<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Adversary-in-the-Middle Phishing

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js analyze-signins --log-file <json>` | Analyze sign-in logs for AiTM |
| `node agent.js detect-impossible-travel --log-file <json> --max-speed-kmh <n>` | Detect impossible travel |
| `node agent.js detect-session-anomaly --log-file <json>` | Detect session cookie replay |
| `node agent.js generate-kql --detection-type aitm-signin` | Generate KQL query |
| `node agent.js generate-sigma --detection-type session-replay` | Generate Sigma rule |
| `node agent.js generate-splunk --detection-type impossible-travel` | Generate Splunk query |
| `node agent.js hardening-report --tenant <domain>` | Hardening recommendations |
| `node agent.js audit-mfa --log-file <json>` | Audit MFA methods |

### Examples

```bash
node agent.js analyze-signins --log-file /tmp/signin_logs.json
node agent.js hardening-report --tenant company.com
node agent.js audit-mfa --log-file /tmp/signin_logs.json
```
