<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Endpoint Detection Engineering

## Agent Tools

| Tool | Description |
|---|---|
| Author Rule | `author_rule(technique, platform, telemetry_source, indicators)` — Author an endpoint detection rule. |
| Validate Config | `validate_config(config_path, platform)` — Validate endpoint collection configuration. |
| Simulate Technique | `simulate_technique(technique, platform)` — Generate simulation command for technique validation. |

## CLI Usage

```bash
# Author rule
node agent.js author --technique T1003.001 --platform windows --telemetry-source sysmon --indicators lsass.exe 0x1010
```

```bash
# Validate config
node agent.js validate --config-path configs/sysmon.xml --platform windows
```

```bash
# Simulate
node agent.js simulate --technique T1003.001 --platform windows
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
