<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Defense-in-Depth — API Reference

## agent.js CLI

```bash
# Inventory all controls
node scripts/agent.js --action inventory --scope all

# Gap analysis against CIS v8
node scripts/agent.js --action gaps --framework cis-v8

# Generate recommendations
node scripts/agent.js --action recommend --gaps gaps.json --output plan.json

# Validate coverage
node scripts/agent.js --action validate --controls inventory.json
```

## CIS Controls v8 Mapping

| Layer | CIS Control | Description |
|-------|------------|-------------|
| Perimeter | CIS 13 | Network Monitoring and Defense |
| Network | CIS 12 | Network Infrastructure Management |
| Endpoint | CIS 10 | Malware Defenses |
| Application | CIS 16 | Application Software Security |
| Data | CIS 3 | Data Protection |
| Identity | CIS 5, 6 | Account Management, Access Control |
| Operations | CIS 17 | Incident Response Management |

## NIST CSF Mapping

| Layer | NIST CSF Function | Categories |
|-------|-------------------|------------|
| Perimeter | Protect (PR) | PR.PT, PR.DS |
| Network | Protect (PR) | PR.AC, PR.PT |
| Endpoint | Protect (PR) | PR.PT, PR.IP |
| Application | Protect (PR) | PR.DS, PR.IP |
| Data | Protect (PR) | PR.DS |
| Identity | Protect (PR) | PR.AC |
| Operations | Respond (RS) | RS.RP, RS.CO |

## Control Types

| Type | Purpose | Example |
|------|---------|---------|
| Preventive | Stop threats before impact | Firewall, encryption, MFA |
| Detective | Identify active threats | IDS, SIEM, audit logs |
| Corrective | Remediate after detection | Incident response, patching |
| Deterrent | Discourage threat actors | Security training, legal warnings |
| Compensating | Alternative when primary unavailable | VPN when segmentation not possible |
