start-ComplianceSearch -Identity "IR-001"
New-ComplianceSearchAction -SearchName "IR-001" -Purge -PurgeType HardDelete
```

## Agent Script

```bash
# Triage email
node agent.js triage --eml reported.eml

# Extract IOCs
node agent.js extract-iocs --eml reported.eml

# Generate block list
node agent.js block-list --eml reported.eml
```
