<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Email Authentication Monitoring

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js parse-rua --report <xml>` | Parse DMARC aggregate report |
| `node agent.js batch-parse --report-dir <dir> --output <file>` | Batch parse reports |
| `node agent.js failing-sources --report <xml>` | Extract failing source IPs |
| `node agent.js sender-inventory --report-dir <dir> --known-senders <file>` | Build sender inventory |
| `node agent.js shadow-senders --report-dir <dir> --known-senders <file>` | Detect shadow IT senders |
| `node agent.js check-threshold --report <xml> --max-fail-rate <float>` | Alert on high failure rate |
| `node agent.js audit-dns --domain <domain>` | Audit SPF/DKIM/DMARC DNS records |
| `node agent.js generate-sigma --detection-type dmarc-failure` | Generate Sigma rule |

### Examples

```bash
node agent.js parse-rua --report /tmp/dmarc_report.xml
node agent.js shadow-senders --report-dir /tmp/reports/ --known-senders /tmp/authorized.txt
node agent.js audit-dns --domain company.com
```
