<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Network Baseline Analysis

## Zeek Logs

| Log File | Description | Key Fields |
|---|---|---|
| `conn.log` | Connection summaries | id.orig_h, id.resp_h, id.resp_p, proto, duration, orig_bytes |
| `dns.log` | DNS queries | query, qtype, rcode, id.orig_h |
| `http.log` | HTTP requests | host, uri, method, status_code |
| `ssl.log` | TLS connections | server_name, ja3, ja3s |
| `notice.log` | Zeek notices/alerts | note, msg, src, dst |

## Zeek-Cut Commands

| Command | Description |
|---|---|
| `zeek-cut <fields>` | Extract specific fields from Zeek logs |
| `zeek-cut -d` | Output timestamps in human-readable format |
| `zeek-cut -c` | Include column headers |

## NetFlow Fields (RFC 5101)

| Field | Description |
|---|---|
| `sourceIPv4Address` | Source IP |
| `destinationIPv4Address` | Destination IP |
| `protocolIdentifier` | IP protocol number |
| `octetDeltaCount` | Bytes transferred |
| `packetDeltaCount` | Packets transferred |
| `flowStartMilliseconds` | Flow start time |

## Agent Script

```bash
# Analyze Zeek conn.log
node agent.js analyze-flows /var/log/zeek/conn.log

# Calculate baseline from values
node agent.js baseline bandwidth_daily.txt

# Detect anomalies
node agent.js detect-anomalies /var/log/zeek/conn.log --column 9 --sigma 3.0

# Generate baseline query
node agent.js baseline-query --dimension bandwidth --platform splunk
```
