<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Zero-Day Vulnerability Indicators

## YARA CLI

| Command | Description |
|---|---|
| `yara -r <rules.yar> <dir>` | Recursive scan directory |
| `yara -s <rules.yar> <file>` | Show matching strings |
| `yara -c <rules.yar> <dir>` | Count matches only |
| `yara -t <tag> <rules.yar> <dir>` | Scan rules with specific tag |

## Suricata

| Command | Description |
|---|---|
| `suricata -r <pcap> -l <logdir>` | Analyze PCAP offline |
| `suricatasc -c rule-reload-rules` | Reload rules at runtime |
| `suricatasc -c iface-stat eth0` | Interface statistics |

## Threat Intelligence APIs

| Endpoint | Description |
|---|---|
| `GET api.abuseipdb.com/api/v2/check` | IP reputation check |
| `GET otx.alienvault.com/api/v1/search/pulses` | OTX pulse search |
| `GET api.first.org/data/v1/epss` | EPSS score lookup |

## OpenCanary

| Command | Description |
|---|---|
| `opencanaryd --start` | Start honeypot daemon |
| `opencanaryd --status` | Check daemon status |
| `opencanaryd --stop` | Stop daemon |

## Agent Script

```bash
# YARA scan for exploit artifacts
node agent.js yara webshell_rules.yar /var/www/

# Check logs for anomalies
node agent.js anomalies /var/log/nginx/access.log --threshold 5

# Query threat intelligence
node agent.js threat-intel 192.168.1.100 --type ip
node agent.js threat-intel CVE-2024-3400 --type cve

# nuclei zero-day template scan
node agent.js nuclei-check https://target.example.com
```
