<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing User Behavior Analytics

## Behavioral Dimensions

| Dimension | Data Source | Anomaly Indicator |
|---|---|---|
| Login time | Auth logs | Outside normal hours (z-score > 2) |
| Login location | GeoIP enrichment | New country or impossible travel |
| Access patterns | File/app logs | First-time resource access |
| Data volume | Proxy/DLP | Downloads > 3 std deviations |
| Privilege usage | Admin logs | Unusual admin operations |
| Peer group | HR + AD data | Activity diverges from peer baseline |

## Risk Score Weights

| Factor | Weight | Threshold |
|---|---|---|
| `impossible_travel` | 30 | Two logins > 500mi apart in < 2h |
| `excessive_downloads` | 25 | Bytes > 3 std deviations |
| `privilege_escalation` | 20 | New admin actions not in baseline |
| `unusual_login_time` | 15 | Login > 2 std from mean hour |
| `failed_auth_spike` | 15 | > 10 failures in 5 minutes |
| `first_time_access` | 10 | Resource never accessed before |
| `peer_group_deviation` | 10 | Activity > 2 std from peer mean |

## Agent Script

```bash
# Calculate risk score from events
node agent.js risk-score events.json

# Analyze login patterns
node agent.js analyze-logins auth_log.csv

# Generate baseline query for login time
node agent.js baseline-query --dimension login_time --platform splunk
```
