<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Endpoint Telemetry

## Sysmon Event IDs

| EID | Category | Key Fields |
|---|---|---|
| 1 | Process Create | Image, CommandLine, ParentImage, User |
| 3 | Network Connect | DestinationIp, DestinationPort, Image |
| 7 | Image Load | ImageLoaded, Signed, Signature |
| 8 | CreateRemoteThread | SourceImage, TargetImage |
| 10 | Process Access | SourceImage, TargetImage, GrantedAccess |
| 11 | File Create | TargetFilename, Image |
| 12/13 | Registry | TargetObject, Details, Image |
| 22 | DNS Query | QueryName, QueryResults, Image |

## Microsoft Defender Tables

| Table | Description |
|---|---|
| `DeviceProcessEvents` | Process creation and injection |
| `DeviceNetworkEvents` | Network connections |
| `DeviceFileEvents` | File system operations |
| `DeviceRegistryEvents` | Registry modifications |
| `DeviceImageLoadEvents` | DLL/image loading |
| `DeviceLogonEvents` | Authentication events |

## Agent Script

```bash
# Build process tree
node agent.js process-tree sysmon_eid1.json

# Detect suspicious parent-child pairs
node agent.js suspicious-parents sysmon_eid1.json

# Generate hunt query for encoded PowerShell
node agent.js hunt-query --type encoded_powershell --platform kql
```
