<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Detecting Email Data Leakage

## Sensitive Data Patterns

| Pattern | Regex |
|---|---|
| SSN | `\b\d{3}-\d{2}-\d{4}\b` |
| Credit Card | `\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\b` |
| AWS Key | `\bAKIA[0-9A-Z]{16}\b` |
| API Key | `\b(?:sk\|pk\|api)[_-][a-zA-Z0-9]{20,}\b` |

## YARA DLP Rules

```bash
yara dlp_patterns.yar attachment.xlsx
```

## KQL — Outbound Volume Anomaly

```kql
EmailEvents
| where DeliveryDirection == "Outbound"
| summarize count(), sum(EmailSize) by SenderAddress
| where count_ > 50
```

## Agent Script

```bash
node agent.js scan-file --file document.txt
node agent.js scan-eml --eml message.eml
node agent.js check-encrypted --file attachment.zip
```
