<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Database Activity Monitoring — API Reference

## Analyze Audit Logs

```bash
node scripts/agent.js --action analyze --input /var/log/pg_audit.log
node scripts/agent.js --action analyze --input /var/log/pg_audit.log --output /tmp/dam.json
```

## Check Audit Configuration

```bash
node scripts/agent.js --action audit-config --dbtype postgresql --config /etc/postgresql/postgresql.conf
node scripts/agent.js --action audit-config --dbtype mysql --config /etc/mysql/my.cnf
```

## Generate Query Baseline

```bash
node scripts/agent.js --action baseline --input /var/log/pg_audit.log --output /tmp/baseline.json
```

## Anomaly Patterns Detected

| Pattern | Description | Severity |
|---------|-------------|----------|
| ddl_change | CREATE/ALTER/DROP operations | High |
| privilege_escalation | GRANT/REVOKE admin privileges | Critical |
| bulk_export | SELECT * / COPY TO / INTO OUTFILE | High |
| schema_dump | pg_dump / mysqldump / INFORMATION_SCHEMA | High |
| injection_indicator | UNION SELECT / OR 1=1 / comment injection | Critical |
| user_creation | CREATE USER/ROLE/LOGIN | High |
| data_modification | DELETE/UPDATE without WHERE clause | High |

## Output Format

```json
{
  "type": "privilege_escalation",
  "line": 847,
  "severity": "critical",
  "context": "GRANT ALL PRIVILEGES ON *.* TO 'backup_user'@'%'"
}
```
