<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Performing Log Enrichment Techniques — API Reference

> Enrich log data with threat intelligence, geolocation, and asset context for improved analysis.

## CLI Interface

### Synopsis

```
agent.js --target TARGET [--mode {audit,scan,report}] [--phase PHASE] [OPTIONS]
```

### Arguments

| Argument | Type | Required | Default | Description |
|----------|------|----------|---------|-------------|
| `--target` | string | Yes | — | Target to analyze |
| `--mode` | enum | No | `audit` | Operating mode |
| `--phase` | enum | No | `all` | Execution phase |
| `--output` | path | No | stdout | Output file path |
| `--verbose` | flag | No | `false` | Enable verbose output |
| `--verify` | flag | No | `false` | Run verification checks |
| `--regression` | flag | No | `false` | Run regression tests |

### Modes

| Mode | Description |
|------|-------------|
| `audit` | Primary audit operation for performing-log-enrichment-techniques |
| `scan` | Deep scan of identified targets |
| `report` | Generate structured report output |

### Phases

| Phase | Description |
|-------|-------------|
| `discovery` | Enumerate targets and attack surface |
| `analysis` | Evaluate findings for severity and impact |
| `remediation` | Apply fixes and generate evidence |
| `all` | Execute all phases sequentially |

## Output Schema

### Finding Object

```json
{
  "id": "string — unique finding identifier",
  "severity": "critical | high | medium | low | info",
  "title": "string — short finding title",
  "description": "string — detailed description",
  "remediation": "string — recommended fix",
  "timestamp": "string — ISO 8601 UTC timestamp",
  "status": "open | resolved | accepted"
}
```

### Results Object

```json
{
  "tool": "performing-log-enrichment-techniques",
  "target": "string — analyzed target",
  "mode": "string — operating mode",
  "phase": "string — execution phase",
  "timestamp": "string — ISO 8601 UTC timestamp",
  "findings": ["Finding[]"],
  "summary": {
    "total_findings": "integer",
    "critical": "integer",
    "high": "integer",
    "medium": "integer",
    "low": "integer",
    "info": "integer"
  }
}
```

## Exit Codes

| Code | Meaning |
|------|---------|
| `0` | Success — no critical findings |
| `1` | Error — execution failure |
| `2` | Warning — critical findings detected |

## Integration

### Python Import

```python
from scripts.agent import run_analysis

results = run_analysis(
    target="example.com",
    mode="audit",
    verbose=True,
)
```

### Pipeline Usage

```bash
# Chain with jq for filtering
node scripts/agent.js --target host --mode audit | jq '.findings[] | select(.severity == "critical")'

# Export to file
node scripts/agent.js --target host --mode report --output findings.json
```

## Related

- `SKILL.md` — Technique documentation and workflow
- [MITRE ATT&CK](https://attack.mitre.org/) — Threat framework
- [NIST SP 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) — Controls catalog
