<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Detection Content Library

## Sigma CLI

| Command | Description |
|---|---|
| `sigma check <rule>` | Validate rule syntax |
| `sigma convert -t <backend> -p <pipeline> <rule>` | Convert to SIEM query |
| `sigma list backends` | List available backends |
| `sigma list pipelines` | List processing pipelines |

## YARA CLI

| Command | Description |
|---|---|
| `yara -C <rule>` | Compile and check rule syntax |
| `yara <rule> <target>` | Scan target with rule |
| `yara -r <rule> <dir>` | Recursive directory scan |

## Suricata CLI

| Command | Description |
|---|---|
| `suricata -T -S <rule>` | Test rule syntax |
| `suricata -r <pcap> -S <rule>` | Run rule against PCAP |

## Agent Script

```bash
# Create Sigma rule
node agent.js create-rule --type sigma --technique T1003.001 \
  --title "LSASS Memory Access" --output sigma/cred/lsass.yml

# Validate all rules
node agent.js validate-rules --rules-dir detection-library/

# Deploy to backends
node agent.js deploy-rules --rules-dir sigma/ \
  --backends splunk,elasticsearch --output deployed/

# Library statistics
node agent.js library-stats --rules-dir sigma/ --output stats.json
```
