<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detection Testing Frameworks

## Agent Tools

| Tool | Description |
|---|---|
| Test Creator | `create_test_case(rule, technique, atomic)` — Build test case |
| Suite Runner | `run_test_suite(tests)` — Execute and summarize |
| Failure Analyzer | `analyze_failure(rule, expected, actual)` — Root cause analysis |

## CLI Usage

```bash
# Create test
node agent.js create --rule lsass_access --technique T1003.001 --atomic T1003.001-1

# Run suite
node agent.js suite --tests '[{"rule": "lsass", "result": "pass"}]'

# Analyze failure
node agent.js analyze --rule powershell --expected alert_fires --actual no_alert
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
