<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Phishing Incident Playbooks

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js create-incident --reporter <email> --email-file <file> --tier <1-4>` | Create incident |
| `node agent.js classify --email-file <file>` | Auto-classify phishing type |
| `node agent.js scope-search --message-id <id> --sender <email>` | Search for recipients |
| `node agent.js contain --incident-id <id> --actions <list>` | Containment actions |
| `node agent.js generate-purge --sender <email> --subject <text>` | M365 purge script |
| `node agent.js revoke-sessions --user <email>` | Revoke sessions |
| `node agent.js collect-evidence --incident-id <id> --email-file <file> --output <dir>` | Collect evidence |
| `node agent.js extract-iocs --email-file <file>` | Extract IOCs |
| `node agent.js post-incident --incident-id <id> --output <file>` | Post-incident report |

### Examples

```bash
node agent.js create-incident --reporter user@company.com --email-file /tmp/phish.eml --tier 1
node agent.js classify --email-file /tmp/phish.eml
node agent.js contain --incident-id INC-001 --actions quarantine,block_sender
```
