<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Endpoint Baseline Monitoring

## PowerShell — Capture Baselines

```powershell
# Processes
Get-Process | Select-Object Name, Id, Path | Export-Csv baseline_processes.csv

# Services
Get-WmiObject Win32_Service | Select-Object Name, State, PathName | Export-Csv baseline_services.csv

# Scheduled tasks
Get-ScheduledTask | Select-Object TaskName, State | Export-Csv baseline_tasks.csv

# Listeners
Get-NetTCPConnection -State Listen | Export-Csv baseline_listeners.csv
```

## Linux — File Integrity

```bash
find /etc /usr/bin -type f -exec sha256sum {} \; > baseline.sha256
sha256sum -c baseline.sha256 | grep -v ": OK$"
```

## Agent Script

```bash
node agent.js capture --directory /etc
node agent.js compare --baseline baseline.csv --current current.csv --key Name
node agent.js check-integrity --baseline baseline.csv
```
