<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Sigma Rule Development

## Agent Tools

| Tool | Description |
|---|---|
| Rule Author | `author_rule(title, technique, logsource, field, value)` — Generate skeleton |
| Rule Validator | `validate_rule(path)` — Check syntax |
| Rule Converter | `convert_rule(path, target, pipeline)` — Convert to SIEM |

## CLI Usage

```bash
# Author rule
node agent.js author --title "LSASS Access" --technique T1003.001 --logsource process_access --field TargetImage --value lsass.exe

# Validate
node agent.js validate --rule rules/lsass.yml

# Convert
node agent.js convert --rule rules/lsass.yml --target splunk
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
