- name: "Allow API calls"
  type: network
  action: allow
  pattern: "api.example.com"

- name: "Block crypto miners"
  type: network
  action: block
  pattern: "*.coinhive.com"

- name: "Allow Python"
  type: process
  action: allow
  pattern: "python*"

- name: "Block shells"
  type: process
  action: block
  pattern: "/bin/sh"

- name: "Allow config reads"
  type: file
  action: allow
  pattern: "/etc/config.yml"
  operation: read

# List agents
garnetctl list agents

# Export detections
garnetctl export detections --since 24h

# Check agent status
garnetctl status <agent-id>