# Run the interactive setup wizard
compliance-cli configure

# Quick mode - only prompts for required settings
compliance-cli configure --quick

# Save to a specific location
compliance-cli configure --output C:\Services\ComplianceMonitor\appsettings.json

# Full interactive setup with service installation
.\scripts\Setup-ComplianceService.ps1

# Custom install location
.\scripts\Setup-ComplianceService.ps1 -InstallPath "D:\Apps\Compliance"

# Only generate config (no service install)
.\scripts\Setup-ComplianceService.ps1 -ConfigOnly

# Uninstall existing service
.\scripts\Setup-ComplianceService.ps1 -Uninstall

# Copy the commented template
copy src\SurePassID.Compliance.Cli\appsettings.template.jsonc appsettings.json

# Edit with any text editor - comments explain each setting
notepad appsettings.json

<ItemGroup>
  <PackageReference Include="SurePassID.Compliance.Runner" />
  <PackageReference Include="SurePassID.Compliance.Events.RestApi" />
  <PackageReference Include="SurePassID.Compliance.Identity.ActiveDirectory" />
  <PackageReference Include="SurePassID.Compliance.Reporting" />
  <PackageReference Include="SurePassID.Compliance.Monitoring" />
</ItemGroup>

using Microsoft.Extensions.DependencyInjection;
using SurePassID.Compliance.Events.RestApi;
using SurePassID.Compliance.Identity.ActiveDirectory;
using SurePassID.Compliance.Runner;

// Configure services
var services = new ServiceCollection();

// Add SurePassID REST API event source
services.AddSurePassIdRestApiEventSource(options =>
{
    options.Endpoint = "https://mfa.company.com/api/mfa/v1";
    options.ApiKeyId = "your-api-key-id";
    options.ApiKey = "your-api-key";
});

// Add identity provider
services.AddActiveDirectoryIdentityProvider(options =>
{
    options.Server = "dc01.contoso.com";
    options.BaseDn = "DC=contoso,DC=com";
    options.UseIntegratedAuth = true;
});

// Add compliance runner
services.AddComplianceRunner();

var provider = services.BuildServiceProvider();
var runner = provider.GetRequiredService<IComplianceRunner>();

// Run compliance check
var result = await runner.RunAsync(new ComplianceRunRequest
{
    Start = DateTimeOffset.UtcNow.AddDays(-1),
    End = DateTimeOffset.UtcNow,
    PrivilegedGroupNamesOrDns = ["Domain Admins", "Enterprise Admins"],
    Reports = [ReportType.PrivilegedAuthReport, ReportType.SfaMfaSummary]
});

Console.WriteLine($"Events analyzed: {result.Summary.EventsIngested}");
Console.WriteLine($"MFA rate: {result.Summary.MfaPercentage}%");

# Interactive configuration wizard
compliance-cli configure

# Quick setup - required fields only
compliance-cli configure --quick

# Save to custom location
compliance-cli configure --output /path/to/appsettings.json

# Test configuration after saving
compliance-cli configure --test

# Run with defaults (24-hour lookback)
compliance-cli run

# Custom time range
compliance-cli run --start "2024-01-15" --end "2024-01-16"

# Custom lookback
compliance-cli run --lookback 48

# Specific groups
compliance-cli run --groups "Domain Admins" "DBA Admins" "Healthcare IT"

# All output formats
compliance-cli run --format all --output ./reports

# Specific output format (json, csv, pdf, html, or all)
compliance-cli run --format csv

# Omit --format to use the ReportFormats section of appsettings.json
# (JSON is always generated; PDF/HTML/CSV are controlled by configuration)
compliance-cli run

# Generate evidence pack
compliance-cli run --evidence-pack

# Quiet mode (JSON output for automation)
compliance-cli run --quiet

# Custom config file
compliance-cli run --config /path/to/appsettings.json

# Verbose logging
compliance-cli run --verbose

{
  "ComplianceService": {
    "Enabled": true,
    "CronSchedule": "0 2 * * *",
    "TimeZone": "UTC",
    "RunOnStartup": false,
    "LookbackHours": 24,
    "PrivilegedGroups": ["Domain Admins", "Enterprise Admins"],
    "OutputDirectory": "./ComplianceReports",
    "RetentionDays": 90,
    "MaxConsecutiveFailures": 3
  },
  "ReportFormats": {
    "Json": true,
    "Pdf": false,
    "Html": false,
    "Csv": false
  }
}

{
  "EventSources": {
    "SurePassID": { "Enabled": true },
    "WindowsEventLog": { "Enabled": true },
    "JsonFile": {
      "Enabled": false,
      "DirectoryPath": "./Events",
      "FilePattern": "*.json"
    },
    "Syslog": { "Enabled": false }
  }
}

{
  "WindowsEventLog": {
    "LogName": "Security",
    "ComputerNames": [],
    "IncludeSuccessfulLogons": true,
    "IncludeFailedLogons": true,
    "IncludeLockouts": true,
    "ExcludeMachineAccounts": true,
    "ExcludeSystemAccounts": true,
    "MaxEventsPerQuery": 10000
  }
}

{
  "SurePassID": {
    "Endpoint": "https://mfa.company.com/api/mfa/v1",
    "ApiKeyId": "your-api-key-id",
    "ApiKey": "your-api-key",
    "UseHttpHeader": true,
    "MaxEventsPerRequest": 1000,
    "TimeoutSeconds": 30,
    "RetryCount": 3,
    "RetryDelaySeconds": 2,
    "EnableTracing": false,
    "ProxyAddress": null,
    "IgnoreSyncStatus": true,
    "PreferJsonBulkFormat": true
  }
}

# Using double underscore separator
export ComplianceService__CronSchedule="0 3 * * *"
export ActiveDirectory__Server="dc02.domain.com"
export SurePassID__Endpoint="https://mfa.company.com/api/mfa/v1"
export SurePassID__ApiKeyId="compliance-api"
export SurePassID__ApiKey="your-secret-key"

services.AddJsonFileEventSource(options =>
{
    options.DirectoryPath = "./Events";
    options.FilePattern = "*.json";
    options.Format = JsonEventFormat.JsonFlat;
    options.FieldMappings = new JsonFieldMappings
    {
        EventId = "eventId",
        EventTime = "timestamp",
        Username = "user",
        Result = "status",
        MfaMethod = "authMethod"
    };
});

services.AddSyslogEventSource(options =>
{
    options.Path = "/var/log";
    options.FilePattern = "auth*.log";
    options.Format = SyslogFormat.Rfc5424;
});

services.AddWindowsEventLogSource(options =>
{
    options.LogName = "Security";
    options.EventIds = [4624, 4625, 4740];
    options.ExcludeMachineAccounts = true;
});

services.AddSurePassIdRestApiEventSource(options =>
{
    options.Endpoint = "https://mfa.company.com/api/mfa/v1";
    options.ApiKeyId = "your-api-key-id";
    options.ApiKey = "your-api-key";
    options.UseHttpHeader = true;
    options.MaxEventsPerRequest = 1000;

    // Server-side date filtering: startDateUtc and endDateUtc are passed to the
    // server automatically from the EventQuery time range, limiting data returned.

    // Sync status control:
    // true  = re-read all events in time range (best for compliance reports)
    // false = only new/unsynced events (best for continuous monitoring)
    options.IgnoreSyncStatus = true;

    // JSON bulk format: richer data including Tenant, AuthMethod, SsoIdentity,
    // and UserEmail fields. Falls back to legacy piped format automatically
    // if the server does not support JSON.
    options.PreferJsonBulkFormat = true;
});

// Via Graph API
services.AddEntraIdGraphEventSource(options =>
{
    options.TenantId = "your-tenant-id";
    options.ClientId = "your-client-id";
    options.ClientSecret = "your-client-secret";
});

// Via JSON export
services.AddEntraIdJsonEventSource(options =>
{
    options.DirectoryPath = "./EntraIdLogs";
    options.FilePattern = "*.json";
    options.Format = EntraIdJsonFormat.AzurePortalExport;
});

services.AddActiveDirectoryIdentityProvider(options =>
{
    options.Server = "dc01.contoso.com";
    options.BaseDn = "DC=contoso,DC=com";
    options.UseIntegratedAuth = true;
    // Or explicit credentials:
    // options.Username = "svc_compliance@contoso.com";
    // options.Password = "password";
    options.UseSsl = false;
});

services.AddSurePassIdIdentityProvider(options =>
{
    options.Endpoint = "https://mfa.company.com/api/mfa/v1";
    options.ApiKeyId = "your-api-key-id";
    options.ApiKey = "your-api-key";
    options.PrivilegeStrategy = SurePassIdPrivilegeStrategy.MfaEnrolled;
    options.FlagBypassUsers = true;
});

{
  "MfaCoverage": {
    "Enabled": true,
    "TimeWindowMinutes": 5,
    "RequireIpMatch": false,
    "EnableFindUserLookup": true,
    "PrivilegedUsersOnly": true
  }
}

# Use the wizard to regenerate config
compliance-cli configure

# Test configuration
compliance-cli configure --test

// Enable debug logging
services.AddLogging(builder =>
{
    builder.SetMinimumLevel(LogLevel.Debug);
    builder.AddConsole();
    builder.AddFilter("SurePassID.Compliance", LogLevel.Debug);
});

public interface IComplianceRunner
{
    Task<ComplianceRunResult> RunAsync(
        ComplianceRunRequest request,
        CancellationToken cancellationToken = default);
}

public interface IAuthEventSource
{
    string SourceName { get; }
    
    Task<IReadOnlyList<AuthEvent>> FetchAsync(
        EventQuery query,
        CancellationToken cancellationToken = default);
    
    Task<bool> TestConnectivityAsync(
        CancellationToken cancellationToken = default);
}

public interface IIdentityProvider
{
    string ProviderName { get; }
    
    Task<IReadOnlyList<IdentityRecord>> GetUsersAsync(
        IdentityQuery query,
        CancellationToken cancellationToken = default);
    
    Task<IReadOnlyList<PrivilegeSnapshot>> GetPrivilegeSnapshotAsync(
        PrivilegeQuery query,
        CancellationToken cancellationToken = default);
}

public enum AuthFactorClassification
{
    Unknown = 0,
    Sfa = 1,  // Single-factor
    Mfa = 2   // Multi-factor
}

public enum MfaMethod
{
    Unknown = 0,
    Otp = 1,           // TOTP/HOTP authenticator codes
    Push = 2,          // Push notification (Authenticator app)
    Sms = 3,           // SMS one-time code
    Email = 4,         // Email one-time code
    Fido2 = 5,         // FIDO2/WebAuthn/Passkey
    Voice = 6,         // Voice call verification
    Biometric = 7,     // Biometric (Windows Hello, fingerprint)
    HardwareToken = 8  // Hardware OATH token/FOB
}