> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/documentation/core-functions/watchdog-telemetry.md).

# Watchdog Telemetry

This page documents the asynchronous background watchdog thread, automated telemetry reporting, and stealth screen capture capabilities.

## Background Watchdog Thread

The Watchdog subsystem spawns an independent thread that continuously evaluates client integrity, monitors newly spawned processes/windows, and ensures memory protections remain intact throughout the application lifecycle.

### `easyauth::start_background_watchdog`

Starts the asynchronous monitoring loop.

```cpp
void start_background_watchdog(uint32_t interval_ms = 500);
```

#### Parameters

* `interval_ms`: Polling interval in milliseconds (default: `500ms`).

### `easyauth::stop_background_watchdog`

Stops the background watchdog worker.

```cpp
void stop_background_watchdog();
```

### `easyauth::get_background_check_count`

Returns the total number of security cycles executed by the watchdog since startup.

```cpp
uint32_t get_background_check_count();
```

## Screen Capture & Threat Reporting

When suspicious behavior is detected, EasyAuth can capture forensic desktop/window snapshots and upload encrypted incident reports to the dashboard.

### `easyauth::capture_screen`

Captures an unhookable multi-monitor screenshot in Base64 JPEG format.

```cpp
std::string capture_screen(void* target_hwnd = nullptr);
```

#### Parameters

* `target_hwnd` *(Optional)*: If provided, captures only the specified window via `PrintWindow`. If `nullptr`, captures the entire virtual desktop.

### `easyauth::report_suspicious`

Sends a telemetry report with optional forensic visual evidence to the EasyAuth server.

```cpp
bool report_suspicious(
    const std::string& reason,
    const std::string& type = "tamper",
    bool include_screenshot = false,
    const std::string& severity = "suspicious",
    const std::string& api_key = ""
);
```

#### Example

```cpp
if (easyauth::is_debugger_detected()) {
    // Report threat with screenshot to admin dashboard
    easyauth::report_suspicious("Hardware breakpoint detected in thread", "debugger", true, "critical");
    exit(1);
}
```