securenow 8.14.1 → 8.16.0

package/NPM_README.md

@@ -339,6 +339,11 @@ verification plus SQL validation. See `node_modules/securenow/TELEMETRY-SQL.md`
 timestamp handling, privacy rules, templates, and the full test-to-production lifecycle.
 
 ```bash
+# Describe a detection in English (new in 8.16): SecureNow picks an instant rule (every request,
+# as it arrives) or a periodic one (SQL on a schedule), writes it from your app's real data,
+# checks it against that data, and creates it in test mode when you confirm
+npx securenow alerts rules from-text "a sign-in from a new address, then a password change within 5 minutes" --app <app-key>
+
 # Create a custom detection rule from your own SQL (new in 8.1)
 npx securenow alerts rules create \
   --name "Auth: magic-link brute force" \

package/README.md

@@ -163,6 +163,8 @@ Everything the MCP server can do is also a command. Run `npx securenow help` for
 | `securenow ip <address>` | IP intelligence (geo, abuse, verdict) |
 | `securenow ip traces <address>` | Traces from an IP |
 | `securenow forensics "<query>"` | Natural-language forensic query |
+| `securenow forensics chat --app <key> ["<question>"]` | Forensics chat with memory; `--conversation <id>` continues one |
+| `securenow forensics conversations [<id>]` | List forensics conversations, or show one |
 | `securenow traces` / `traces show <traceId>` | Recent traces / trace spans |
 | `securenow traces analyze <traceId>` | AI security analysis of a trace |
 | `securenow logs [--since 6h] [--level error]` | View logs |

package/SKILL-CLI.md

@@ -275,6 +275,11 @@ its fields were observed and `alerts rules validate` succeeds. Otherwise label i
 ```bash
 securenow alerts                             # list alert rules (default)
 securenow alerts rules                       # list alert rules (columns: Status, Applications, Schedule)
+securenow alerts rules from-text \           # describe a detection in English; checked draft, then create (test mode)
+  "one IP failing 10 sign-ins in 5 minutes" \
+  --app <key> [--env production]             #   picks instant or periodic; --instant/--periodic, --draft-only, --yes
+securenow alerts rules create --name "Secrets probe" --apps <key> \
+  --conditions '[{"field":"path","operator":"contains","value":"/.env"}]'   # an instant rule, no SQL
 securenow alerts rules validate \            # dry-run a candidate query BEFORE creating any rule
   --sql @rule.sql --app <key>                #   no rule id needed — auto-hosts on an existing (system) rule
 securenow alerts rules create \              # create a custom detection rule from inline SQL
@@ -334,10 +339,20 @@ securenow ip traces <ip-address> --env production # traces originating from this
 ```bash
 securenow forensics "show me all SQL injection attempts in the last 24h" --env production
 securenow forensics query "top 10 IPs by blocked requests" --app my-app --env production
-securenow forensics chat --app my-app --env production # interactive forensics chat session
+securenow forensics chat --app my-app --env production # interactive forensics chat session (with memory)
+securenow forensics chat --app my-app "which accounts had failed logins then a success?"   # one question, prints the conversation id
+securenow forensics chat --conversation <id> "what else did those IPs do?"                # follow up: the chat remembers the earlier answers
+securenow forensics conversations             # list conversations (dashboard, CLI and agent ones)
+securenow forensics conversations <id>        # show one: questions, SQL, findings, rows
 securenow forensics library                  # view saved/template queries
 ```
 
+The chat runs discovery queries before answering, shows its SQL, and ends each answer with findings: what the result rows
+show. A follow-up sees the earlier questions, their findings, and the IPs and trace IDs in their results. MCP:
+`securenow_forensics_chat` (pass `conversationId` to continue), `securenow_forensics_conversations_list`,
+`securenow_forensics_conversation_get`. `securenow forensics "<q>"` and `securenow_forensics_query` answer one question
+with no memory.
+
 ---
 
 ### Firewall

package/cli/monitor.js

@@ -342,6 +342,8 @@ async function notificationsList(args, flags) {
   const s = ui.spinner('Fetching notifications');
   try {
     const query = { limit: flags.limit || 20, page: flags.page || 1 };
+    if (flags.search) query.search = String(flags.search);
+    if (flags.severity) query.severity = String(flags.severity).toLowerCase();
     const data = await api.get('/notifications', { query });
     const notifications = data.notifications || [];
     const pagination = data.pagination;
@@ -354,7 +356,7 @@ async function notificationsList(args, flags) {
       ui.c.dim(n.id || n._id || ''),
       ui.statusBadge(n.read ? 'read' : 'unread'),
       ui.truncate(n.title || n.message || n.type || '', 50),
-      n.ip || '—',
+      n.primaryIp || n.ip || '—',
       n.severity ? ui.statusBadge(n.severity) : '—',
       ui.timeAgo(n.createdAt),
     ]);

package/cli/security.js

@@ -39,6 +39,9 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'create' || sub === 'add') {
     return alertRuleCreate(args.slice(1), flags);
   }
+  if (sub === 'from-text' || sub === 'draft') {
+    return alertRuleFromText(args.slice(1), flags);
+  }
   if (sub === 'show') {
     return alertRuleShow(args.slice(1), flags);
   }
@@ -125,8 +128,8 @@ async function alertRuleSetMode(args, flags, mode) {
 
 // Duplicate any rule (including a read-only system template) into a new CUSTOM rule you
 // own. System rules are view-only examples — fork one with this to enable / edit it. The
-// copy defaults to Disabled (opt in with --enable / --status active); SQL, instant.block,
-// schedule, scope, and mode are copied from the source.
+// copy defaults to Disabled (opt in with --enable / --status active) and to test mode
+// (--mode prod to arm it); SQL, instant.block, schedule and scope are copied from the source.
 async function alertRuleDuplicate(args, flags) {
   requireAuth();
   const id = args[0];
@@ -221,8 +224,11 @@ async function alertRuleCreate(args, flags) {
 
   const queryMappingId = flags['query-mapping-id'] || flags.queryMappingId;
   const sqlQuery = readSqlArg(flags);
-  if (!queryMappingId && !sqlQuery) {
-    ui.error('Provide the detection query: --sql <sql|@file|-> (or reuse one with --query-mapping-id <id>).');
+  const instantConditions = flags.conditions ? readJsonArg(flags.conditions, '--conditions') : null;
+  if (!queryMappingId && !sqlQuery && !instantConditions) {
+    ui.error('Provide the detection query: --sql <sql|@file|-> (or reuse one with --query-mapping-id <id>),');
+    ui.error('or an instant rule: --conditions \'[{"field":"path","operator":"contains","value":"/.env"}]\' [--match any|all].');
+    ui.info('Or describe it in English: securenow alerts rules from-text "<what to catch>" --app <key>');
     console.log(ui.c.dim('  Scope app keys in SQL with the __USER_APP_KEYS__ placeholder. The column differs by table:'));
     console.log(ui.c.dim("  traces: WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__) AND timestamp >= now64(9) - INTERVAL 15 MINUTE"));
     console.log(ui.c.dim("  logs:   WHERE resources_string['service.name'] IN (__USER_APP_KEYS__) AND timestamp >= toUnixTimestamp64Nano(now64() - INTERVAL 15 MINUTE)"));
@@ -239,12 +245,22 @@ async function alertRuleCreate(args, flags) {
 
   const body = { name };
   if (flags.description) body.description = flags.description;
-  if (queryMappingId) body.queryMappingId = queryMappingId;
+  if (instantConditions) {
+    // An instant rule: checked against every incoming request, no SQL and no schedule.
+    body.executionMode = 'instant';
+    body.instant = {
+      enabled: true,
+      matchMode: flags.match === 'all' ? 'all' : 'any',
+      conditions: Array.isArray(instantConditions) ? instantConditions : [instantConditions],
+    };
+    const env = resolveEnvironment(flags);
+    if (env) body.instant.environments = String(env).split(',').map((e) => e.trim()).filter(Boolean);
+  } else if (queryMappingId) body.queryMappingId = queryMappingId;
   else body.sqlQuery = sqlQuery;
   if (flags.nlp || flags.text) body.nlpQuery = flags.nlp || flags.text;
   if (flags.category) body.category = flags.category;
   if (flags.severity) body.severity = String(flags.severity).toLowerCase();
-  if (flags['execution-mode']) body.executionMode = flags['execution-mode'];
+  if (flags['execution-mode'] && !instantConditions) body.executionMode = flags['execution-mode'];
 
   if (hasAll) {
     body.applicationsAll = true;
@@ -646,6 +662,163 @@ function readSqlArg(flags) {
   return text;
 }
 
+// JSON from a flag value, '@file' or '-' (stdin).
+function readJsonArg(raw, label) {
+  const text = String(raw);
+  const source = text === '-' ? fs.readFileSync(0, 'utf8') : text.startsWith('@') ? fs.readFileSync(text.slice(1), 'utf8') : text;
+  try {
+    return JSON.parse(source);
+  } catch (err) {
+    ui.error(`${label} is not valid JSON: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+// ── English → alert rule ──
+// The API drafts the rule from the app's real data (instant or periodic), checks it against that
+// data, and returns the draft. Nothing is created until you confirm; new rules start in test mode.
+
+async function waitForDraft(draftId, s) {
+  for (let i = 0; i < 90; i++) {
+    await new Promise(r => setTimeout(r, 1500));
+    const result = await api.get(`/alert-rules/draft/${draftId}`);
+    if (result.status !== 'running') return result;
+    if (s && i === 6) s.update('Checking the draft against your data');
+  }
+  return { status: 'failed', error: 'The draft is still running after 2 minutes; try again' };
+}
+
+function draftCell(value) {
+  if (value == null) return '';
+  const text = typeof value === 'object' ? JSON.stringify(value) : String(value);
+  return text.length > 40 ? `${text.slice(0, 37)}…` : text;
+}
+
+function printDraft(result) {
+  const d = result.draft || {};
+  const check = result.check || {};
+  const kindLabel = d.kind === 'instant' ? ui.c.cyan('Instant rule') : ui.c.cyan('Periodic rule');
+  console.log('');
+  console.log(`  ${kindLabel} ${ui.c.dim('·')} ${d.severity || 'medium'} ${ui.c.dim('·')} ${d.category || 'custom'}`);
+  console.log(`  ${ui.c.bold(d.name || '')}`);
+  if (d.summary) console.log(`  ${d.summary}`);
+  if (d.whyThisKind) console.log(ui.c.dim(`  Why ${d.kind}: ${d.whyThisKind}`));
+  console.log('');
+  if (d.kind === 'instant') {
+    const conditions = d.instant?.conditions || [];
+    const envs = d.instant?.environments || [];
+    console.log(`  Watches   every request, as it arrives${envs.length ? `, in ${envs.join(', ')}` : ', in every environment'}`);
+    console.log(`  When      ${d.instant?.matchMode === 'all' ? 'all of' : 'any of'}`);
+    for (const c of conditions) console.log(`            ${c.field} ${ui.c.dim(c.operator)} ${c.value}`);
+  } else {
+    const parts = [d.schedule?.description || d.schedule?.cronExpression];
+    if (d.windowMinutes) parts.push(`window ${d.windowMinutes} min`);
+    if (d.threshold) parts.push(d.threshold);
+    console.log(`  Schedule  ${parts.filter(Boolean).join(ui.c.dim(' · '))}`);
+    console.log('  SQL');
+    for (const line of String(d.sqlQuery || '').split('\n')) console.log(ui.c.dim(`    ${line}`));
+  }
+  console.log('');
+  console.log(`  Check     ${check.note || ''}`);
+  const rows = check.rows || [];
+  if (rows.length) {
+    const cols = Object.keys(rows[0]).slice(0, 6);
+    console.log('');
+    ui.table(cols, rows.slice(0, 8).map((row) => cols.map((c) => draftCell(row[c]))));
+  }
+  for (const w of check.warnings || []) ui.warn(w);
+}
+
+function draftToCreateBody(result, flags) {
+  const d = result.draft || {};
+  const body = {
+    name: flags.name ? String(flags.name) : d.name,
+    description: d.summary || '',
+    nlpQuery: d.nlpQuery,
+    category: d.category,
+    severity: flags.severity ? String(flags.severity).toLowerCase() : d.severity,
+    applicationsAll: false,
+    applications: [result.applicationKey],
+    executionMode: d.executionMode,
+  };
+  if (d.executionMode === 'instant') body.instant = d.instant;
+  else {
+    body.sqlQuery = d.sqlQuery;
+    body.schedule = d.schedule;
+  }
+  if (flags['no-throttle']) body.throttle = { enabled: false, minutes: 0 };
+  else if (flags['throttle-minutes']) body.throttle = { enabled: true, minutes: Number(flags['throttle-minutes']) };
+  return body;
+}
+
+async function alertRuleFromText(args, flags) {
+  requireAuth();
+  const text = (args.join(' ').trim() || (typeof flags.text === 'string' ? flags.text : '')).trim();
+  const appKey = resolveApp(flags);
+  if (!text || !appKey) {
+    ui.error('Usage: securenow alerts rules from-text "<what the rule should catch>" --app <key> [--env <environment>]');
+    console.log(ui.c.dim('  [--instant | --periodic] [--name "..."] [--severity high] [--yes] [--draft-only] [--json]'));
+    console.log(ui.c.dim('  Example: securenow alerts rules from-text "one IP failing 10 sign-ins in 5 minutes" --app <key>'));
+    process.exit(1);
+  }
+
+  const body = { text, applicationKey: appKey };
+  const environment = resolveEnvironment(flags);
+  if (environment) body.environment = environment;
+  if (flags.instant || flags.kind === 'instant') body.kind = 'instant';
+  else if (flags.periodic || flags.kind === 'periodic') body.kind = 'periodic';
+
+  const s = ui.spinner('Drafting the rule from your app\'s data');
+  let result;
+  try {
+    const started = await api.post('/alert-rules/draft', body);
+    result = await waitForDraft(started.draftId, s);
+  } catch (err) {
+    s.fail('Failed to draft the rule');
+    throw err;
+  }
+  if (result.status !== 'complete') {
+    s.fail(result.error || 'Could not draft the rule');
+    process.exit(1);
+  }
+  s.stop('Draft ready');
+
+  if (flags.json && (flags['draft-only'] || !flags.yes)) { ui.json(result); return; }
+  printDraft(result);
+  console.log('');
+  if (flags['draft-only']) {
+    ui.info('Draft only: nothing was created. Drop --draft-only to create it.');
+    return;
+  }
+  if (!flags.yes) {
+    const ok = await ui.confirm('Create this rule? It starts in test mode: it alerts, but blocks nothing');
+    if (!ok) { ui.info('Nothing created'); return; }
+  }
+
+  const c = ui.spinner('Creating the rule');
+  let data;
+  try {
+    data = await api.post('/alert-rules', draftToCreateBody(result, flags));
+  } catch (err) {
+    c.fail('Failed to create the rule');
+    throw err;
+  }
+  const r = data.alertRule || data;
+  const id = r._id || r.id || '';
+  c.stop('Rule created');
+  if (flags.json) { ui.json({ draft: result.draft, check: result.check, alertRule: r }); return; }
+  console.log('');
+  ui.keyValue([
+    ['ID', id || '-'],
+    ['Name', r.name || '-'],
+    ['Kind', r.executionMode === 'instant' ? 'instant (every request, as it arrives)' : `periodic (${r.schedule?.description || r.schedule?.cronExpression || '-'})`],
+    ['Mode', `${r.mode || 'test'} (alerts only, no blocking)`],
+    ['Application', (r.applications || []).join(', ') || '-'],
+  ]);
+  console.log('');
+  ui.success(`Watching. Promote it when it has proved itself: securenow alerts rules promote ${id}`);
+}
+
 async function alertRuleTest(args, flags) {
   requireAuth();
   const id = args[0];
@@ -1509,24 +1682,124 @@ async function forensicsLibrary(args, flags) {
 
 // ── Forensics Chat ──
 
-async function forensicsChat(args, flags) {
-  requireAuth();
+const CHAT_PRINT_ROWS = 25;
+
+// Log timestamps come back as nanosecond (or microsecond) epochs when a query returns
+// min(timestamp) and the like from the logs table; print them as times.
+function chatCell(value) {
+  const s = String(value ?? '');
+  if (/^\d{16,19}$/.test(s)) {
+    const n = Number(s);
+    const ms = n >= 1e18 && n < 4e18 ? n / 1e6 : n >= 1e15 && n < 4e15 ? n / 1e3 : null;
+    if (ms != null) return new Date(ms).toISOString().replace('T', ' ').replace('Z', '');
+  }
+  return typeof value === 'object' && value !== null ? JSON.stringify(value) : s;
+}
+
+// The API answers a chat message with 202 and works in the background; poll until
+// the reply settles (complete or awaiting_confirmation) or about five minutes pass.
+async function waitForChatReply(conversationId, environment, s) {
+  for (let i = 0; i < 150; i++) {
+    await new Promise(r => setTimeout(r, 2000));
+    const result = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
+    if (result.status !== 'processing') return { ...result, conversationId };
+    if (result._progress?.action && s) s.update(result._progress.action);
+  }
+  return { conversationId, status: 'processing' };
+}
+
+async function sendChatMessage(body, environment, s) {
+  const chatRes = await api.post('/forensics/chat', body);
+  if (chatRes.status !== 'processing') {
+    return { conversationId: chatRes.conversationId, status: 'complete', message: chatRes.message };
+  }
+  return waitForChatReply(chatRes.conversationId, environment, s);
+}
+
+async function confirmChatQuery(conversationId, environment, s) {
+  await api.post(`/forensics/chat/confirm/${conversationId}`, { environment });
+  return waitForChatReply(conversationId, environment, s);
+}
+
+// Resolve what a chat talks to: an existing conversation (--conversation <id>,
+// which carries its own app and environment) or a new one scoped to --app.
+async function resolveChatTarget(flags) {
+  if (typeof flags.conversation === 'string' && flags.conversation) {
+    const data = await api.get(`/forensics/conversations/${flags.conversation}`);
+    const conv = data.conversation;
+    return {
+      conversationId: conv.id,
+      title: conv.title,
+      label: conv.applicationName || conv.applicationKey || conv.applicationId,
+      appKey: conv.applicationKey,
+      environment: conv.environment || 'production',
+      messageCount: (conv.messages || []).length,
+    };
+  }
   const resolved = await resolveAppId(flags);
   if (!resolved) {
-    ui.error('App required. Usage: securenow forensics chat --app <key>');
+    ui.error('App required. Usage: securenow forensics chat --app <key>, or --conversation <id> to continue one.');
     ui.info('Set a default with: securenow apps default <key>');
     process.exit(1);
   }
+  return {
+    conversationId: null,
+    label: resolved.name || resolved.key,
+    appKey: resolved.key,
+    environment: resolveEnvironment(flags, 'production'),
+  };
+}
 
-  console.log('');
-  ui.heading(`Forensics Chat — ${resolved.name || resolved.key}`);
-  console.log(ui.c.dim(`  App: ${resolved.key} (${resolved.id})`));
-  console.log(ui.c.dim('  Type your question, or "exit" to quit.\n'));
+async function forensicsChat(args, flags) {
+  requireAuth();
+  // `--json "<question>"` parses the question as the flag's value; give it back.
+  const words = [...args];
+  for (const key of ['json', 'yes', 'force']) {
+    if (typeof flags[key] === 'string') { words.push(flags[key]); flags[key] = true; }
+  }
+  const target = await resolveChatTarget(flags);
+  const { environment } = target;
+  let conversationId = target.conversationId;
+  const question = words.join(' ').trim();
+
+  // One question, one reply, then exit: scriptable, and what an agent without MCP uses.
+  if (question) {
+    const s = flags.json ? null : ui.spinner('Thinking');
+    const body = { message: question, environment };
+    if (conversationId) body.conversationId = conversationId;
+    else body.applicationKey = target.appKey;
+    let reply = await sendChatMessage(body, environment, s);
+    if (reply.status === 'awaiting_confirmation' && (flags.yes || flags.force)) {
+      if (s) s.update('Running the large query');
+      reply = await confirmChatQuery(reply.conversationId, environment, s);
+    }
+    if (flags.json) { ui.json(reply); return; }
+    if (reply.status === 'processing') {
+      s.fail('Still working');
+      ui.info(`See the reply later: securenow forensics conversations ${reply.conversationId}`);
+      return;
+    }
+    s.stop('Done');
+    printChatMessage(reply.message);
+    console.log('');
+    if (reply.status === 'awaiting_confirmation') {
+      ui.info('Large query held back. Add --yes to run it, or ask a narrower question.');
+    }
+    ui.info(`Conversation ${reply.conversationId}`);
+    console.log(ui.c.dim(`  Follow up: securenow forensics chat --conversation ${reply.conversationId} "<question>"`));
+    console.log('');
+    return;
+  }
 
-  const environment = resolveEnvironment(flags, 'production');
+  console.log('');
+  ui.heading(`Forensics Chat — ${target.label}`);
+  if (conversationId) {
+    console.log(ui.c.dim(`  Continuing: ${target.title} (${target.messageCount} messages)`));
+  } else {
+    console.log(ui.c.dim(`  App: ${target.appKey}`));
+  }
   console.log(ui.c.dim(`  Env: ${environment}`));
-
-  let conversationId = null;
+  console.log(ui.c.dim('  Type your question, or "exit" to quit.\n'));
 
   const readline = require('readline');
   const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
@@ -1541,57 +1814,37 @@ async function forensicsChat(args, flags) {
       if (!message || message.toLowerCase() === 'exit' || message.toLowerCase() === 'quit') {
         console.log('');
         ui.info('Chat ended.');
+        if (conversationId) console.log(ui.c.dim(`  Continue later: securenow forensics chat --conversation ${conversationId}`));
         break;
       }
 
       const s = ui.spinner('Thinking');
       try {
-        const body = { message, applicationKey: resolved.key, environment };
+        const body = { message, environment };
         if (conversationId) body.conversationId = conversationId;
+        else body.applicationKey = target.appKey;
 
-        const chatRes = await api.post('/forensics/chat', body);
-        conversationId = chatRes.conversationId;
-
-        if (chatRes.status === 'processing') {
-          let result;
-          for (let i = 0; i < 150; i++) {
-            await new Promise(r => setTimeout(r, 2000));
-            result = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
-            if (result.status === 'complete' || result.status === 'failed' || result.status === 'awaiting_confirmation') break;
-            const progress = result._progress;
-            if (progress?.action) s.update(progress.action);
-          }
+        const reply = await sendChatMessage(body, environment, s);
+        conversationId = reply.conversationId;
 
-          if (!result || result.status === 'processing') {
-            s.fail('Response timed out');
-            continue;
-          }
+        if (reply.status === 'processing') {
+          s.fail('Response timed out');
+          continue;
+        }
 
-          s.stop('Done');
-          printChatMessage(result.message);
-
-          if (result.status === 'awaiting_confirmation') {
-            const proceed = await ui.confirm('Proceed with this query?');
-            if (proceed) {
-              const cs = ui.spinner('Executing query');
-              await api.post(`/forensics/chat/confirm/${conversationId}`, { environment });
-              let confirmResult;
-              for (let i = 0; i < 90; i++) {
-                await new Promise(r => setTimeout(r, 2000));
-                confirmResult = await api.get(`/forensics/chat/status/${conversationId}`, { query: { environment } });
-                if (confirmResult.status !== 'processing') break;
-              }
-              cs.stop('Done');
-              if (confirmResult?.message) printChatMessage(confirmResult.message);
-            } else {
-              ui.info('Query skipped. Ask a different question or refine.');
-            }
+        s.stop('Done');
+        printChatMessage(reply.message);
+
+        if (reply.status === 'awaiting_confirmation') {
+          const proceed = await ui.confirm('Proceed with this query?');
+          if (proceed) {
+            const cs = ui.spinner('Executing query');
+            const confirmed = await confirmChatQuery(conversationId, environment, cs);
+            cs.stop('Done');
+            if (confirmed?.message) printChatMessage(confirmed.message);
+          } else {
+            ui.info('Query skipped. Ask a different question or refine.');
           }
-        } else if (chatRes.message) {
-          s.stop('Done');
-          printChatMessage(chatRes.message);
-        } else {
-          s.stop('Done');
         }
       } catch (err) {
         s.fail('Error');
@@ -1604,9 +1857,61 @@ async function forensicsChat(args, flags) {
   }
 }
 
-function printChatMessage(msg) {
+async function forensicsConversations(args, flags) {
+  requireAuth();
+  const id = args[0];
+
+  if (id) {
+    const s = flags.json ? null : ui.spinner('Fetching conversation');
+    const data = await api.get(`/forensics/conversations/${id}`);
+    const conv = data.conversation;
+    if (flags.json) { ui.json(conv); return; }
+    s.stop(conv.title);
+    console.log(ui.c.dim(`  ${conv.applicationName || conv.applicationKey} · ${conv.environment} · ${(conv.messages || []).length} messages · ${conv.id}`));
+    for (const msg of conv.messages || []) {
+      if (msg.role === 'user') {
+        console.log(`\n  ${ui.c.cyan('you >')} ${msg.content}`);
+      } else {
+        printChatMessage(msg, { maxRows: 10 });
+      }
+    }
+    console.log('');
+    console.log(ui.c.dim(`  Continue: securenow forensics chat --conversation ${conv.id} "<question>"`));
+    console.log('');
+    return;
+  }
+
+  const s = flags.json ? null : ui.spinner('Fetching conversations');
+  const query = {};
+  if (flags.app) {
+    const resolved = await resolveAppId(flags);
+    if (resolved) query.applicationId = resolved.id;
+  }
+  const data = await api.get('/forensics/conversations', { query });
+  const list = data.conversations || [];
+  if (flags.json) { ui.json(list); return; }
+  s.stop(`Found ${list.length} conversation${list.length !== 1 ? 's' : ''}`);
+  console.log('');
+  ui.table(['ID', 'Title', 'App', 'Env', 'Msgs', 'Updated'], list.map(c => [
+    ui.c.dim(c.id),
+    ui.truncate(c.title || '', 48),
+    c.applicationName || '—',
+    c.environment || '—',
+    String(c.messageCount ?? 0),
+    ui.timeAgo(c.updatedAt),
+  ]));
+  console.log('');
+}
+
+function printChatMessage(msg, { maxRows = CHAT_PRINT_ROWS } = {}) {
   if (!msg) return;
   console.log('');
+  if (msg.reasoning) {
+    console.log(ui.c.dim(`  plan: ${msg.reasoning}`));
+  }
+  if (Array.isArray(msg.discoverySteps) && msg.discoverySteps.length > 0) {
+    console.log(ui.c.dim(`  ${msg.discoverySteps.length} discovery quer${msg.discoverySteps.length !== 1 ? 'ies' : 'y'} run first`));
+  }
   if (msg.content) {
     console.log(`  ${ui.c.green('ai >')} ${msg.content}`);
   }
@@ -1616,11 +1921,18 @@ function printChatMessage(msg) {
     console.log(`\n  ${ui.c.dim(msg.sqlQuery)}\n`);
   }
   if (msg.results && Array.isArray(msg.results) && msg.results.length > 0) {
-    ui.subheading(`Results (${msg.resultCount ?? msg.results.length} rows)`);
+    const total = msg.resultCount ?? msg.results.length;
+    ui.subheading(`Results (${total} rows)`);
     console.log('');
     const headers = Object.keys(msg.results[0]);
-    const rows = msg.results.map(row => headers.map(h => String(row[h] ?? '')));
+    const rows = msg.results.slice(0, maxRows).map(row => headers.map(h => chatCell(row[h])));
     ui.table(headers, rows);
+    if (msg.results.length > maxRows) {
+      console.log(ui.c.dim(`  … ${msg.results.length - maxRows} more rows (--json for all)`));
+    }
+  }
+  if (msg.findings) {
+    console.log(`\n  ${ui.c.cyan('findings >')} ${msg.findings}`);
   }
   if (msg.estimation) {
     const est = msg.estimation;
@@ -1857,6 +2169,7 @@ module.exports = {
   trustedRemove,
   forensicsQuery,
   forensicsChat,
+  forensicsConversations,
   forensicsLibrary,
   ipLookup,
   ipTraces,

package/cli.js

@@ -240,7 +240,7 @@ const COMMANDS = {
     desc: 'Manage notifications',
     usage: 'securenow notifications <subcommand> [options]',
     sub: {
-      list: { desc: 'List notifications', flags: { limit: 'Max results', page: 'Page number' }, run: (a, f) => require('./cli/monitor').notificationsList(a, f) },
+      list: { desc: 'List notifications', flags: { limit: 'Max results', page: 'Page number', search: 'Only notifications whose title, description or IP contains this text (e.g. a rule name)', severity: 'critical | high | medium | low' }, run: (a, f) => require('./cli/monitor').notificationsList(a, f) },
       read: { desc: 'Mark notification as read', usage: 'securenow notifications read <id>', run: (a, f) => require('./cli/monitor').notificationsRead(a, f) },
       'read-all': { desc: 'Mark all as read', run: () => require('./cli/monitor').notificationsReadAll() },
       unread: { desc: 'Show unread count', run: () => require('./cli/monitor').notificationsUnread() },
@@ -311,11 +311,18 @@ const COMMANDS = {
     usage: 'securenow alerts <subcommand> [options]',
     sub: {
       rules: {
-        desc: 'Create, list, show, update, duplicate, promote/demote, set-sql, validate, delete, test, or tune alert rules',
-        usage: 'securenow alerts rules <list|create|show|update|duplicate|promote|demote|set-sql|validate|delete|test|dry-run-query|tune-query|exclusions> [options]',
+        desc: 'Create (from English or SQL), list, show, update, duplicate, promote/demote, set-sql, validate, delete, test, or tune alert rules',
+        usage: 'securenow alerts rules <list|from-text|create|show|update|duplicate|promote|demote|set-sql|validate|delete|test|dry-run-query|tune-query|exclusions|versions|version|rollback> [options]\n'
+          + '  securenow alerts rules from-text "<what to catch, in English>" --app <key> [--env <environment>] [--instant|--periodic] [--yes|--draft-only]',
         flags: {
           json: 'Output as JSON',
-          name: 'With create: rule name',
+          env: 'With from-text or create --conditions: only watch this environment (default: every environment)',
+          instant: 'With from-text: ask for an instant rule (every request, as it arrives)',
+          periodic: 'With from-text: ask for a periodic rule (SQL on a schedule)',
+          'draft-only': 'With from-text: show the checked draft, create nothing',
+          conditions: 'With create: instant-rule conditions as JSON, @file or - ([{"field":"path","operator":"contains","value":"/.env"}])',
+          match: 'With create --conditions: any (default) | all',
+          name: 'With create/from-text: rule name',
           description: 'With create: rule description',
           nlp: 'With create: plain-English intent stored on the query',
           text: 'Alias for --nlp',
@@ -585,7 +592,8 @@ const COMMANDS = {
     usage: 'securenow forensics <query> [--app <key>]',
     sub: {
       query: { desc: 'Run a forensic query', flags: { app: 'App key to scope query', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/security').forensicsQuery(a, f) },
-      chat: { desc: 'Interactive forensics chat (scoped to an app)', usage: 'securenow forensics chat --app <key> [--env production]', flags: { app: 'App key to chat with', env: 'Environment (default: production)', environment: 'Alias for --env' }, run: (a, f) => require('./cli/security').forensicsChat(a, f) },
+      chat: { desc: 'Forensics chat with memory: interactive, or one question with "<question>"', usage: 'securenow forensics chat [--app <key> | --conversation <id>] ["<question>"] [--json]', flags: { app: 'App key for a new conversation', conversation: 'Continue this conversation (from the dashboard, the CLI or an agent)', env: 'Environment of a new conversation (default: production)', environment: 'Alias for --env', yes: 'Run a query the chat held back as large', json: 'Print the raw reply (one-question mode)' }, run: (a, f) => require('./cli/security').forensicsChat(a, f) },
+      conversations: { desc: 'List forensics chat conversations, or show one', usage: 'securenow forensics conversations [<id>] [--app <key>] [--json]', flags: { app: 'Only conversations about this app', json: 'Output as JSON' }, run: (a, f) => require('./cli/security').forensicsConversations(a, f) },
       library: { desc: 'View saved queries', run: (a, f) => require('./cli/security').forensicsLibrary(a, f) },
     },
     defaultAction: (a, f) => require('./cli/security').forensicsQuery(a, f),

package/mcp/catalog.js

@@ -845,7 +845,7 @@ const TOOLS = [
   {
     name: 'securenow_forensics_query',
     title: 'Run Forensics Query',
-    description: 'Run a natural-language forensic query over your traffic and return the result rows. Waits up to 30 seconds; a query still running after that returns its jobId with status processing. Write scope because it creates an async query job.',
+    description: 'Run one natural-language forensic query over your traffic and return the result rows. One question, no memory of earlier questions; for an investigation with follow-ups use securenow_forensics_chat. Waits up to 30 seconds; a query still running after that returns its jobId with status processing. Write scope because it creates an async query job.',
     scope: 'forensics:write',
     readOnly: false,
     confirm: true,
@@ -890,6 +890,93 @@ const TOOLS = [
     endpoint: '/forensics/query-library',
     inputSchema: objectSchema({}),
   },
+  {
+    name: 'securenow_forensics_chat',
+    title: 'Ask the Forensics Chat',
+    description: 'Ask the SecureNow forensics chat a question about one app\'s traces, logs, errors and custom events, in plain English. Without conversationId it starts a new conversation (applicationKey or applicationId required); with conversationId it continues that conversation, including ones started in the dashboard or the CLI, and the chat sees the earlier questions, their SQL, findings, and the IPs and trace IDs in their results. The reply has the chat\'s reasoning, any discovery queries, the SQL, up to 100 result rows and findings: what the rows show. Read-only over telemetry. Waits up to 90 seconds; a reply still running after that comes back with status processing (use securenow_forensics_chat_status). Status awaiting_confirmation means the query is large: run it with securenow_forensics_chat_confirm or ask a narrower question.',
+    scope: 'forensics:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/forensics/chat',
+    bodyFields: ['message', 'conversationId', 'applicationKey', 'applicationId', 'environment'],
+    poll: {
+      tool: 'securenow_forensics_chat_status',
+      idField: 'conversationId',
+      pending: ['processing'],
+      timeoutMs: 90000,
+      intervalMs: 2000,
+    },
+    inputSchema: objectSchema({
+      message: string('The question, in plain English. Follow-ups can refer to earlier answers ("those IPs", "that session").'),
+      conversationId: string('Continue this conversation. Omit to start a new one.'),
+      applicationKey: string('App key the new conversation is scoped to. Not needed with conversationId.'),
+      applicationId: string('App database id, instead of applicationKey.'),
+      environment: string('Environment of a new conversation: production (default), staging, preview, local or test. Omit it when continuing: a conversation keeps its environment.'),
+      ...confirmSchema,
+    }, ['message', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_forensics_chat_status',
+    title: 'Forensics Chat Reply',
+    description: 'Get the latest reply of a forensics chat conversation: status (processing, complete or awaiting_confirmation), progress while processing, then the reasoning, SQL, result rows and findings.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/chat/status/:conversationId',
+    pathParams: ['conversationId'],
+    inputSchema: objectSchema({
+      conversationId: string('Forensics chat conversation id.'),
+    }, ['conversationId']),
+  },
+  {
+    name: 'securenow_forensics_chat_confirm',
+    title: 'Run a Large Forensics Query',
+    description: 'Run the query a forensics chat held back as large (status awaiting_confirmation), after the user agrees. Returns the rows and findings like securenow_forensics_chat.',
+    scope: 'forensics:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/forensics/chat/confirm/:conversationId',
+    pathParams: ['conversationId'],
+    poll: {
+      tool: 'securenow_forensics_chat_status',
+      idField: 'conversationId',
+      pending: ['processing'],
+      timeoutMs: 90000,
+      intervalMs: 2000,
+    },
+    inputSchema: objectSchema({
+      conversationId: string('Forensics chat conversation id.'),
+      ...confirmSchema,
+    }, ['conversationId', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_forensics_conversations_list',
+    title: 'List Forensics Conversations',
+    description: 'List your forensics chat conversations, newest first (up to 100): id, title, app, environment, message count and last update. Includes conversations started in the dashboard and the CLI.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/conversations',
+    queryFields: ['applicationId'],
+    inputSchema: objectSchema({
+      applicationId: string('Only conversations about this app database id.'),
+    }),
+  },
+  {
+    name: 'securenow_forensics_conversation_get',
+    title: 'Get Forensics Conversation',
+    description: 'Get a whole forensics chat conversation: every question and reply with its reasoning, SQL, findings and up to 100 result rows. Use it to read an investigation someone started in the dashboard before continuing it with securenow_forensics_chat.',
+    scope: 'forensics:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/forensics/conversations/:id',
+    pathParams: ['id'],
+    inputSchema: objectSchema({
+      id: string('Forensics chat conversation id.'),
+    }, ['id']),
+  },
   {
     name: 'securenow_analytics_summary',
     title: 'Analytics Summary',
@@ -1291,6 +1378,70 @@ const TOOLS = [
       ...confirmSchema,
     }, ['text', 'confirm', 'reason']),
   },
+  {
+    name: 'securenow_alert_rule_draft',
+    title: 'Draft an Alert Rule From English',
+    description: 'Turn a detection idea in plain English into an alert rule draft for one app, checked against that app\'s data. It reads the app\'s real event types, attribute keys and routes, then picks the kind: instant (conditions checked on every incoming request, alerts within seconds; one request is enough evidence) or periodic (SQL run on a schedule: counts, thresholds, distinct counts, ratios, sequences, baselines, security events, app log lines). Periodic SQL is run once against the data; instant conditions are replayed over the app\'s last 2000 requests, so check.matches shows what would alert today (false positives). Nothing is saved: create it with securenow_alert_rule_create, passing the draft fields. Waits up to 120 seconds.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules/draft',
+    bodyFields: ['text', 'applicationKey', 'environment', 'kind'],
+    poll: {
+      tool: 'securenow_alert_rule_draft_status',
+      idField: 'draftId',
+      pending: ['running'],
+      timeoutMs: 120000,
+      intervalMs: 2000,
+    },
+    inputSchema: objectSchema({
+      text: string('What the rule should catch, in plain English, e.g. "one IP failing 10 sign-ins in 5 minutes" or "anyone requesting /.env or /.git".'),
+      applicationKey: string('App key the rule watches; the draft is checked against its data.'),
+      environment: string('Only watch this environment (e.g. production). Omit to watch every environment.'),
+      kind: string('Optional: instant or periodic. Omit to let the drafter choose.'),
+      ...confirmSchema,
+    }, ['text', 'applicationKey', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_draft_status',
+    title: 'Alert Rule Draft Result',
+    description: 'Get an alert rule draft started by securenow_alert_rule_draft: status (running, complete or failed), then the draft (kind, name, summary, SQL and schedule, or instant conditions) and the check against the app\'s data.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/draft/:draftId',
+    pathParams: ['draftId'],
+    inputSchema: objectSchema({
+      draftId: string('Draft id from securenow_alert_rule_draft.'),
+    }, ['draftId']),
+  },
+  {
+    name: 'securenow_alert_rule_create',
+    title: 'Create Alert Rule (Test Mode)',
+    description: 'Create an alert rule. It always starts in test mode: it alerts, but nothing blocks, rate-limits or acts on its alerts until a person promotes it. Instant rule: executionMode "instant" plus instant {matchMode: any|all, conditions: [{field: path|method|user_agent|status_code|request_body|request_headers|client_ip|host, operator, value}]}. Periodic rule: sqlQuery plus schedule {cronExpression}; the SQL must scope every table with the __USER_APP_KEYS__ placeholder, bound time on every table read, and return a column named ip (rows without an ip never alert). Easiest path: securenow_alert_rule_draft, then pass its draft fields here. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules',
+    bodyFields: ['name', 'description', 'nlpQuery', 'category', 'severity', 'applications', 'applicationsAll', 'executionMode', 'sqlQuery', 'schedule', 'instant', 'throttle'],
+    inputSchema: objectSchema({
+      name: string('Rule name.'),
+      description: string('What it catches, in a sentence.'),
+      nlpQuery: string('The detection idea in plain English (kept with the rule).'),
+      category: string('One word, e.g. authentication, scanning, exfiltration.'),
+      severity: string('low, medium, high or critical.'),
+      applications: { type: 'array', items: { type: 'string' }, description: 'App keys the rule watches.' },
+      applicationsAll: boolean('true watches every app instead of applications.'),
+      executionMode: string('scheduled (periodic SQL, the default) or instant (conditions on every request).'),
+      sqlQuery: string('Periodic rules: the detection SELECT.'),
+      schedule: { type: 'object', additionalProperties: true, description: 'Periodic rules: {cronExpression: "* * * * *", description: "Every minute"}. Default every 15 minutes.' },
+      instant: { type: 'object', additionalProperties: true, description: 'Instant rules: {matchMode: "any" | "all", conditions: [{field, operator, value}], environments: ["staging"] (optional; omit to watch every environment)}.' },
+      throttle: { type: 'object', additionalProperties: true, description: 'Optional {enabled: true, minutes: 15}: one alert per rule per window.' },
+      ...confirmSchema,
+    }, ['name', 'confirm', 'reason']),
+  },
   {
     name: 'securenow_alert_rules_list',
     title: 'List Alert Rules',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.14.1",
+  "version": "8.16.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",