securenow 8.10.0 → 8.11.0

package/cli/agent.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// `securenow agent` — the SOC runbook prompts that SecureNow's retired built-in
+// AI Security Agent used to run on a cron. Print them here so customers can run
+// the same work externally with their own harness (Claude, Hermes, OpenClaw, or
+// any MCP-capable agent), e.g.:
+//
+//   claude -p "$(securenow agent prompt patrol --confirm-writes)"
+//
+// The same prompts are published over MCP via prompts/list (soc_patrol,
+// work_alert_review, work_human_actions, ...).
+
+const ui = require('./ui');
+const { PROMPTS, promptMessages } = require('../mcp/catalog.js');
+
+const PROMPT_ALIASES = {
+  patrol: 'soc_patrol',
+  soc_patrol: 'soc_patrol',
+  'alert-review': 'work_alert_review',
+  work_alert_review: 'work_alert_review',
+  'human-queue': 'work_human_actions',
+  human: 'work_human_actions',
+  work_human_actions: 'work_human_actions',
+};
+
+function promptText(name, args) {
+  const messages = promptMessages(name, args);
+  return messages
+    .map((message) => message?.content?.text || '')
+    .filter(Boolean)
+    .join('\n\n');
+}
+
+async function prompts(args, flags = {}) {
+  const rows = PROMPTS.map((p) => ({ name: p.name, title: p.title, description: p.description }));
+  if (flags.json) return ui.json({ prompts: rows, aliases: PROMPT_ALIASES });
+  ui.heading('SecureNow agent runbook prompts');
+  for (const row of rows) {
+    console.log(`- ${row.name}: ${row.description}`);
+  }
+  console.log('');
+  console.log('Print one with: securenow agent prompt <patrol|alert-review|human-queue|full name>');
+  console.log('Scheduled example: claude -p "$(securenow agent prompt patrol --confirm-writes)"');
+}
+
+async function prompt(args, flags = {}) {
+  const ref = String(args[0] || 'patrol').toLowerCase();
+  const name = PROMPT_ALIASES[ref] || ref;
+  if (!PROMPTS.some((p) => p.name === name)) {
+    throw new Error(`Unknown prompt "${args[0]}". Run \`securenow agent prompts\` to list them.`);
+  }
+  const promptArgs = {
+    confirmWrites: Boolean(flags['confirm-writes'] || flags.confirmWrites || flags.yes),
+  };
+  if (flags.limit) promptArgs.limit = flags.limit;
+  if (flags.search) promptArgs.search = flags.search;
+  if (flags['max-alert-review-groups']) promptArgs.maxAlertReviewGroups = flags['max-alert-review-groups'];
+  if (flags['max-human-rows']) promptArgs.maxHumanRows = flags['max-human-rows'];
+
+  const text = promptText(name, promptArgs);
+  if (flags.json) return ui.json({ name, prompt: text });
+  console.log(text);
+}
+
+module.exports = { prompt, prompts };

package/cli.js

@@ -188,54 +188,54 @@ const COMMANDS = {
     },
     defaultSub: 'list',
   },
-  logs: {
+  logs: {
     desc: 'View application logs',
     usage: 'securenow logs [options]',
     sub: {
       list: { desc: 'List recent logs', flags: { app: 'App key', env: 'Environment (production, staging, preview, local, or all)', environment: 'Alias for --env', limit: 'Max results (default 200)', since: 'Time window (e.g. 30m, 6h, 2d)', minutes: 'Time window in minutes (alias for --since Nm)', level: 'Filter by level (error, warn, info, debug)', start: 'Start time (ISO 8601)', end: 'End time (ISO 8601)' }, run: (a, f) => require('./cli/monitor').logsList(a, f) },
       trace: { desc: 'Show logs for a trace', usage: 'securenow logs trace <traceId>', flags: { app: 'App key', env: 'Environment', environment: 'Alias for --env' }, run: (a, f) => require('./cli/monitor').logsTrace(a, f) },
     },
-    defaultSub: 'list',
-  },
-  telemetry: {
-    desc: 'Inspect the alert-SQL telemetry contract and fields observed for an app',
-    usage: 'securenow telemetry <schema|fields> [options]',
-    flags: {
-      app: 'With fields: application key (defaults to connected/default app)',
-      env: 'With fields: environment or all (default: production)',
-      since: 'With fields: observation window such as 30m, 24h, or 7d (maximum 30d)',
-      source: 'Schema section or live signal source',
-      limit: 'With fields: maximum fields per signal (1-500, default 200)',
-      json: 'Machine-readable output',
-    },
-    sub: {
-      schema: {
-        desc: 'Print the packaged ClickHouse tables, fields, mappings, and SQL requirements',
-        usage: 'securenow telemetry schema [all|logs|traces|events] [--json]',
-        flags: {
-          source: 'Schema section: all, logs, traces, or events',
-          json: 'Output the machine-readable contract as JSON',
-        },
-        run: (a, f) => require('./cli/telemetry').schema(a, f),
-      },
-      fields: {
-        desc: 'Discover fields and custom event types actually emitted by an app',
-        usage: 'securenow telemetry fields [--app <key>] [--env production] [--since 24h] [--source all] [--limit 200] [--json]',
-        flags: {
-          app: 'Application key (defaults to connected/default app)',
-          env: 'Environment, comma-separated environments, or all (default: production)',
-          environment: 'Alias for --env',
-          since: 'Observation window such as 30m, 24h, or 7d (maximum 30d)',
-          source: 'Signal source: all, logs, or traces',
-          limit: 'Maximum fields per signal (1-500, default 200)',
-          json: 'Output JSON for agents and scripts',
-        },
-        run: (a, f) => require('./cli/telemetry').fields(a, f),
-      },
-    },
-    defaultSub: 'schema',
-  },
-  notifications: {
+    defaultSub: 'list',
+  },
+  telemetry: {
+    desc: 'Inspect the alert-SQL telemetry contract and fields observed for an app',
+    usage: 'securenow telemetry <schema|fields> [options]',
+    flags: {
+      app: 'With fields: application key (defaults to connected/default app)',
+      env: 'With fields: environment or all (default: production)',
+      since: 'With fields: observation window such as 30m, 24h, or 7d (maximum 30d)',
+      source: 'Schema section or live signal source',
+      limit: 'With fields: maximum fields per signal (1-500, default 200)',
+      json: 'Machine-readable output',
+    },
+    sub: {
+      schema: {
+        desc: 'Print the packaged ClickHouse tables, fields, mappings, and SQL requirements',
+        usage: 'securenow telemetry schema [all|logs|traces|events] [--json]',
+        flags: {
+          source: 'Schema section: all, logs, traces, or events',
+          json: 'Output the machine-readable contract as JSON',
+        },
+        run: (a, f) => require('./cli/telemetry').schema(a, f),
+      },
+      fields: {
+        desc: 'Discover fields and custom event types actually emitted by an app',
+        usage: 'securenow telemetry fields [--app <key>] [--env production] [--since 24h] [--source all] [--limit 200] [--json]',
+        flags: {
+          app: 'Application key (defaults to connected/default app)',
+          env: 'Environment, comma-separated environments, or all (default: production)',
+          environment: 'Alias for --env',
+          since: 'Observation window such as 30m, 24h, or 7d (maximum 30d)',
+          source: 'Signal source: all, logs, or traces',
+          limit: 'Maximum fields per signal (1-500, default 200)',
+          json: 'Output JSON for agents and scripts',
+        },
+        run: (a, f) => require('./cli/telemetry').fields(a, f),
+      },
+    },
+    defaultSub: 'schema',
+  },
+  notifications: {
     desc: 'Manage notifications',
     usage: 'securenow notifications <subcommand> [options]',
     sub: {
@@ -288,6 +288,23 @@ const COMMANDS = {
     },
     defaultSub: 'list',
   },
+  agent: {
+    desc: 'SOC runbook prompts for running the SecureNow agent work with your own harness (Claude, Hermes, OpenClaw, ...)',
+    usage: 'securenow agent <prompt|prompts> [patrol|alert-review|human-queue] [options]',
+    flags: {
+      json: 'Output as JSON',
+      'confirm-writes': 'Emit the prompt variant that allows the external agent to execute decisions',
+      limit: 'Row/group budget baked into the prompt',
+      search: 'Optional search filter baked into the prompt',
+      'max-alert-review-groups': 'SOC patrol: max alert-review root-cause groups per pass',
+      'max-human-rows': 'SOC patrol: max Requires Human rows per pass',
+    },
+    sub: {
+      prompt: { desc: 'Print one runbook prompt (pipe it into your harness or schedule it on a cron)', usage: 'securenow agent prompt <patrol|alert-review|human-queue> [--confirm-writes]', run: (a, f) => require('./cli/agent').prompt(a, f) },
+      prompts: { desc: 'List the available runbook prompts (same catalog as MCP prompts/list)', run: (a, f) => require('./cli/agent').prompts(a, f) },
+    },
+    defaultSub: 'prompts',
+  },
   alerts: {
     desc: 'Manage alerting',
     usage: 'securenow alerts <subcommand> [options]',
@@ -803,7 +820,7 @@ function showHelp(commandName) {
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],
-    'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
+    'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
     'Utilities': ['redact', 'cidr', 'doctor', 'env', 'mcp'],
     'Settings': ['instances', 'config', 'version'],
   };

package/legacy-semconv.js

@@ -0,0 +1,349 @@
+'use strict';
+
+/**
+ * Legacy semantic-convention attributes for the OpenTelemetry 0.221+ /
+ * contrib 0.74+ instrumentations, which emit ONLY the stable conventions.
+ * OTEL_SEMCONV_STABILITY_OPT_IN no longer brings the old names back.
+ *
+ * The SecureNow telemetry contract (telemetry-schema.json "automaticTraceFields"),
+ * dashboard queries, alert-rule SQL, block/impact reports and false-positive
+ * conditions filter on the legacy names. This module restores them next to the
+ * stable ones:
+ *
+ *  - HTTP (withLegacyHttpSemconv): http.method, http.target, http.url,
+ *    http.status_code, http.host, http.scheme, http.user_agent, net.peer.ip, ...
+ *    via the HttpInstrumentation's public hooks, reproducing what
+ *    instrumentation-http <= 0.220 emitted by default.
+ *  - Databases (withLegacyDbSemconvExporter): db.statement, db.system, db.name,
+ *    db.operation, db.mongodb.collection / db.sql.table, net.peer.name/port,
+ *    derived at export time from db.query.text, db.system.name, db.namespace,
+ *    db.operation.name, db.collection.name, server.address/port. The values are
+ *    the same ones the old instrumentations wrote under both names.
+ *
+ * Deliberate HTTP differences from <= 0.220:
+ *  - http.client_ip is NOT derived from the first X-Forwarded-For entry (that
+ *    value is spoofable). SecureNow's requestHook sets http.client_ip from the
+ *    trusted-proxy resolver (resolve-ip.js).
+ *  - Signature-style query parameters (same list upstream now redacts on
+ *    url.query / url.full) are replaced with REDACTED in http.target / http.url.
+ *    Every other byte of the target is kept exactly as received, so detection
+ *    rules that match encoded payloads keep working.
+ */
+
+// Mirrors DEFAULT_QUERY_STRINGS_TO_REDACT in @opentelemetry/instrumentation-http.
+const DEFAULT_REDACTED_QUERY_PARAMS = Object.freeze([
+  'sig',
+  'Signature',
+  'AWSAccessKeyId',
+  'X-Goog-Signature',
+  'X-Amz-Signature',
+  'X-Amz-Credential',
+  'X-Amz-Security-Token',
+]);
+const REDACTED = 'REDACTED';
+
+function isServerResponse(value) {
+  return !!value && typeof value.setHeader === 'function' && typeof value.writeHead === 'function';
+}
+
+function defined(attributes) {
+  const out = {};
+  for (const key of Object.keys(attributes)) {
+    if (attributes[key] !== undefined && attributes[key] !== null) out[key] = attributes[key];
+  }
+  return out;
+}
+
+/**
+ * Redact the values of sensitive query parameters in a `?query` string while
+ * leaving every other byte untouched (no re-encoding). Returns the input when
+ * nothing matched.
+ */
+function redactSearch(search, paramsToRedact = DEFAULT_REDACTED_QUERY_PARAMS) {
+  if (typeof search !== 'string' || search.length < 2 || search[0] !== '?') return search;
+  const sensitive = new Set(paramsToRedact || []);
+  if (sensitive.size === 0) return search;
+  let changed = false;
+  const parts = search.slice(1).split('&').map((part) => {
+    const eq = part.indexOf('=');
+    const rawKey = eq === -1 ? part : part.slice(0, eq);
+    let key = rawKey;
+    try {
+      key = decodeURIComponent(rawKey.replace(/\+/g, ' '));
+    } catch (_) {}
+    if (!sensitive.has(key)) return part;
+    changed = true;
+    return `${rawKey}=${REDACTED}`;
+  });
+  return changed ? `?${parts.join('&')}` : search;
+}
+
+function contentLengthAttributes(headers, direction) {
+  const raw = headers && headers['content-length'];
+  if (raw === undefined) return {};
+  const length = parseInt(raw, 10);
+  if (Number.isNaN(length)) return {};
+  const encoding = headers['content-encoding'];
+  const compressed = !!encoding && encoding !== 'identity';
+  return compressed
+    ? { [`http.${direction}_content_length`]: length }
+    : { [`http.${direction}_content_length_uncompressed`]: length };
+}
+
+function httpKindAttributes(httpVersion) {
+  if (!httpVersion) return {};
+  return {
+    'http.flavor': httpVersion,
+    'net.transport': String(httpVersion).toUpperCase() !== 'QUIC' ? 'ip_tcp' : 'ip_udp',
+  };
+}
+
+// ---- incoming (SERVER spans) ----
+
+function incomingRequestAttributes(request, paramsToRedact) {
+  const headers = request.headers || {};
+  const component = request.socket && request.socket.encrypted ? 'https' : 'http';
+  const host = headers.host;
+  const hostname = (typeof host === 'string' && host.replace(/^(.*)(:[0-9]{1,5})/, '$1')) || 'localhost';
+  const userAgent = headers['user-agent'];
+
+  let pathname;
+  let search = '';
+  let fullUrl;
+  try {
+    if (host) {
+      const parsed = new URL(request.url || '/', `${component}://${host}`);
+      pathname = parsed.pathname;
+      const redacted = redactSearch(parsed.search, paramsToRedact);
+      if (redacted !== parsed.search) parsed.search = redacted;
+      search = parsed.search;
+      fullUrl = parsed.toString();
+    } else {
+      const parsed = new URL(request.url || '/', `${component}://localhost`);
+      pathname = parsed.pathname;
+      search = redactSearch(parsed.search, paramsToRedact);
+      fullUrl = pathname + search;
+    }
+  } catch (_) {}
+
+  const attributes = {
+    'http.url': fullUrl,
+    'http.host': host,
+    'net.host.name': hostname,
+    'http.method': request.method,
+    'http.scheme': component,
+    ...contentLengthAttributes(headers, 'request'),
+    ...httpKindAttributes(request.httpVersion),
+  };
+  if (pathname) attributes['http.target'] = pathname + search || '/';
+  if (userAgent !== undefined) attributes['http.user_agent'] = userAgent;
+  return defined(attributes);
+}
+
+function incomingResponseAttributes(request, response) {
+  const socket = request && request.socket;
+  const attributes = {
+    'http.status_code': response.statusCode,
+    'http.status_text': String(response.statusMessage || '').toUpperCase(),
+  };
+  if (socket) {
+    attributes['net.host.ip'] = socket.localAddress;
+    attributes['net.host.port'] = socket.localPort;
+    attributes['net.peer.ip'] = socket.remoteAddress;
+    attributes['net.peer.port'] = socket.remotePort;
+  }
+  return defined(attributes);
+}
+
+// ---- outgoing (CLIENT spans) ----
+
+function hostnameAndPort(options) {
+  if (options.hostname && options.port) return { hostname: options.hostname, port: options.port };
+  const matches = (typeof options.host === 'string' && options.host.match(/^([^:/ ]+)(:\d{1,5})?/)) || null;
+  const hostname = options.hostname || (matches === null ? 'localhost' : matches[1]);
+  let port = options.port;
+  if (!port) {
+    if (matches && matches[2]) port = matches[2].substring(1);
+    else port = options.protocol === 'https:' ? '443' : '80';
+  }
+  return { hostname, port };
+}
+
+function absoluteUrl(options, headers, paramsToRedact) {
+  const protocol = options.protocol || 'http:';
+  const port = String(options.port || '');
+  let path = options.path || '/';
+  let host = options.host || options.hostname || headers.host || 'localhost';
+  if (String(host).indexOf(':') === -1 && port && port !== '80' && port !== '443') host += `:${port}`;
+  if (path.includes('?')) {
+    // Same WHATWG normalization as instrumentation-http <= 0.220.
+    try {
+      const parsed = new URL(path, 'http://localhost');
+      path = `${parsed.pathname}${redactSearch(parsed.search, paramsToRedact)}`;
+    } catch (_) {}
+  }
+  const auth = options.auth ? `${REDACTED}:${REDACTED}@` : '';
+  return `${protocol}//${auth}${host}${path}`;
+}
+
+function outgoingRequestAttributes(options, paramsToRedact) {
+  const headers = options.headers || {};
+  const { hostname, port } = hostnameAndPort(options);
+  const rawPath = options.path || '/';
+  const q = rawPath.indexOf('?');
+  const target = q === -1 ? rawPath : rawPath.slice(0, q) + redactSearch(rawPath.slice(q), paramsToRedact);
+  const attributes = {
+    'http.url': absoluteUrl(options, headers, paramsToRedact),
+    'http.method': options.method || 'GET',
+    'http.target': target,
+    'net.peer.name': hostname,
+    'http.host': headers.host !== undefined ? headers.host : `${hostname}:${port}`,
+  };
+  if (headers['user-agent'] !== undefined) attributes['http.user_agent'] = headers['user-agent'];
+  return defined(attributes);
+}
+
+function outgoingResponseAttributes(response) {
+  const { statusCode, statusMessage, httpVersion, socket } = response;
+  const attributes = {
+    ...contentLengthAttributes(response.headers || {}, 'response'),
+    ...httpKindAttributes(httpVersion),
+  };
+  if (socket) {
+    attributes['net.peer.ip'] = socket.remoteAddress;
+    attributes['net.peer.port'] = socket.remotePort;
+  }
+  if (statusCode) {
+    attributes['http.status_code'] = statusCode;
+    attributes['http.status_text'] = String(statusMessage || '').toUpperCase();
+  }
+  return defined(attributes);
+}
+
+function safe(fn, fallback) {
+  try {
+    return fn();
+  } catch (_) {
+    return fallback;
+  }
+}
+
+/**
+ * Returns a copy of an HttpInstrumentation config whose hooks also emit the
+ * legacy attributes. Existing hooks are preserved and run after the legacy
+ * attributes are set (same ordering as instrumentation-http <= 0.220, so a
+ * caller hook can still override a legacy value), except for the final
+ * server-side status which, like <= 0.220, is written when the response ends.
+ */
+function withLegacyHttpSemconv(config = {}) {
+  const serverParams = config.redactedQueryParamsServer || DEFAULT_REDACTED_QUERY_PARAMS;
+  const clientParams = config.redactedQueryParams || DEFAULT_REDACTED_QUERY_PARAMS;
+  const {
+    startIncomingSpanHook,
+    startOutgoingSpanHook,
+    responseHook,
+    applyCustomAttributesOnSpan,
+  } = config;
+
+  return {
+    ...config,
+    startIncomingSpanHook(request) {
+      const legacy = safe(() => incomingRequestAttributes(request, serverParams), {});
+      const custom = typeof startIncomingSpanHook === 'function' ? startIncomingSpanHook(request) : undefined;
+      return { ...legacy, ...(custom || {}) };
+    },
+    startOutgoingSpanHook(options) {
+      const legacy = safe(() => outgoingRequestAttributes(options, clientParams), {});
+      const custom = typeof startOutgoingSpanHook === 'function' ? startOutgoingSpanHook(options) : undefined;
+      return { ...legacy, ...(custom || {}) };
+    },
+    responseHook(span, response) {
+      // CLIENT spans receive the IncomingMessage here once the response
+      // arrives. SERVER spans receive the ServerResponse before the handler
+      // runs; their legacy status is set in applyCustomAttributesOnSpan.
+      if (!isServerResponse(response)) {
+        safe(() => span.setAttributes(outgoingResponseAttributes(response)));
+      }
+      if (typeof responseHook === 'function') responseHook(span, response);
+    },
+    applyCustomAttributesOnSpan(span, request, response) {
+      if (isServerResponse(response)) {
+        safe(() => span.setAttributes(incomingResponseAttributes(request, response)));
+      }
+      if (typeof applyCustomAttributesOnSpan === 'function') applyCustomAttributesOnSpan(span, request, response);
+    },
+  };
+}
+
+// ---- databases (contrib instrumentations >= 0.74) ----
+
+// Stable db.system.name values that differ from the legacy db.system values.
+const LEGACY_DB_SYSTEM = Object.freeze({
+  'microsoft.sql_server': 'mssql',
+  'oracle.db': 'oracle',
+});
+const SQL_SYSTEMS = new Set(['mssql', 'microsoft.sql_server']);
+// instrumentation-mongoose 0.64/0.66 (securenow 8.9/8.10) wrote db.system="mongoose";
+// 0.68 only reports db.system.name="mongodb". Keep "mongoose" so `db.system = 'mongodb'` queries don't
+// start double-counting each operation (mongoose span + driver span).
+const LEGACY_DB_SYSTEM_BY_SCOPE = Object.freeze({
+  '@opentelemetry/instrumentation-mongoose': 'mongoose',
+});
+
+function legacyDbAttributes(attributes, scopeName) {
+  if (!attributes || attributes['db.system.name'] === undefined) return null;
+  const system = attributes['db.system.name'];
+  const legacy = {};
+  const alias = (from, to, map) => {
+    if (attributes[from] === undefined || attributes[to] !== undefined) return;
+    legacy[to] = map ? map(attributes[from]) : attributes[from];
+  };
+  alias('db.system.name', 'db.system', (v) => LEGACY_DB_SYSTEM_BY_SCOPE[scopeName] || LEGACY_DB_SYSTEM[v] || v);
+  alias('db.query.text', 'db.statement');
+  alias('db.namespace', 'db.name');
+  alias('db.operation.name', 'db.operation');
+  alias('server.address', 'net.peer.name');
+  alias('server.port', 'net.peer.port');
+  if (system === 'mongodb') alias('db.collection.name', 'db.mongodb.collection');
+  else if (SQL_SYSTEMS.has(system)) alias('db.collection.name', 'db.sql.table');
+  return Object.keys(legacy).length ? legacy : null;
+}
+
+/**
+ * Wraps a SpanExporter so database client spans are exported with the legacy
+ * db.* aliases as well. The finished span is not mutated: the exporter gets a
+ * view that delegates to it and only overrides `attributes`.
+ */
+function withLegacyDbSemconvExporter(exporter) {
+  const view = (span) => {
+    const legacy = safe(() => legacyDbAttributes(span.attributes, span.instrumentationScope && span.instrumentationScope.name), null);
+    if (!legacy) return span;
+    return Object.create(span, {
+      attributes: { value: { ...span.attributes, ...legacy }, enumerable: true },
+    });
+  };
+  return {
+    export(spans, resultCallback) {
+      const mapped = safe(() => spans.map(view), spans);
+      return exporter.export(mapped, resultCallback);
+    },
+    shutdown() {
+      return exporter.shutdown();
+    },
+    forceFlush() {
+      return typeof exporter.forceFlush === 'function' ? exporter.forceFlush() : Promise.resolve();
+    },
+  };
+}
+
+module.exports = {
+  DEFAULT_REDACTED_QUERY_PARAMS,
+  withLegacyHttpSemconv,
+  withLegacyDbSemconvExporter,
+  legacyDbAttributes,
+  redactSearch,
+  incomingRequestAttributes,
+  incomingResponseAttributes,
+  outgoingRequestAttributes,
+  outgoingResponseAttributes,
+};

package/mcp/catalog.js

@@ -1936,6 +1936,26 @@ const PROMPTS = [
       { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute decisions.', required: false },
     ],
   },
+  {
+    name: 'work_alert_review',
+    title: 'Work Alert Review',
+    description: 'Use MCP tools to clear the Alert Review queue from root-cause buckets: tune noisy rules with validated guards, batch-resolve covered rows, and keep real detections alive.',
+    arguments: [
+      { name: 'limit', description: 'Maximum root-cause groups to work this run. Defaults to 10.', required: false },
+      { name: 'search', description: 'Optional search filter over rule, route, IP, or evidence.', required: false },
+      { name: 'confirmWrites', description: 'Set true only when the user explicitly wants the MCP agent to execute decisions.', required: false },
+    ],
+  },
+  {
+    name: 'soc_patrol',
+    title: 'SOC Patrol (Scheduled)',
+    description: 'The recurring SOC pass SecureNow\'s built-in agent used to run on a 5-minute cron. Run it from your own harness (Claude, Hermes, OpenClaw, ...) on a schedule: Alert Review root-cause fixes first, then the Requires Human queue.',
+    arguments: [
+      { name: 'maxAlertReviewGroups', description: 'Maximum alert-review root-cause groups to work this pass. Defaults to 10.', required: false },
+      { name: 'maxHumanRows', description: 'Maximum Requires Human rows to work this pass. Defaults to 10.', required: false },
+      { name: 'confirmWrites', description: 'Set true only when this scheduled run is allowed to execute decisions autonomously.', required: false },
+    ],
+  },
   {
     name: 'cleanup_legacy_pending_blocks',
     title: 'Clean Legacy Pending Blocks',
@@ -2079,6 +2099,71 @@ function promptMessages(name, args = {}) {
     ];
   }
 
+  if (name === 'work_alert_review') {
+    const limit = args.limit || 10;
+    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            'Work my SecureNow Alert Review queue like a senior detection engineer using the MCP tools.',
+            `Work up to ${limit} root-cause group(s), biggest and most urgent first.${args.search ? ` Search filter: ${args.search}.` : ''}`,
+            'Start with securenow_alert_review_runs_count, then securenow_alert_review_runs_list to get the root-cause groups. Work buckets before singletons: one upstream rule fix closes many downstream rows.',
+            'For each group, inspect a prototype row with securenow_alert_review_run_get and preview the sibling rows with securenow_alert_review_group_similar. Pull trace evidence with securenow_traces_show / securenow_logs_for_trace when trace IDs are available.',
+            'Classify the root cause: (a) benign false-positive pattern -> tune the rule, (b) real detection that fired correctly -> keep the rule alive and close the review rows, (c) mixed or unclear -> leave open with the exact missing proof.',
+            'For rule tuning, propose a narrow attack-preserving guard: combine at least TWO of path, method, status_code, user_agent. Never guard on attacker-controllable fields alone (request body/header payloads), never use path starts_with "/" or catch-all regex. Validate with securenow_alert_rule_condition_candidate_test and securenow_alert_rule_condition_diff (or a dry run) BEFORE applying; the guard must suppress the benign samples while attack examples still match.',
+            'Apply validated tuning with securenow_alert_rule_condition_update or securenow_alert_rule_exclusion_add. If the rule is a system/global rule and the tool returns access denied, do not force a customer-specific workaround — record the exact prepared guard in the decision report with outcome=rule_tuning and the missing permission.',
+            'After a rule fix, close the covered rows with securenow_alert_review_run_apply_group_decision (use previewOnly:true first; set allowMixed only after reviewing every row). For correct detections use securenow_alert_review_run_keep_alive. For one-off rows use securenow_alert_review_run_resolve or securenow_alert_review_run_dismiss with a full decision report.',
+            confirmWrites
+              ? 'The user requested execution. Call write tools with confirm:true, a precise reason, and a decisionReport containing summary, evidence, reviewedHistory, traceIds, and missingProof when relevant.'
+              : 'Do not execute write tools yet. Produce a group-by-group plan with the exact validated guards and MCP write calls for user approval.',
+            'Never resolve a group as false positive without concrete benign samples AND proof the guard preserves attack detection. When uncertain, keep the rule alive and leave the row open with the missing proof named.',
+            'End with counts: groups worked, rules tuned (with the exact guards), rows resolved/dismissed/kept alive, rows left open with missing proof, and any permission blockers.',
+          ].join('\n'),
+        },
+      },
+    ];
+  }
+
+  if (name === 'soc_patrol') {
+    const maxAlertReviewGroups = args.maxAlertReviewGroups || 10;
+    const maxHumanRows = args.maxHumanRows || 10;
+    const confirmWrites = args.confirmWrites === true || args.confirmWrites === 'true';
+    return [
+      {
+        role: 'user',
+        content: {
+          type: 'text',
+          text: [
+            'Run one scheduled SecureNow SOC patrol pass using the MCP tools. This is the recurring pass the built-in SecureNow agent used to run every 5 minutes; you are its external replacement, so be conservative, auditable, and finish in one bounded pass.',
+            '',
+            'Phase 0 — check for work:',
+            '- Call securenow_alert_review_runs_count and securenow_human_actions_list (page=1, limit=1).',
+            '- If both queues are empty, stop and report "no open SOC work".',
+            '',
+            'Phase 1 — Alert Review first (root-cause rule fixes are the upstream fix; they auto-resolve downstream human work):',
+            `- Follow the work_alert_review runbook for up to ${maxAlertReviewGroups} root-cause group(s): list groups, inspect prototypes and siblings, validate narrow attack-preserving guards (two or more of path/method/status_code/user_agent) with condition tests/diffs before applying, tune rules, batch-resolve covered rows, keep real detections alive, and leave unclear rows open with the exact missing proof.`,
+            '',
+            'Phase 2 — Requires Human queue:',
+            `- Follow the work_human_actions runbook for up to ${maxHumanRows} row(s): list the queue most urgent first, read each AI report and trace evidence, then choose exactly one outcome per row (block, rate limit, scoped false positive, rule tuning, case action approve/reject, or an auditable no-write decision report with the missing proof).`,
+            '- Re-check rows against any rule changes from Phase 1 before deciding — a Phase 1 fix often already covers them.',
+            '',
+            'Safety (this run may be unattended):',
+            confirmWrites
+              ? '- Writes are allowed this pass: call write tools with confirm:true, a precise reason, and a full decisionReport. Never block without high-confidence malicious evidence (riskScore >= 90 or equivalent proof). Never create broad false positives or single-condition exclusions. Prefer an auditable no-write decision report whenever evidence is mixed.'
+              : '- Read-only pass: do NOT call write tools. Produce the exact prepared write calls (with guards and reasons) as a reviewable plan.',
+            '- Never trust an IP globally, never create IP allowlist entries, never suppress on attacker-controllable fields alone.',
+            '- Stay within the row/group budgets; leave the rest for the next scheduled pass.',
+            '',
+            'End with a compact patrol report: queues checked, groups/rows worked, rules tuned (exact guards), blocks/rate limits/false positives executed or prepared, rows left open with missing proof, and anything that needs a human decision.',
+          ].join('\n'),
+        },
+      },
+    ];
+  }
+
   if (name === 'cleanup_legacy_pending_blocks') {
     const limit = args.limit || 50;
     const environment = args.environment || 'production';