<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Business Email Compromise Patterns

## Commands

| Command | Description |
|---|---|
| `Get-MessageTrace` | Trace email flow for sender/recipient pairs |
| `Get-InboxRule` | List mailbox rules including forwarding |
| `Search-UnifiedAuditLog` | Audit mailbox rule changes |
| `Get-AntiPhishPolicy` | Check impersonation protection settings |
| `New-TransportRule` | Create mail flow rule for BEC detection |
| `Get-MailDetailATPReport` | Get ATP threat detection details |
| `Get-PhishFilterPolicy` | Review anti-phishing configuration |

## Agent Script

```bash
# node agent.js analyze --headers <value>
# node agent.js scan-rules --mailbox <value>
# node agent.js score --text <value>
```
