# PACT Monitor CLI - API Reference This document provides comprehensive API reference for PACT Monitor CLI commands, including detailed parameter specifications, response formats, and integration examples for real-time monitoring and AI-powered threat detection. ## Table of Contents - [Command Interface](#command-interface) - [Global Options](#global-options) - [Commands](#commands) - [stream](#stream) - [watch](#watch) - [alert](#alert) - [analyze](#analyze) - [export](#export) - [status](#status) - [hunt](#hunt) - [Data Models](#data-models) - [Response Formats](#response-formats) - [Error Handling](#error-handling) - [Integration Examples](#integration-examples) ## Command Interface All PACT Monitor CLI commands follow a consistent interface pattern: ```bash pact-monitor [options] [--global-options] ``` ### Exit Codes - `0`: Success - `1`: General error - `2`: Configuration error - `3`: Network error - `4`: Validation error - `5`: Permission error - `6`: AI/Analysis error ## Global Options These options are available for all commands: | Option | Type | Description | Default | |--------|------|-------------|---------| | `--config ` | string | Path to configuration file | `~/.pactrc` | | `--verbose` | boolean | Enable verbose output | false | | `--no-banner` | boolean | Disable startup banner | false | | `--json` | boolean | Output results in JSON format | false | | `--proof` | boolean | Generate cryptographic proof | false | | `--debug` | boolean | Enable debug mode | false | | `--help` | boolean | Show command help | false | | `--version` | boolean | Show version information | false | ## Commands ### stream Real-time monitoring of directories or API endpoints with automatic analysis capabilities. #### Syntax ```bash pact-monitor stream [options] ``` #### Options | Option | Type | Required | Description | Default | |--------|------|----------|-------------|---------| | `--watch ` | string | No | Directory or endpoint to monitor | './signals' | | `--interval ` | number | No | Polling interval in milliseconds | 5000 | | `--auto-analyze` | boolean | No | Automatically analyze detected changes | false | | `--webhook ` | string | No | Webhook URL for notifications | - | #### Response Format **Standard Output:** ``` 🔍 Starting real-time monitoring... Watching: ./compliance-data Interval: 5s Auto-analyze: enabled Webhook: https://api.example.com/alerts 📁 ADD: compliance-data/entity-001.json 📝 CHANGE: compliance-data/risk-scores.json 🗑️ DELETE: compliance-data/temp-file.json ✓ Analysis triggered for entity-001.json Risk Score: 0.75 (Medium) Issues Found: 2 (KYC incomplete, High transaction volume) ⚡ Webhook notification sent: 200 OK ``` **JSON Output (`--json`):** ```json { "success": true, "monitoring": { "watchPath": "./compliance-data", "interval": 5000, "autoAnalyze": true, "webhook": "https://api.example.com/alerts", "startTime": "2024-08-01T12:00:00Z" }, "events": [ { "type": "ADD", "path": "compliance-data/entity-001.json", "timestamp": "2024-08-01T12:05:23Z", "analysis": { "riskScore": 0.75, "severity": "medium", "issues": ["KYC incomplete", "High transaction volume"] } } ], "proof": "pact-proof-a1b2c3d4e5f6g7h8" } ``` #### Examples ```bash # Basic directory monitoring pact-monitor stream --watch ./compliance-data # Advanced monitoring with webhooks pact-monitor stream --watch ./signals --auto-analyze --webhook https://alerts.example.com # High-frequency monitoring pact-monitor stream --watch ./real-time --interval 1000 --auto-analyze ``` ### watch Pattern-based file monitoring with configurable actions and debouncing. #### Syntax ```bash pact-monitor watch [options] ``` #### Options | Option | Type | Required | Description | Default | |--------|------|----------|-------------|---------| | `--pattern ` | string | No | File pattern to watch | '**/*.json' | | `--action ` | string | No | Action on change | 'validate' | | `--debounce ` | number | No | Debounce delay in milliseconds | 1000 | #### Action Types | Action | Description | Use Case | |--------|-------------|----------| | `validate` | Validate file format and structure | JSON/YAML validation | | `analyze` | Perform compliance analysis | Risk assessment | | `alert` | Trigger alert if thresholds exceeded | Real-time notifications | #### Response Format **Standard Output:** ``` 👀 Watching pattern: **/*.json 🎯 Action: validate ⏱️ Debounce: 1000ms 📄 File changed: data/wallet-001.json ✓ Validation passed Schema: valid JSON Structure: compliant Risk indicators: none 📄 File changed: data/high-risk-entity.json ⚠️ Validation warnings: - Missing KYC verification - Suspicious transaction patterns Action: Alert triggered ``` **JSON Output (`--json`):** ```json { "success": true, "watching": { "pattern": "**/*.json", "action": "validate", "debounce": 1000 }, "events": [ { "file": "data/wallet-001.json", "timestamp": "2024-08-01T12:10:45Z", "action": "validate", "result": { "status": "passed", "schema": "valid", "structure": "compliant", "warnings": [] } } ], "proof": "pact-proof-b2c3d4e5f6g7h8i9" } ``` #### Examples ```bash # Watch JSON files for validation pact-monitor watch --pattern "*.json" --action validate # Watch logs with analysis pact-monitor watch --pattern "**/*.log" --action analyze --debounce 5000 # Watch config files with alerts pact-monitor watch --pattern "config/**/*.yaml" --action alert ``` ### alert Configure and manage intelligent alert rules with multiple notification channels. #### Syntax ```bash pact-monitor alert [options] ``` #### Options | Option | Type | Required | Description | Default | |--------|------|----------|-------------|---------| | `--threshold ` | number | No | Risk threshold for alerts (0.0-1.0) | - | | `--channel ` | string | No | Alert channel | - | | `--list` | boolean | No | List all configured alerts | false | | `--test` | boolean | No | Test alert configuration | false | #### Alert Channels | Channel | Description | Configuration | |---------|-------------|---------------| | `email` | Email notifications | SMTP configuration required | | `slack` | Slack webhook integration | Webhook URL in config | | `webhook` | Custom webhook endpoint | Custom URL and payload | #### Response Format **Standard Output (list):** ``` Alert Configuration: 🚨 High Risk Alert Threshold: 0.8 Channel: slack Status: active Triggers: 23 (last 7 days) ⚠️ Medium Risk Alert Threshold: 0.6 Channel: email Status: active Triggers: 45 (last 7 days) 📧 Webhook Alert Threshold: 0.9 Channel: webhook Status: active Endpoint: https://api.example.com/alerts ``` **JSON Output (`--json`):** ```json { "success": true, "alerts": [ { "id": "alert-high-risk", "threshold": 0.8, "channel": "slack", "status": "active", "triggers": 23, "lastTriggered": "2024-08-01T11:45:00Z", "created": "2024-07-15T10:00:00Z" } ], "totalAlerts": 3, "activeAlerts": 3 } ``` #### Examples ```bash # Configure high-risk alerts pact-monitor alert --threshold 0.9 --channel email # Set up Slack notifications pact-monitor alert --threshold 0.8 --channel slack # Test current configuration pact-monitor alert --test # List all alert rules pact-monitor alert --list ``` ### analyze Comprehensive compliance analysis with entity-specific risk assessment and metrics evaluation. #### Syntax ```bash pact-monitor analyze [options] ``` #### Options | Option | Type | Required | Description | Default | |--------|------|----------|-------------|---------| | `--entity ` | string | No | Specific entity to analyze | - | | `--period ` | string | No | Analysis period | '24h' | | `--metrics ` | string | No | Comma-separated metrics | 'risk,compliance,activity' | #### Time Period Formats | Format | Description | Examples | |--------|-------------|----------| | `Xh` | Hours | 24h, 48h, 72h | | `Xd` | Days | 7d, 14d, 30d | | `Xw` | Weeks | 1w, 2w, 4w | | `Xm` | Months | 1m, 3m, 6m | #### Response Format **Standard Output:** ``` Compliance Analysis for wallet123 📊 Risk Assessment: Overall Risk: 0.65 (Medium) ↗ +0.05 this period Behavioral Risk: 0.58 (Low-Medium) Network Risk: 0.72 (Medium-High) Compliance Risk: 0.60 (Medium) 📈 Activity Metrics: Transaction Volume: 150 transactions Average Amount: $2,350 Unique Counterparties: 23 QR Verifications: 12 🔍 Issues Detected: Medium Risk [2 issues] • High-value transactions without enhanced due diligence • Interaction with medium-risk entities Low Risk [3 issues] • Delayed KYC document updates • Infrequent QR verification activity • Minor compliance documentation gaps 📊 Trend Analysis: Improving (↗ +15% compliance score) ``` **JSON Output (`--json`):** ```json { "success": true, "analysis": { "entity": "wallet123", "period": "24h", "timestamp": "2024-08-01T14:00:00Z", "riskAssessment": { "overall": 0.65, "behavioral": 0.58, "network": 0.72, "compliance": 0.60, "trend": "improving", "change": 0.05 }, "activityMetrics": { "transactionVolume": 150, "averageAmount": 2350, "uniqueCounterparties": 23, "qrVerifications": 12 }, "issues": [ { "severity": "medium", "description": "High-value transactions without enhanced due diligence", "count": 2, "recommendation": "Implement enhanced monitoring for transactions >$10K" } ] }, "proof": "pact-proof-c3d4e5f6g7h8i9j0" } ``` #### Examples ```bash # Analyze specific wallet pact-monitor analyze --entity 0x123...abc --period 48h # Comprehensive system analysis pact-monitor analyze --metrics "risk,compliance,activity" --period 7d # Quick entity check pact-monitor analyze --entity company-alpha --period 24h ``` ### export Export monitoring data and analytics in multiple formats for external analysis and reporting. #### Syntax ```bash pact-monitor export [options] ``` #### Options | Option | Type | Required | Description | Default | |--------|------|----------|-------------|---------| | `--format ` | string | No | Export format | 'json' | | `--output ` | string | No | Output file path | auto-generated | | `--period ` | string | No | Export period | '7d' | | `--filter ` | string | No | Filter query | - | #### Export Formats | Format | Description | Use Case | |--------|-------------|----------| | `json` | Structured JSON data | API integration, analysis | | `csv` | Comma-separated values | Spreadsheet analysis | | `pdf` | PDF report with charts | Executive reporting | #### Filter Queries | Query | Description | Example | |-------|-------------|---------| | `risk>X` | Risk score above threshold | `risk>0.8` | | `type=X` | Specific event type | `type=transaction` | | `entity=X` | Specific entity | `entity=wallet123` | #### Response Format **Standard Output:** ``` ✓ Export completed successfully Format: CSV Period: 7 days Records: 1,247 events File: monitoring-export-20240801.csv Size: 145 KB Export Summary: High Risk Events: 23 Medium Risk Events: 156 Low Risk Events: 1,068 Total Entities: 89 Date Range: 2024-07-25 to 2024-08-01 ``` **JSON Output (`--json`):** ```json { "success": true, "export": { "format": "csv", "period": "7d", "filePath": "./monitoring-export-20240801.csv", "fileSize": "145 KB", "recordCount": 1247, "dateRange": { "start": "2024-07-25T00:00:00Z", "end": "2024-08-01T23:59:59Z" }, "summary": { "highRiskEvents": 23, "mediumRiskEvents": 156, "lowRiskEvents": 1068, "totalEntities": 89 }, "generated": "2024-08-01T15:00:00Z" }, "proof": "pact-proof-d4e5f6g7h8i9j0k1" } ``` #### Examples ```bash # Export recent data as CSV pact-monitor export --format csv --period 7d --output monitoring-report.csv # Export high-risk events pact-monitor export --filter "risk>0.8" --format json --period 30d # Generate PDF executive report pact-monitor export --format pdf --period 30d --output executive-summary.pdf ``` ### status Display current monitoring system status, performance metrics, and active monitor inventory. #### Syntax ```bash pact-monitor status [options] ``` #### Options | Option | Type | Required | Description | Default | |--------|------|----------|-------------|---------| | `--active` | boolean | No | Show only active monitors | false | | `--detailed` | boolean | No | Show detailed statistics | false | #### Response Format **Standard Output:** ``` PACT Monitor System Status 🔍 Active Monitors: 3 📁 Directory: ./compliance-data (5,234 events) 🔍 API: https://api.compliance.com (892 events) 📄 Pattern: **/*.json (1,456 events) 📊 Performance Metrics: Uptime: 72h 14m Total Events: 7,582 Events/Hour: 105 avg Memory Usage: 234 MB CPU Usage: 12% ⚡ Recent Activity (last hour): 📈 Risk events: 23 📋 Compliance events: 67 🔔 Alerts triggered: 4 🚨 Alert Status: High Risk (>0.8): 2 active alerts Medium Risk (>0.6): 5 active alerts System Health: ✅ Operational ``` **JSON Output (`--json`):** ```json { "success": true, "status": { "activeMonitors": 3, "monitors": [ { "id": "monitor-dir-001", "type": "directory", "target": "./compliance-data", "status": "active", "events": 5234, "lastEvent": "2024-08-01T14:45:00Z" } ], "performance": { "uptime": "72h 14m", "totalEvents": 7582, "eventsPerHour": 105, "memoryUsage": "234 MB", "cpuUsage": "12%" }, "recentActivity": { "riskEvents": 23, "complianceEvents": 67, "alertsTriggered": 4 }, "systemHealth": "operational" }, "timestamp": "2024-08-01T15:00:00Z" } ``` #### Examples ```bash # Basic status overview pact-monitor status # Active monitors only pact-monitor status --active # Detailed system metrics pact-monitor status --detailed ``` ### hunt Advanced AI-powered threat hunting with temporal analysis, entity linking, and enforcement capabilities. #### Syntax ```bash pact-monitor hunt [options] ``` #### Options | Option | Type | Required | Description | Default | |--------|------|----------|-------------|---------| | `--backtrack ` | string | No | Duration to scan back | '30d' | | `--type ` | string | No | Specific threat type | all | | `--entity ` | string | No | Target specific entity | - | | `--summary` | boolean | No | Show summary only | false | | `--export ` | string | No | Export results to file | - | | `--link` | boolean | No | Link related entities | false | | `--export-graph ` | string | No | Export graph format | - | | `--revoke-linked` | boolean | No | Revoke compliance NFTs | false | | `--freeze-linked` | boolean | No | Freeze compliance NFTs | false | | `--reason ` | string | No | Reason for NFT actions | - | #### Threat Types | Type | Description | Detection Method | |------|-------------|------------------| | `sanctions-evasion` | Sanctioned entity interactions | Network analysis | | `fraud-patterns` | Coordinated malicious activities | Behavioral clustering | | `mixer-detection` | Privacy coin usage | Transaction analysis | | `compliance-drift` | Gradual compliance degradation | Temporal analysis | #### Backtrack Periods | Period | Description | Data Scope | |--------|-------------|------------| | `30d` | 30 days | Recent patterns | | `60d` | 60 days | Medium-term trends | | `90d` | 90 days | Quarterly analysis | | `180d` | 180 days | Long-term patterns | #### Response Format **Standard Output:** ``` 🔍 AI Threat Hunt - Backtrack: 30 days 📊 Threat Analysis Summary: Entities Analyzed: 1,247 Threats Detected: 23 High Priority: 5 Fraud Rings Identified: 2 🚨 High-Priority Threats: Threat #1: Sanctions Evasion Network Risk Score: 0.94 (Critical) Entities: 7 wallets Pattern: Coordinated transactions with sanctioned addresses Confidence: 87% 🔗 Linked Entities: • 0xABC123...def (Hub/Coordinator) • 0x456789...abc (Active Participant) • 0x789012...def (Active Participant) 📈 Evidence: • Vector similarity: 0.92 • QR code overlap: 3 shared codes • Temporal coordination: 94% overlap • Rule violations: 12 instances 🤖 AI Recommendations: 1. Immediate SAR filing required 2. Freeze all linked entity NFTs 3. Enhanced monitoring for 90 days 4. Investigate infrastructure sharing ⚡ Enforcement Actions Available: --freeze-linked: Freeze compliance NFTs (reversible) --revoke-linked: Revoke compliance NFTs (permanent) ``` **JSON Output (`--json`):** ```json { "success": true, "hunt": { "backtrack": "30d", "type": "all", "startTime": "2024-08-01T15:00:00Z", "analysis": { "entitiesAnalyzed": 1247, "threatsDetected": 23, "highPriority": 5, "fraudRings": 2 }, "threats": [ { "id": "threat-001", "type": "sanctions-evasion", "riskScore": 0.94, "severity": "critical", "entities": ["0xABC123...def", "0x456789...abc"], "pattern": "Coordinated transactions with sanctioned addresses", "confidence": 0.87, "evidence": { "vectorSimilarity": 0.92, "qrOverlap": 3, "temporalCoordination": 0.94, "ruleViolations": 12 }, "recommendations": [ "Immediate SAR filing required", "Freeze all linked entity NFTs", "Enhanced monitoring for 90 days" ] } ], "linkedEntities": [ { "entity": "0xABC123...def", "role": "Hub/Coordinator", "riskScore": 0.94, "connections": 6 } ] }, "proof": "pact-proof-e5f6g7h8i9j0k1l2" } ``` #### Examples ```bash # Basic threat hunt pact-monitor hunt --backtrack 30d --type sanctions-evasion # Advanced analysis with linking pact-monitor hunt --backtrack 90d --link --export-graph json --export fraud-network.json # Entity-specific investigation pact-monitor hunt --entity 0xABC123 --backtrack 60d --summary # Enforcement actions pact-monitor hunt --backtrack 30d --link --freeze-linked --reason "Investigation pending" ``` ## Data Models ### Monitor Model ```typescript interface Monitor { id: string; type: 'directory' | 'api' | 'pattern'; target: string; status: 'active' | 'paused' | 'stopped'; events: number; lastEvent: string; // ISO timestamp configuration: Record; } ``` ### Event Model ```typescript interface MonitoringEvent { id: string; type: 'ADD' | 'CHANGE' | 'DELETE' | 'API_RESPONSE' | 'PATTERN_MATCH'; path: string; timestamp: string; // ISO timestamp riskScore?: number; analysis?: AnalysisResult; metadata: Record; } ``` ### Analysis Result Model ```typescript interface AnalysisResult { riskScore: number; severity: 'low' | 'medium' | 'high' | 'critical'; issues: Issue[]; trends: { direction: 'improving' | 'declining' | 'stable'; change: number; }; recommendations: string[]; } interface Issue { severity: 'low' | 'medium' | 'high'; description: string; count: number; recommendation: string; } ``` ### Threat Model ```typescript interface Threat { id: string; type: 'sanctions-evasion' | 'fraud-patterns' | 'mixer-detection' | 'compliance-drift'; riskScore: number; severity: 'low' | 'medium' | 'high' | 'critical'; entities: string[]; pattern: string; confidence: number; evidence: Evidence; recommendations: string[]; detected: string; // ISO timestamp } interface Evidence { vectorSimilarity?: number; qrOverlap?: number; temporalCoordination?: number; ruleViolations?: number; transactionPatterns?: any[]; } ``` ### Fraud Ring Model ```typescript interface FraudRing { id: string; entities: LinkedEntity[]; coordinationScore: number; riskLevel: 'low' | 'medium' | 'high' | 'critical'; structure: { hubs: string[]; participants: string[]; isolated: string[]; }; evidence: { sharedInfrastructure: string[]; coordinatedActivities: Activity[]; rulesToggetherViolations: Violation[]; }; detected: string; // ISO timestamp } interface LinkedEntity { entity: string; role: 'Hub/Coordinator' | 'Active Participant' | 'Isolated Actor'; riskScore: number; connections: number; } ``` ### Alert Model ```typescript interface Alert { id: string; threshold: number; channel: 'email' | 'slack' | 'webhook'; status: 'active' | 'paused' | 'disabled'; triggers: number; lastTriggered: string; // ISO timestamp configuration: AlertConfiguration; created: string; // ISO timestamp } interface AlertConfiguration { webhook?: string; email?: string; slackChannel?: string; customPayload?: Record; } ``` ## Response Formats ### Success Response ```json { "success": true, "data": { /* command-specific data */ }, "proof": "pact-proof-abc123def456", // if --proof option used "timestamp": "2024-08-01T12:00:00Z" } ``` ### Error Response ```json { "success": false, "error": { "code": "MONITORING_ERROR", "message": "Failed to start monitoring on path './invalid-path'", "details": { "path": "./invalid-path", "reason": "Directory does not exist", "suggestion": "Create directory or specify valid path" } }, "timestamp": "2024-08-01T12:00:00Z" } ``` ## Error Handling ### Error Codes | Code | Description | HTTP Equivalent | |------|-------------|-----------------| | `MONITORING_ERROR` | Monitoring setup failed | 500 | | `PATH_NOT_FOUND` | Invalid path specified | 404 | | `PERMISSION_DENIED` | Insufficient file permissions | 403 | | `ANALYSIS_FAILED` | AI analysis error | 500 | | `DATABASE_ERROR` | Database connectivity issue | 503 | | `VALIDATION_ERROR` | Invalid input parameters | 400 | | `WEBHOOK_ERROR` | Webhook delivery failed | 502 | | `AI_SERVICE_ERROR` | AI service unavailable | 503 | ### Error Handling Examples **File System Monitoring Errors:** ```bash #!/bin/bash # Monitor with error handling if ! pact-monitor stream --watch "$WATCH_DIR" --json > monitoring.json; then echo "Monitoring failed for directory: $WATCH_DIR" # Check if directory exists if [ ! -d "$WATCH_DIR" ]; then echo "Creating directory: $WATCH_DIR" mkdir -p "$WATCH_DIR" # Retry monitoring pact-monitor stream --watch "$WATCH_DIR" fi fi ``` **AI Analysis Error Handling:** ```python import subprocess import json def analyze_entity(entity_id): try: result = subprocess.run([ 'pact-monitor', 'analyze', '--entity', entity_id, '--json' ], capture_output=True, text=True, check=True) return json.loads(result.stdout) except subprocess.CalledProcessError as e: error_data = json.loads(e.stdout) if error_data['error']['code'] == 'AI_SERVICE_ERROR': # Fallback to basic analysis return basic_analysis(entity_id) else: raise Exception(f"Analysis failed: {error_data['error']['message']}") ``` ## Integration Examples ### Real-time Monitoring with Webhooks ```bash #!/bin/bash # Setup real-time monitoring with Slack integration # Configure webhook in Slack SLACK_WEBHOOK="https://hooks.slack.com/services/YOUR/WEBHOOK/URL" # Start monitoring with webhook notifications pact-monitor stream \ --watch ./compliance-data \ --auto-analyze \ --webhook "$SLACK_WEBHOOK" \ --json > monitoring.log & # Store PID for later cleanup echo $! > monitoring.pid echo "Monitoring started with PID: $(cat monitoring.pid)" ``` ### AI Threat Hunting Pipeline ```bash #!/bin/bash # Automated threat hunting pipeline LOG_FILE="/var/log/pact-monitor-hunt.log" DATE=$(date +%Y-%m-%d) echo "[$DATE] Starting threat hunt..." >> "$LOG_FILE" # Run threat hunt with entity linking if hunt_result=$(pact-monitor hunt --backtrack 30d --link --json); then # Extract high-risk threats HIGH_RISK=$(echo "$hunt_result" | jq '.hunt.threats[] | select(.severity == "critical" or .severity == "high")') if [ -n "$HIGH_RISK" ]; then echo "[$DATE] High-risk threats detected" >> "$LOG_FILE" # Generate detailed report pact-monitor hunt --backtrack 30d --link --export "threat-report-$DATE.json" # Take enforcement action for critical threats CRITICAL_THREATS=$(echo "$hunt_result" | jq '.hunt.threats[] | select(.severity == "critical")') if [ -n "$CRITICAL_THREATS" ]; then echo "[$DATE] Taking enforcement action on critical threats" >> "$LOG_FILE" # Freeze linked entities for investigation pact-monitor hunt --backtrack 30d --link --freeze-linked --reason "Critical threat detected - investigation pending" fi fi else echo "[$DATE] Threat hunt failed" >> "$LOG_FILE" fi echo "[$DATE] Threat hunt complete" >> "$LOG_FILE" ``` ### Compliance Dashboard Integration ```javascript // Node.js service for compliance dashboard const { exec } = require('child_process'); const express = require('express'); const app = express(); // Real-time monitoring endpoint app.get('/api/monitoring/status', async (req, res) => { try { const { stdout } = await execAsync('pact-monitor status --json'); const status = JSON.parse(stdout); res.json({ success: true, monitoring: status.status, timestamp: new Date().toISOString() }); } catch (error) { res.status(500).json({ success: false, error: error.message }); } }); // Threat analysis endpoint app.get('/api/threats/:period', async (req, res) => { const { period } = req.params; try { const { stdout } = await execAsync(`pact-monitor hunt --backtrack ${period} --summary --json`); const threats = JSON.parse(stdout); res.json({ success: true, threats: threats.hunt.threats, summary: threats.hunt.analysis }); } catch (error) { res.status(500).json({ success: false, error: error.message }); } }); // Entity analysis endpoint app.get('/api/analyze/:entity', async (req, res) => { const { entity } = req.params; const { period = '24h' } = req.query; try { const { stdout } = await execAsync(`pact-monitor analyze --entity ${entity} --period ${period} --json`); const analysis = JSON.parse(stdout); res.json({ success: true, analysis: analysis.analysis, recommendations: analysis.analysis.recommendations }); } catch (error) { res.status(500).json({ success: false, error: error.message }); } }); function execAsync(command) { return new Promise((resolve, reject) => { exec(command, (error, stdout, stderr) => { if (error) reject(error); else resolve({ stdout, stderr }); }); }); } app.listen(3000, () => { console.log('Compliance dashboard API listening on port 3000'); }); ``` ### Automated Alert Processing ```python #!/usr/bin/env python3 # Automated alert processing with machine learning import subprocess import json import numpy as np from datetime import datetime import smtplib from email.mime.text import MIMEText class ComplianceMonitor: def __init__(self): self.alert_history = [] self.risk_threshold = 0.8 def check_compliance(self): """Run compliance analysis and process alerts""" try: # Get system status result = subprocess.run([ 'pact-monitor', 'status', '--detailed', '--json' ], capture_output=True, text=True, check=True) status = json.loads(result.stdout) # Analyze recent activity if status['status']['recentActivity']['riskEvents'] > 10: self.trigger_investigation() # Check for high-risk entities self.hunt_threats() except subprocess.CalledProcessError as e: self.log_error(f"Compliance check failed: {e}") def hunt_threats(self): """Perform AI threat hunting""" try: result = subprocess.run([ 'pact-monitor', 'hunt', '--backtrack', '24h', '--summary', '--json' ], capture_output=True, text=True, check=True) hunt_data = json.loads(result.stdout) # Process high-risk threats for threat in hunt_data['hunt']['threats']: if threat['severity'] in ['high', 'critical']: self.process_threat(threat) except subprocess.CalledProcessError as e: self.log_error(f"Threat hunting failed: {e}") def process_threat(self, threat): """Process individual threat and take action""" print(f"Processing {threat['severity']} threat: {threat['type']}") # Send alert self.send_alert(threat) # For critical threats, take immediate action if threat['severity'] == 'critical': self.freeze_entities(threat['entities']) def freeze_entities(self, entities): """Freeze compliance NFTs for high-risk entities""" for entity in entities: try: subprocess.run([ 'pact-monitor', 'hunt', '--entity', entity, '--freeze-linked', '--reason', 'Automated freeze - critical threat detected' ], check=True) print(f"Frozen entity: {entity}") except subprocess.CalledProcessError as e: self.log_error(f"Failed to freeze {entity}: {e}") def send_alert(self, threat): """Send alert notification""" message = f""" PACT Monitor Alert Threat Type: {threat['type']} Severity: {threat['severity']} Risk Score: {threat['riskScore']} Entities: {', '.join(threat['entities'])} Pattern: {threat['pattern']} Confidence: {threat['confidence']} Recommendations: {chr(10).join(f"• {rec}" for rec in threat['recommendations'])} """ # Configure SMTP and send email # Implementation depends on your email setup print(f"Alert sent for {threat['type']} threat") def log_error(self, message): """Log error with timestamp""" timestamp = datetime.now().isoformat() print(f"[{timestamp}] ERROR: {message}") if __name__ == "__main__": monitor = ComplianceMonitor() monitor.check_compliance() ``` --- This API reference provides comprehensive documentation for integrating PACT Monitor CLI into compliance monitoring systems and threat detection workflows. For additional support, consult the main [README](README.md) or contact the development team.