chron-mcp 0.1.13 → 0.1.17

package/README.md

@@ -24,6 +24,8 @@ Chron fixes that. Every exchange is logged with a precise local datetime (includ
 
 ## Install
 
+**MCP server** (for Claude Desktop, Claude Code, Cursor, Windsurf):
+
 Add to your AI tool's MCP config:
 
 ```json
@@ -37,10 +39,46 @@ Add to your AI tool's MCP config:
 }
 ```
 
+**CLI** (for `chron history`, `chron connect`, `chron export`, etc.):
+
+```bash
+npm install -g chron-mcp
+```
+
+> `npx chron-mcp` starts the MCP server only — it does not put the `chron` CLI command in your PATH. You need a global install for the CLI.
+
 First run creates `~/.chron/chron.db` automatically. No database setup, no env vars, no migrations.
 
 ---
 
+## CLI
+
+After `npm install -g chron-mcp`, the `chron` command is available globally:
+
+```
+Usage: chron <command> [options]
+
+Commands:
+  history         List sessions or show full log for a session
+  report          Aggregate audit stats across sessions
+  export          Export a session as markdown
+  secrets         List detected secrets across sessions
+  settings        View current configuration
+  connect         Connect to a SIEM integration (crowdstrike, sentinel, splunk)
+
+Options (history):
+  --limit=<n>     Max sessions to show (default: 20)
+  <id-prefix>     Show full log for the session with this ID prefix
+
+Options (report):
+  --since=<range> Filter by date: 7d, 30d, or YYYY-MM-DD (default: all time)
+
+Options (export / secrets):
+  <id-prefix>     Scope to a single session
+```
+
+---
+
 ## What it logs
 
 Every exchange is recorded with precise local timestamps — user message when received, assistant response when sent:
@@ -173,6 +211,261 @@ This turns your local log into a verifiable audit artifact. Any edit to a stored
 
 ---
 
+## CrowdStrike LogScale integration
+
+Stream AI session telemetry directly from developer machines into your CrowdStrike LogScale repository. No relay service — events go straight to your own LogScale instance.
+
+**What gets sent:** session starts, message counts (role only), and masked credential detections. Message content never leaves the machine.
+
+### Setup
+
+**1. Create a LogScale repository and ingest token**
+
+In Falcon console → **Log Management** → **Repositories** → **New repository** (name it `ChronAIEvents`).  
+Then **Settings** → **API Tokens** → **Add token** → select **Ingest** permission → copy the token.
+
+Your ingest URL follows this pattern:
+```
+https://<your-cluster>.humio.com/api/v1/ingest/humio-structured
+```
+
+**2. Install the CLI and run the onboarding wizard**
+
+```bash
+npm install -g chron-mcp
+chron connect crowdstrike
+# Paste your ingest URL and token when prompted
+# The wizard sends a test event and confirms before saving
+```
+
+**3. Add env vars to your MCP client config**
+
+The wizard prints the exact block to paste. For Claude Code, add to the `chron` entry in `~/.claude.json`:
+
+```json
+{
+  "mcpServers": {
+    "chron": {
+      "command": "npx",
+      "args": ["-y", "chron-mcp"],
+      "env": {
+        "CHRON_LOGSCALE_URL": "https://<your-cluster>.humio.com/api/v1/ingest/humio-structured",
+        "CHRON_LOGSCALE_TOKEN": "<your-ingest-token>"
+      }
+    }
+  }
+}
+```
+
+Restart your AI tool to pick up the new env vars.
+
+**4. Import the pre-built dashboard**
+
+In Falcon → **Log Management** → **Dashboards** → **Import**:
+```
+node_modules/chron-mcp/dashboards/logscale/chron-ai-activity.yaml
+```
+
+Full guide with SOC alert setup: [dashboards/logscale/README.md](dashboards/logscale/README.md)
+
+### Env vars
+
+| Env var | Description |
+|---|---|
+| `CHRON_LOGSCALE_URL` | LogScale ingest endpoint |
+| `CHRON_LOGSCALE_TOKEN` | LogScale ingest token |
+
+Both must be set for events to flow. If unset, the integration is silently disabled.
+
+---
+
+## Splunk integration
+
+Stream AI session telemetry into Splunk via HTTP Event Collector (HEC). Works with Splunk Enterprise, Splunk Cloud, and a local Docker instance.
+
+**What gets sent:** session starts, message counts (role only), and masked credential detections. Message content never leaves the machine.
+
+### Setup
+
+**Option A — Local Docker (fastest, no account needed)**
+
+```bash
+# Start a local Splunk instance (Apple Silicon: --platform linux/amd64 is required)
+docker run -d --name splunk-chron \
+  --platform linux/amd64 \
+  -p 8000:8000 -p 8088:8088 \
+  -e SPLUNK_START_ARGS=--accept-license \
+  -e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com \
+  -e SPLUNK_PASSWORD=Admin1234! \
+  -e SPLUNK_HEC_TOKEN=chron-test-token \
+  splunk/splunk:latest
+
+# Wait ~2 minutes, then watch until ready:
+docker logs -f splunk-chron 2>&1 | grep -i "Ansible playbook complete"
+```
+
+**Option B — Splunk Enterprise or Cloud**
+
+Settings → **Data Inputs** → **HTTP Event Collector** → **New Token** → name it `chron-ingest` → source type `chron:event` → copy the token.
+
+**2. Install the CLI and run the onboarding wizard**
+
+```bash
+npm install -g chron-mcp
+chron connect splunk
+# For local Docker: URL = https://localhost:8088, Token = chron-test-token
+# TLS verification is skipped automatically for localhost (self-signed cert)
+```
+
+**3. Add env vars to your MCP client config**
+
+The wizard prints the exact block to paste. For Claude Code, add to `~/.claude.json`:
+
+```json
+{
+  "mcpServers": {
+    "chron": {
+      "command": "npx",
+      "args": ["-y", "chron-mcp"],
+      "env": {
+        "CHRON_SPLUNK_URL": "https://localhost:8088",
+        "CHRON_SPLUNK_TOKEN": "chron-test-token",
+        "CHRON_SPLUNK_INSECURE": "1"
+      }
+    }
+  }
+}
+```
+
+> Remove `CHRON_SPLUNK_INSECURE` for production Splunk instances with valid TLS certificates.
+
+Restart your AI tool to pick up the new env vars.
+
+**4. Search in Splunk**
+
+Open [http://localhost:8000](http://localhost:8000) → **Search & Reporting** → run:
+```
+sourcetype="chron:event"
+```
+
+Events appear in real time as you have AI conversations.
+
+Full guide with dashboard templates and alert setup: [dashboards/splunk/README.md](dashboards/splunk/README.md)
+
+### Env vars
+
+| Env var | Description |
+|---|---|
+| `CHRON_SPLUNK_URL` | Splunk HEC base URL, e.g. `https://localhost:8088` or `https://your-host:8088` |
+| `CHRON_SPLUNK_TOKEN` | HEC ingest token |
+| `CHRON_SPLUNK_INSECURE` | Set to `1` to skip TLS verification (local Docker with self-signed cert) |
+
+`CHRON_SPLUNK_URL` and `CHRON_SPLUNK_TOKEN` must both be set for events to flow.
+
+---
+
+## Microsoft Sentinel integration
+
+Stream AI session telemetry into your Microsoft Sentinel workspace via the Azure Monitor Logs Ingestion API. Events go directly from developer machines to your own Log Analytics workspace — no relay service.
+
+**What gets sent:** session starts, message counts (role only), and masked credential detections. Message content never leaves the machine.
+
+### Setup
+
+**1. Register an Azure App**
+
+Azure Portal → **Azure Active Directory** → **App registrations** → **New registration** → name it `chron-ingest`.  
+Note the **Application (client) ID** and **Directory (tenant) ID**.  
+Go to **Certificates & secrets** → **New client secret** → copy the value immediately.
+
+**2. Create a custom table in Log Analytics**
+
+Open your Log Analytics workspace → **Tables** → **Create** → **New custom log (DCR-based)** → name it `ChronEvents_CL`.
+
+Add these columns (in addition to the auto-added `TimeGenerated`):
+
+| Column | Type |
+|---|---|
+| `EventType` | string |
+| `SessionIdPrefix` | string |
+| `AiTool` | string |
+| `OS` | string |
+| `ChronVersion` | string |
+| `Computer` | string |
+| `Role` | string |
+| `DetectionType` | string |
+| `MaskedValue` | string |
+
+The wizard creates a **Data Collection Endpoint (DCE)** and **Data Collection Rule (DCR)** — note both.
+
+**3. Grant the App ingest permission**
+
+Open the DCR → **Access control (IAM)** → **Add role assignment** → Role: **Monitoring Metrics Publisher** → Member: the `chron-ingest` app.
+
+**4. Get the DCR Immutable ID**
+
+Open the DCR → **Overview** → **JSON view** → copy the `immutableId` field (starts with `dcr-`).
+
+**5. Install the CLI and run the onboarding wizard**
+
+```bash
+npm install -g chron-mcp
+chron connect sentinel
+# Enter tenant ID, client ID, client secret, DCE URL, DCR immutable ID, and stream name
+# The wizard authenticates with Azure AD and sends a test event before saving
+```
+
+**6. Add env vars to your MCP client config**
+
+The wizard prints the exact block to paste. For Claude Code, add to `~/.claude.json`:
+
+```json
+{
+  "mcpServers": {
+    "chron": {
+      "command": "npx",
+      "args": ["-y", "chron-mcp"],
+      "env": {
+        "CHRON_SENTINEL_TENANT_ID": "<your-tenant-id>",
+        "CHRON_SENTINEL_CLIENT_ID": "<your-client-id>",
+        "CHRON_SENTINEL_CLIENT_SECRET": "<your-client-secret>",
+        "CHRON_SENTINEL_DCE": "https://<your-dce>.ingest.monitor.azure.com",
+        "CHRON_SENTINEL_DCR_ID": "dcr-<your-immutable-id>",
+        "CHRON_SENTINEL_STREAM": "Custom-ChronEvents_CL"
+      }
+    }
+  }
+}
+```
+
+Restart your AI tool to pick up the new env vars.
+
+**7. Query in Sentinel**
+
+Sentinel → **Logs** → paste any query from `dashboards/sentinel/`:
+```kql
+ChronEvents_CL
+| where TimeGenerated > ago(24h)
+| summarize count() by EventType, AiTool
+```
+
+Full guide with KQL queries and alert rule setup: [dashboards/sentinel/README.md](dashboards/sentinel/README.md)
+
+### Env vars
+
+| Env var | Description |
+|---|---|
+| `CHRON_SENTINEL_TENANT_ID` | Azure AD tenant ID |
+| `CHRON_SENTINEL_CLIENT_ID` | App Registration client ID |
+| `CHRON_SENTINEL_CLIENT_SECRET` | App Registration client secret |
+| `CHRON_SENTINEL_DCE` | Data Collection Endpoint URL |
+| `CHRON_SENTINEL_DCR_ID` | DCR Immutable ID (starts with `dcr-`) |
+| `CHRON_SENTINEL_STREAM` | Stream name, e.g. `Custom-ChronEvents_CL` |
+
+All six must be set for events to flow. Token refresh is automatic (1-hour Azure AD tokens, refreshed 60s before expiry).
+
+---
+
 ## Configuration
 
 | Env var | Default | Description |
@@ -181,6 +474,18 @@ This turns your local log into a verifiable audit artifact. Any edit to a stored
 | `CHRON_TRANSPORT` | `stdio` | Set to `http` to enable HTTP+SSE mode |
 | `CHRON_API_KEY` | _(none)_ | Bearer token for HTTP mode |
 | `PORT` | `3001` | Port for HTTP mode |
+| `CHRON_LOGSCALE_URL` | _(none)_ | LogScale ingest endpoint (enables CrowdStrike integration) |
+| `CHRON_LOGSCALE_TOKEN` | _(none)_ | LogScale ingest token |
+| `CHRON_SENTINEL_TENANT_ID` | _(none)_ | Azure AD tenant ID (enables Sentinel integration) |
+| `CHRON_SENTINEL_CLIENT_ID` | _(none)_ | App Registration client ID |
+| `CHRON_SENTINEL_CLIENT_SECRET` | _(none)_ | App Registration client secret |
+| `CHRON_SENTINEL_DCE` | _(none)_ | Data Collection Endpoint URL |
+| `CHRON_SENTINEL_DCR_ID` | _(none)_ | DCR Immutable ID |
+| `CHRON_SENTINEL_STREAM` | _(none)_ | Stream name (e.g. `Custom-ChronEvents_CL`) |
+| `CHRON_SPLUNK_URL` | _(none)_ | Splunk HEC base URL (enables Splunk integration) |
+| `CHRON_SPLUNK_TOKEN` | _(none)_ | Splunk HEC ingest token |
+| `CHRON_RELAY_URL` | _(none)_ | Generic relay endpoint (any SIEM or webhook) |
+| `CHRON_RELAY_TOKEN` | _(none)_ | Bearer token for generic relay |
 
 ---
 

package/dashboards/logscale/README.md

@@ -0,0 +1,121 @@
+# Chron → CrowdStrike LogScale
+
+Stream AI session telemetry directly from developer machines into your CrowdStrike LogScale repository. No relay service, no data routed through Chron infrastructure — events go from the developer's machine straight to your own LogScale instance.
+
+## Prerequisites
+
+- CrowdStrike Falcon with **LogScale / Next-Gen SIEM** access
+- Admin access to create a LogScale repository and ingest token
+
+## Step 1 — Create a LogScale repository
+
+1. Open Falcon console → **Log Management** → **Repositories**
+2. Click **New repository** → name it `ChronAIEvents` (or any name)
+3. Go to **Settings** → **API Tokens** → **Add token**
+4. Select **Ingest** permission, name it `chron-ingest`, copy the token
+
+## Step 2 — Get your cluster URL
+
+Your LogScale ingest URL follows this pattern:
+
+```
+https://<your-cluster>.humio.com/api/v1/ingest/humio-structured
+```
+
+Common cluster URLs:
+- US: `https://cloud.us.humio.com/api/v1/ingest/humio-structured`
+- EU: `https://cloud.humio.com/api/v1/ingest/humio-structured`
+
+Your exact URL is visible in Falcon under **Log Management → Repositories → <your repo> → Ingest API**.
+
+## Step 3 — Connect from the developer machine
+
+Run the onboarding command:
+
+```bash
+chron connect crowdstrike
+```
+
+Paste the ingest URL and token when prompted. The command sends a test event and confirms the connection before saving.
+
+## Step 4 — Add env vars to your MCP client
+
+The `connect` command prints the exact block to paste. For Claude Code, add to the `chron` entry in `~/.claude.json`:
+
+```json
+{
+  "mcpServers": {
+    "chron": {
+      "type": "stdio",
+      "command": "node",
+      "args": ["/path/to/dist/index.js"],
+      "env": {
+        "CHRON_LOGSCALE_URL": "https://<your-cluster>.humio.com/api/v1/ingest/humio-structured",
+        "CHRON_LOGSCALE_TOKEN": "<your-ingest-token>"
+      }
+    }
+  }
+}
+```
+
+For org-wide rollout, push these env vars via MDM (Jamf, Intune, etc.) instead of configuring each machine individually.
+
+## Step 5 — Import the dashboard
+
+In Falcon console → **Log Management** → **Dashboards** → **Import**:
+
+```
+node_modules/chron-mcp/dashboards/logscale/chron-ai-activity.yaml
+```
+
+The dashboard includes five widgets:
+- **Daily Active Developers** — distinct machines with AI sessions per day
+- **AI Tool Usage** — breakdown by tool (Claude, Cursor, Windsurf, etc.)
+- **Secrets Detected by Type** — credential exposures over time
+- **Sessions by Developer** — per-machine session count with AI tool
+- **Credential Exposures** — full table of api_key, jwt, aws_key detections for SOC review
+
+## Step 6 — Set up the API key alert (optional)
+
+In LogScale, create a **Scheduled Search** using `api-key-alert.lql`:
+
+```
+event_type = "secret_detected"
+| detection_type in ["api_key", "aws_key", "gcp_key", "azure_key", "private_key", "jwt"]
+| table([#host, ai_tool, detection_type, masked_value, session_id_prefix, @timestamp])
+```
+
+Set the alert to trigger when results > 0 and route to your SOC notification channel.
+
+## Event schema
+
+All events arrive in LogScale with:
+
+| Tag | Value |
+|---|---|
+| `#host` | Developer's machine hostname |
+| `#source` | `chron-mcp` |
+
+| Attribute | Present on |
+|---|---|
+| `event_type` | All events: `session_started`, `message_logged`, `secret_detected` |
+| `session_id_prefix` | All events |
+| `ai_tool` | All events: `claude`, `cursor`, `windsurf`, etc. |
+| `os` | All events: `darwin`, `linux`, `win32` |
+| `chron_version` | All events |
+| `role` | `message_logged` only: `user` or `assistant` |
+| `detection_type` | `secret_detected` only: `api_key`, `aws_key`, `jwt`, etc. |
+| `masked_value` | `secret_detected` only: e.g. `AKIA****F3K2` |
+
+**What is never transmitted:** message content, actual secret values, file paths, or any user-typed text.
+
+## Individual LQL queries
+
+| File | Use |
+|---|---|
+| `secrets-by-type.lql` | Time-series widget — secret detections by type |
+| `sessions-by-developer.lql` | Table — sessions per host and AI tool |
+| `api-key-alert.lql` | Scheduled alert — credential exposures |
+| `ai-tool-usage.lql` | Pie chart — tool adoption breakdown |
+| `daily-active-developers.lql` | Time-series — distinct active machines per day |
+| `chron-ai-activity.yaml` | Full importable dashboard (all five) |

package/dashboards/logscale/ai-tool-usage.lql

@@ -0,0 +1,5 @@
+// AI tool adoption breakdown — pie/bar widget
+event_type = "session_started"
+| groupby(ai_tool, function=count())
+| rename(count(), as=sessions)
+| sort(sessions, order=desc)

package/dashboards/logscale/api-key-alert.lql

@@ -0,0 +1,5 @@
+// Alert: API key or credential sent to AI tool
+// Use as a Scheduled Search alert — notify SOC on any match
+event_type = "secret_detected"
+| detection_type in ["api_key", "aws_key", "gcp_key", "azure_key", "private_key", "jwt"]
+| table([#host, ai_tool, detection_type, masked_value, session_id_prefix, @timestamp])

package/dashboards/logscale/chron-ai-activity.yaml

@@ -0,0 +1,66 @@
+$schema: "https://schemas.humio.com/dashboard/v0.1.0"
+name: "Chron — AI Activity"
+updateFrequency: 60
+timeSelector:
+  defaultRelativeTimeRange: "7d"
+
+widgets:
+  - id: daily-active-developers
+    title: "Daily Active Developers"
+    type: time-chart
+    x: 0
+    y: 0
+    width: 8
+    height: 4
+    query: |
+      event_type = "session_started"
+      | timechart(unit=1d, function=count(#host, distinct=true))
+
+  - id: ai-tool-usage
+    title: "AI Tool Usage"
+    type: pie-chart
+    x: 8
+    y: 0
+    width: 4
+    height: 4
+    query: |
+      event_type = "session_started"
+      | groupby(ai_tool, function=count())
+      | rename(count(), as=sessions)
+      | sort(sessions, order=desc)
+
+  - id: secrets-by-type
+    title: "Secrets Detected by Type (7d)"
+    type: time-chart
+    x: 0
+    y: 4
+    width: 8
+    height: 4
+    query: |
+      event_type = "secret_detected"
+      | timechart(detection_type, unit=1d, function=count())
+
+  - id: sessions-by-developer
+    title: "Sessions by Developer"
+    type: table
+    x: 8
+    y: 4
+    width: 4
+    height: 4
+    query: |
+      event_type = "session_started"
+      | groupby([#host, ai_tool], function=count())
+      | rename(count(), as=sessions)
+      | sort(sessions, order=desc)
+
+  - id: api-key-alerts
+    title: "Credential Exposures — Requires Attention"
+    type: table
+    x: 0
+    y: 8
+    width: 12
+    height: 4
+    query: |
+      event_type = "secret_detected"
+      | detection_type in ["api_key", "aws_key", "gcp_key", "azure_key", "private_key", "jwt"]
+      | table([#host, ai_tool, detection_type, masked_value, session_id_prefix, @timestamp])

package/dashboards/logscale/daily-active-developers.lql

@@ -0,0 +1,3 @@
+// Daily active developers — time-series widget
+event_type = "session_started"
+| timechart(unit=1d, function=count(#host, distinct=true))

package/dashboards/logscale/secrets-by-type.lql

@@ -0,0 +1,3 @@
+// Secrets detected by type — timechart (use as time-series widget, 7d window)
+event_type = "secret_detected"
+| timechart(detection_type, unit=1d, function=count())

package/dashboards/logscale/sessions-by-developer.lql

@@ -0,0 +1,6 @@
+// Sessions per developer — bar/table widget
+// #host is the actual hostname sent in the LogScale tags (set by chron MCP)
+event_type = "session_started"
+| groupby([#host, ai_tool], function=count())
+| rename(count(), as=sessions)
+| sort(sessions, order=desc)

package/dashboards/sentinel/README.md

@@ -0,0 +1,123 @@
+# Chron → Microsoft Sentinel
+
+Stream AI session telemetry directly from developer machines into your Microsoft Sentinel workspace via the Azure Monitor Logs Ingestion API. No relay service — events go from the developer's machine straight to your own Log Analytics workspace.
+
+## Prerequisites
+
+- Microsoft Sentinel enabled on a Log Analytics workspace
+- Azure subscription with permission to create App Registrations and Data Collection Rules
+
+## Step 1 — Register an Azure App
+
+1. Open **Azure Portal** → **Azure Active Directory** → **App registrations** → **New registration**
+2. Name it `chron-ingest` (or any name), leave defaults, click **Register**
+3. Note the **Application (client) ID** and **Directory (tenant) ID**
+4. Go to **Certificates & secrets** → **New client secret** — copy the value immediately
+
+## Step 2 — Create a custom table in Log Analytics
+
+1. Open your Log Analytics workspace → **Tables** → **Create** → **New custom log (DCR-based)**
+2. Name the table `ChronEvents_CL`
+3. Define the schema (add these columns):
+
+| Column | Type |
+|---|---|
+| `EventType` | string |
+| `SessionIdPrefix` | string |
+| `AiTool` | string |
+| `OS` | string |
+| `ChronVersion` | string |
+| `Computer` | string |
+| `Role` | string |
+| `DetectionType` | string |
+| `MaskedValue` | string |
+
+(`TimeGenerated` is added automatically.)
+
+4. The wizard creates a **Data Collection Endpoint (DCE)** and **Data Collection Rule (DCR)** — note both URLs/IDs.
+
+## Step 3 — Grant the App ingest permission
+
+1. Open the DCR you created → **Access control (IAM)** → **Add role assignment**
+2. Role: **Monitoring Metrics Publisher**
+3. Member: the `chron-ingest` app registration
+
+## Step 4 — Get the DCR Immutable ID
+
+Open the DCR → **Overview** → **JSON view** → copy the `immutableId` field (starts with `dcr-`).
+
+## Step 5 — Connect from the developer machine
+
+```bash
+chron connect sentinel
+```
+
+Enter the tenant ID, client ID, client secret, DCE URL, DCR immutable ID, and stream name when prompted. The command authenticates, sends a test event, and confirms before saving.
+
+## Step 6 — Add env vars to your MCP client
+
+The `connect` command prints the exact block to paste. For Claude Code, add to the `chron` entry in `~/.claude.json`:
+
+```json
+{
+  "mcpServers": {
+    "chron": {
+      "type": "stdio",
+      "command": "node",
+      "args": ["/path/to/dist/index.js"],
+      "env": {
+        "CHRON_SENTINEL_TENANT_ID": "<your-tenant-id>",
+        "CHRON_SENTINEL_CLIENT_ID": "<your-client-id>",
+        "CHRON_SENTINEL_CLIENT_SECRET": "<your-client-secret>",
+        "CHRON_SENTINEL_DCE": "https://<your-dce>.ingest.monitor.azure.com",
+        "CHRON_SENTINEL_DCR_ID": "dcr-<your-immutable-id>",
+        "CHRON_SENTINEL_STREAM": "Custom-ChronEvents_CL"
+      }
+    }
+  }
+}
+```
+
+## Step 7 — Add KQL queries to Sentinel
+
+In Sentinel → **Logs**, run queries from this directory:
+
+| File | Use |
+|---|---|
+| `events-by-type.kql` | Time-series — event volume by type |
+| `sessions-by-developer.kql` | Table — sessions per machine and AI tool |
+| `secrets-detected.kql` | Table — credential exposures for SOC review |
+| `ai-tool-usage.kql` | Summary — tool adoption breakdown |
+| `daily-active-developers.kql` | Time-series — distinct active machines per day |
+| `secrets-alert.kql` | Scheduled alert rule — credential exposures |
+
+## Step 8 — Set up the credential alert (recommended)
+
+1. Sentinel → **Analytics** → **Create** → **Scheduled query rule**
+2. Paste `secrets-alert.kql` as the rule query
+3. Set **Run query every**: 1 hour, **Lookup data from the last**: 1 hour
+4. Alert threshold: **Number of results greater than 0**
+5. Route to your SOC incident queue
+
+## Event schema
+
+All events arrive in `ChronEvents_CL` with:
+
+| Column | Present on |
+|---|---|
+| `TimeGenerated` | All events |
+| `EventType` | All: `session_started`, `message_logged`, `secret_detected` |
+| `SessionIdPrefix` | All events |
+| `AiTool` | All events: `claude`, `cursor`, `windsurf`, etc. |
+| `OS` | All events: `darwin`, `linux`, `win32` |
+| `ChronVersion` | All events |
+| `Computer` | All events: developer's machine hostname |
+| `Role` | `message_logged` only: `user` or `assistant` |
+| `DetectionType` | `secret_detected` only: `api_key`, `aws_key`, `jwt`, etc. |
+| `MaskedValue` | `secret_detected` only: e.g. `AKIA****F3K2` |
+
+**What is never transmitted:** message content, actual secret values, file paths, or any user-typed text.
+
+## Token refresh
+
+Chron automatically refreshes the Azure AD access token before it expires (tokens are valid for 1 hour). No manual intervention required after initial setup.

package/dashboards/sentinel/ai-tool-usage.kql

@@ -0,0 +1,7 @@
+// AI tool adoption breakdown (last 30 days)
+ChronEvents_CL
+| where TimeGenerated > ago(30d)
+| where EventType == "session_started"
+| where isnotempty(AiTool)
+| summarize Sessions = count() by AiTool
+| sort by Sessions desc

package/dashboards/sentinel/daily-active-developers.kql

@@ -0,0 +1,6 @@
+// Distinct developer machines with AI sessions per day (last 30 days)
+ChronEvents_CL
+| where TimeGenerated > ago(30d)
+| where EventType == "session_started"
+| summarize ActiveDevelopers = dcount(Computer) by bin(TimeGenerated, 1d)
+| render timechart