<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Unauthorized Data Access Detection — API Reference

## Analyze Access Logs

```bash
node scripts/agent.js --action analyze --input /var/log/data_access.log
```

## Detect Off-Hours Access

```bash
node scripts/agent.js --action off-hours --input /var/log/data_access.log --start-hour 8 --end-hour 18
```

## Detect Volume Anomalies

```bash
node scripts/agent.js --action volume --input /var/log/data_access.log --threshold 1000
```

## Access Anomaly Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| bulk_query | SELECT * operations | High |
| export_operation | COPY/EXPORT/DUMP commands | High |
| privilege_escalation | GRANT/ALTER ROLE/sudo | Critical |
| service_account_login | Service account interactive login | Critical |
| sensitive_table_access | Access to sensitive tables | High |

## Output Format

```json
{
  "indicator": "privilege_escalation",
  "severity": "critical",
  "line": 1247,
  "context": "2025-03-15 02:15:00 user=jdoe GRANT ALL ON customers TO temp_role"
}
```

## Off-Hours Output

```json
{
  "line": 892,
  "timestamp": "2025-03-15T02:30:00",
  "hour": 2,
  "context": "SELECT * FROM employees WHERE salary > 100000"
}
```
