<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Microsegmentation — API Reference

## agent.js CLI

```bash
# Discover traffic flows
node scripts/agent.js --action discover --source flow-logs

# Generate Kubernetes NetworkPolicies
node scripts/agent.js --action generate --platform kubernetes --namespace production

# Generate AWS security group rules
node scripts/agent.js --action generate --platform aws

# Validate policies
node scripts/agent.js --action validate --policies policies.json

# Deploy in monitor mode
node scripts/agent.js --action deploy --mode monitor
```

## Kubernetes NetworkPolicy CLI

```bash
# Apply network policies
kubectl apply -f network-policies/

# Test connectivity
kubectl exec -n production frontend-pod -- curl -s backend:8080/health

# Verify default deny
kubectl exec -n production frontend-pod -- curl -s --max-time 3 database:5432 || echo "Blocked"

# List network policies
kubectl get networkpolicy -n production
```

## Calico CLI (calicoctl)

```bash
# Apply global network policy
calicoctl apply -f global-policy.yaml

# List policies
calicoctl get globalnetworkpolicy

# Check policy evaluation order
calicoctl get globalnetworkpolicy -o yaml | grep order
```

## AWS Security Group CLI

```bash
# Create security group
aws ec2 create-security-group --group-name NAME --description DESC --vpc-id VPC

# Add ingress rule (source security group)
aws ec2 authorize-security-group-ingress --group-id SG_ID \
  --protocol tcp --port PORT --source-group SOURCE_SG

# Describe security group rules
aws ec2 describe-security-group-rules --filters "Name=group-id,Values=SG_ID"

# Analyze VPC Flow Logs for traffic patterns
aws logs filter-log-events --log-group-name /vpc/flow-logs \
  --filter-pattern "REJECT"
```

## Traffic Flow Discovery

| Source | Command | Coverage |
|--------|---------|----------|
| VPC Flow Logs | `aws logs filter-log-events` | AWS network flows |
| K8s audit logs | `kubectl logs -n kube-system` | Pod-to-pod traffic |
| Calico flow logs | `calicoctl node status` | Calico-managed flows |
| Zeek | `zeek -r capture.pcap` | Full packet analysis |
| Hubble (Cilium) | `hubble observe --namespace prod` | Cilium eBPF flows |
