<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Data Exfiltration Detection — API Reference

## Scan Logs for Exfiltration Indicators

```bash
node scripts/agent.js --action scan --input /var/log/proxy.log
node scripts/agent.js --action scan --input /var/log/proxy.log --output /tmp/exfil.json
```

## DNS Entropy Analysis

```bash
node scripts/agent.js --action dns-entropy --input /var/log/dns.log --threshold 3.5
```

## Volumetric Anomaly Detection

```bash
node scripts/agent.js --action volume --input /var/log/netflow.json --baseline-mb 100
```

## Exfiltration Indicators

| Indicator | Pattern | Risk |
|-----------|---------|------|
| cloud_upload | Mega, Dropbox, Google Drive, WeTransfer | High |
| paste_site | Pastebin, Ghostbin, Hastebin | High |
| file_share | AnonFiles, file.io, transfer.sh | High |
| base64_url | Large Base64 data in URL parameters | Medium |
| large_dns_query | DNS subdomain > 30 chars | Medium |

## Output Format

```json
{
  "indicator": "cloud_upload",
  "line": 1042,
  "matched": "mega.nz",
  "context": "POST https://mega.nz/upload ..."
}
```

## DNS Tunneling Output

```json
{
  "domain": "aGVsbG8gd29ybGQ.evil.com",
  "subdomain_length": 32,
  "entropy": 4.12,
  "indicator": "dns_tunneling"
}
```
