securenow 8.15.0 → 8.16.0

package/NPM_README.md

@@ -339,6 +339,11 @@ verification plus SQL validation. See `node_modules/securenow/TELEMETRY-SQL.md`
 timestamp handling, privacy rules, templates, and the full test-to-production lifecycle.
 
 ```bash
+# Describe a detection in English (new in 8.16): SecureNow picks an instant rule (every request,
+# as it arrives) or a periodic one (SQL on a schedule), writes it from your app's real data,
+# checks it against that data, and creates it in test mode when you confirm
+npx securenow alerts rules from-text "a sign-in from a new address, then a password change within 5 minutes" --app <app-key>
+
 # Create a custom detection rule from your own SQL (new in 8.1)
 npx securenow alerts rules create \
   --name "Auth: magic-link brute force" \

package/SKILL-CLI.md

@@ -275,6 +275,11 @@ its fields were observed and `alerts rules validate` succeeds. Otherwise label i
 ```bash
 securenow alerts                             # list alert rules (default)
 securenow alerts rules                       # list alert rules (columns: Status, Applications, Schedule)
+securenow alerts rules from-text \           # describe a detection in English; checked draft, then create (test mode)
+  "one IP failing 10 sign-ins in 5 minutes" \
+  --app <key> [--env production]             #   picks instant or periodic; --instant/--periodic, --draft-only, --yes
+securenow alerts rules create --name "Secrets probe" --apps <key> \
+  --conditions '[{"field":"path","operator":"contains","value":"/.env"}]'   # an instant rule, no SQL
 securenow alerts rules validate \            # dry-run a candidate query BEFORE creating any rule
   --sql @rule.sql --app <key>                #   no rule id needed — auto-hosts on an existing (system) rule
 securenow alerts rules create \              # create a custom detection rule from inline SQL

package/cli/monitor.js

@@ -342,6 +342,8 @@ async function notificationsList(args, flags) {
   const s = ui.spinner('Fetching notifications');
   try {
     const query = { limit: flags.limit || 20, page: flags.page || 1 };
+    if (flags.search) query.search = String(flags.search);
+    if (flags.severity) query.severity = String(flags.severity).toLowerCase();
     const data = await api.get('/notifications', { query });
     const notifications = data.notifications || [];
     const pagination = data.pagination;
@@ -354,7 +356,7 @@ async function notificationsList(args, flags) {
       ui.c.dim(n.id || n._id || ''),
       ui.statusBadge(n.read ? 'read' : 'unread'),
       ui.truncate(n.title || n.message || n.type || '', 50),
-      n.ip || '—',
+      n.primaryIp || n.ip || '—',
       n.severity ? ui.statusBadge(n.severity) : '—',
       ui.timeAgo(n.createdAt),
     ]);

package/cli/security.js

@@ -39,6 +39,9 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'create' || sub === 'add') {
     return alertRuleCreate(args.slice(1), flags);
   }
+  if (sub === 'from-text' || sub === 'draft') {
+    return alertRuleFromText(args.slice(1), flags);
+  }
   if (sub === 'show') {
     return alertRuleShow(args.slice(1), flags);
   }
@@ -125,8 +128,8 @@ async function alertRuleSetMode(args, flags, mode) {
 
 // Duplicate any rule (including a read-only system template) into a new CUSTOM rule you
 // own. System rules are view-only examples — fork one with this to enable / edit it. The
-// copy defaults to Disabled (opt in with --enable / --status active); SQL, instant.block,
-// schedule, scope, and mode are copied from the source.
+// copy defaults to Disabled (opt in with --enable / --status active) and to test mode
+// (--mode prod to arm it); SQL, instant.block, schedule and scope are copied from the source.
 async function alertRuleDuplicate(args, flags) {
   requireAuth();
   const id = args[0];
@@ -221,8 +224,11 @@ async function alertRuleCreate(args, flags) {
 
   const queryMappingId = flags['query-mapping-id'] || flags.queryMappingId;
   const sqlQuery = readSqlArg(flags);
-  if (!queryMappingId && !sqlQuery) {
-    ui.error('Provide the detection query: --sql <sql|@file|-> (or reuse one with --query-mapping-id <id>).');
+  const instantConditions = flags.conditions ? readJsonArg(flags.conditions, '--conditions') : null;
+  if (!queryMappingId && !sqlQuery && !instantConditions) {
+    ui.error('Provide the detection query: --sql <sql|@file|-> (or reuse one with --query-mapping-id <id>),');
+    ui.error('or an instant rule: --conditions \'[{"field":"path","operator":"contains","value":"/.env"}]\' [--match any|all].');
+    ui.info('Or describe it in English: securenow alerts rules from-text "<what to catch>" --app <key>');
     console.log(ui.c.dim('  Scope app keys in SQL with the __USER_APP_KEYS__ placeholder. The column differs by table:'));
     console.log(ui.c.dim("  traces: WHERE `resource_string_service$$name` IN (__USER_APP_KEYS__) AND timestamp >= now64(9) - INTERVAL 15 MINUTE"));
     console.log(ui.c.dim("  logs:   WHERE resources_string['service.name'] IN (__USER_APP_KEYS__) AND timestamp >= toUnixTimestamp64Nano(now64() - INTERVAL 15 MINUTE)"));
@@ -239,12 +245,22 @@ async function alertRuleCreate(args, flags) {
 
   const body = { name };
   if (flags.description) body.description = flags.description;
-  if (queryMappingId) body.queryMappingId = queryMappingId;
+  if (instantConditions) {
+    // An instant rule: checked against every incoming request, no SQL and no schedule.
+    body.executionMode = 'instant';
+    body.instant = {
+      enabled: true,
+      matchMode: flags.match === 'all' ? 'all' : 'any',
+      conditions: Array.isArray(instantConditions) ? instantConditions : [instantConditions],
+    };
+    const env = resolveEnvironment(flags);
+    if (env) body.instant.environments = String(env).split(',').map((e) => e.trim()).filter(Boolean);
+  } else if (queryMappingId) body.queryMappingId = queryMappingId;
   else body.sqlQuery = sqlQuery;
   if (flags.nlp || flags.text) body.nlpQuery = flags.nlp || flags.text;
   if (flags.category) body.category = flags.category;
   if (flags.severity) body.severity = String(flags.severity).toLowerCase();
-  if (flags['execution-mode']) body.executionMode = flags['execution-mode'];
+  if (flags['execution-mode'] && !instantConditions) body.executionMode = flags['execution-mode'];
 
   if (hasAll) {
     body.applicationsAll = true;
@@ -646,6 +662,163 @@ function readSqlArg(flags) {
   return text;
 }
 
+// JSON from a flag value, '@file' or '-' (stdin).
+function readJsonArg(raw, label) {
+  const text = String(raw);
+  const source = text === '-' ? fs.readFileSync(0, 'utf8') : text.startsWith('@') ? fs.readFileSync(text.slice(1), 'utf8') : text;
+  try {
+    return JSON.parse(source);
+  } catch (err) {
+    ui.error(`${label} is not valid JSON: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+// ── English → alert rule ──
+// The API drafts the rule from the app's real data (instant or periodic), checks it against that
+// data, and returns the draft. Nothing is created until you confirm; new rules start in test mode.
+
+async function waitForDraft(draftId, s) {
+  for (let i = 0; i < 90; i++) {
+    await new Promise(r => setTimeout(r, 1500));
+    const result = await api.get(`/alert-rules/draft/${draftId}`);
+    if (result.status !== 'running') return result;
+    if (s && i === 6) s.update('Checking the draft against your data');
+  }
+  return { status: 'failed', error: 'The draft is still running after 2 minutes; try again' };
+}
+
+function draftCell(value) {
+  if (value == null) return '';
+  const text = typeof value === 'object' ? JSON.stringify(value) : String(value);
+  return text.length > 40 ? `${text.slice(0, 37)}…` : text;
+}
+
+function printDraft(result) {
+  const d = result.draft || {};
+  const check = result.check || {};
+  const kindLabel = d.kind === 'instant' ? ui.c.cyan('Instant rule') : ui.c.cyan('Periodic rule');
+  console.log('');
+  console.log(`  ${kindLabel} ${ui.c.dim('·')} ${d.severity || 'medium'} ${ui.c.dim('·')} ${d.category || 'custom'}`);
+  console.log(`  ${ui.c.bold(d.name || '')}`);
+  if (d.summary) console.log(`  ${d.summary}`);
+  if (d.whyThisKind) console.log(ui.c.dim(`  Why ${d.kind}: ${d.whyThisKind}`));
+  console.log('');
+  if (d.kind === 'instant') {
+    const conditions = d.instant?.conditions || [];
+    const envs = d.instant?.environments || [];
+    console.log(`  Watches   every request, as it arrives${envs.length ? `, in ${envs.join(', ')}` : ', in every environment'}`);
+    console.log(`  When      ${d.instant?.matchMode === 'all' ? 'all of' : 'any of'}`);
+    for (const c of conditions) console.log(`            ${c.field} ${ui.c.dim(c.operator)} ${c.value}`);
+  } else {
+    const parts = [d.schedule?.description || d.schedule?.cronExpression];
+    if (d.windowMinutes) parts.push(`window ${d.windowMinutes} min`);
+    if (d.threshold) parts.push(d.threshold);
+    console.log(`  Schedule  ${parts.filter(Boolean).join(ui.c.dim(' · '))}`);
+    console.log('  SQL');
+    for (const line of String(d.sqlQuery || '').split('\n')) console.log(ui.c.dim(`    ${line}`));
+  }
+  console.log('');
+  console.log(`  Check     ${check.note || ''}`);
+  const rows = check.rows || [];
+  if (rows.length) {
+    const cols = Object.keys(rows[0]).slice(0, 6);
+    console.log('');
+    ui.table(cols, rows.slice(0, 8).map((row) => cols.map((c) => draftCell(row[c]))));
+  }
+  for (const w of check.warnings || []) ui.warn(w);
+}
+
+function draftToCreateBody(result, flags) {
+  const d = result.draft || {};
+  const body = {
+    name: flags.name ? String(flags.name) : d.name,
+    description: d.summary || '',
+    nlpQuery: d.nlpQuery,
+    category: d.category,
+    severity: flags.severity ? String(flags.severity).toLowerCase() : d.severity,
+    applicationsAll: false,
+    applications: [result.applicationKey],
+    executionMode: d.executionMode,
+  };
+  if (d.executionMode === 'instant') body.instant = d.instant;
+  else {
+    body.sqlQuery = d.sqlQuery;
+    body.schedule = d.schedule;
+  }
+  if (flags['no-throttle']) body.throttle = { enabled: false, minutes: 0 };
+  else if (flags['throttle-minutes']) body.throttle = { enabled: true, minutes: Number(flags['throttle-minutes']) };
+  return body;
+}
+
+async function alertRuleFromText(args, flags) {
+  requireAuth();
+  const text = (args.join(' ').trim() || (typeof flags.text === 'string' ? flags.text : '')).trim();
+  const appKey = resolveApp(flags);
+  if (!text || !appKey) {
+    ui.error('Usage: securenow alerts rules from-text "<what the rule should catch>" --app <key> [--env <environment>]');
+    console.log(ui.c.dim('  [--instant | --periodic] [--name "..."] [--severity high] [--yes] [--draft-only] [--json]'));
+    console.log(ui.c.dim('  Example: securenow alerts rules from-text "one IP failing 10 sign-ins in 5 minutes" --app <key>'));
+    process.exit(1);
+  }
+
+  const body = { text, applicationKey: appKey };
+  const environment = resolveEnvironment(flags);
+  if (environment) body.environment = environment;
+  if (flags.instant || flags.kind === 'instant') body.kind = 'instant';
+  else if (flags.periodic || flags.kind === 'periodic') body.kind = 'periodic';
+
+  const s = ui.spinner('Drafting the rule from your app\'s data');
+  let result;
+  try {
+    const started = await api.post('/alert-rules/draft', body);
+    result = await waitForDraft(started.draftId, s);
+  } catch (err) {
+    s.fail('Failed to draft the rule');
+    throw err;
+  }
+  if (result.status !== 'complete') {
+    s.fail(result.error || 'Could not draft the rule');
+    process.exit(1);
+  }
+  s.stop('Draft ready');
+
+  if (flags.json && (flags['draft-only'] || !flags.yes)) { ui.json(result); return; }
+  printDraft(result);
+  console.log('');
+  if (flags['draft-only']) {
+    ui.info('Draft only: nothing was created. Drop --draft-only to create it.');
+    return;
+  }
+  if (!flags.yes) {
+    const ok = await ui.confirm('Create this rule? It starts in test mode: it alerts, but blocks nothing');
+    if (!ok) { ui.info('Nothing created'); return; }
+  }
+
+  const c = ui.spinner('Creating the rule');
+  let data;
+  try {
+    data = await api.post('/alert-rules', draftToCreateBody(result, flags));
+  } catch (err) {
+    c.fail('Failed to create the rule');
+    throw err;
+  }
+  const r = data.alertRule || data;
+  const id = r._id || r.id || '';
+  c.stop('Rule created');
+  if (flags.json) { ui.json({ draft: result.draft, check: result.check, alertRule: r }); return; }
+  console.log('');
+  ui.keyValue([
+    ['ID', id || '-'],
+    ['Name', r.name || '-'],
+    ['Kind', r.executionMode === 'instant' ? 'instant (every request, as it arrives)' : `periodic (${r.schedule?.description || r.schedule?.cronExpression || '-'})`],
+    ['Mode', `${r.mode || 'test'} (alerts only, no blocking)`],
+    ['Application', (r.applications || []).join(', ') || '-'],
+  ]);
+  console.log('');
+  ui.success(`Watching. Promote it when it has proved itself: securenow alerts rules promote ${id}`);
+}
+
 async function alertRuleTest(args, flags) {
   requireAuth();
   const id = args[0];

package/cli.js

@@ -240,7 +240,7 @@ const COMMANDS = {
     desc: 'Manage notifications',
     usage: 'securenow notifications <subcommand> [options]',
     sub: {
-      list: { desc: 'List notifications', flags: { limit: 'Max results', page: 'Page number' }, run: (a, f) => require('./cli/monitor').notificationsList(a, f) },
+      list: { desc: 'List notifications', flags: { limit: 'Max results', page: 'Page number', search: 'Only notifications whose title, description or IP contains this text (e.g. a rule name)', severity: 'critical | high | medium | low' }, run: (a, f) => require('./cli/monitor').notificationsList(a, f) },
       read: { desc: 'Mark notification as read', usage: 'securenow notifications read <id>', run: (a, f) => require('./cli/monitor').notificationsRead(a, f) },
       'read-all': { desc: 'Mark all as read', run: () => require('./cli/monitor').notificationsReadAll() },
       unread: { desc: 'Show unread count', run: () => require('./cli/monitor').notificationsUnread() },
@@ -311,11 +311,18 @@ const COMMANDS = {
     usage: 'securenow alerts <subcommand> [options]',
     sub: {
       rules: {
-        desc: 'Create, list, show, update, duplicate, promote/demote, set-sql, validate, delete, test, or tune alert rules',
-        usage: 'securenow alerts rules <list|create|show|update|duplicate|promote|demote|set-sql|validate|delete|test|dry-run-query|tune-query|exclusions> [options]',
+        desc: 'Create (from English or SQL), list, show, update, duplicate, promote/demote, set-sql, validate, delete, test, or tune alert rules',
+        usage: 'securenow alerts rules <list|from-text|create|show|update|duplicate|promote|demote|set-sql|validate|delete|test|dry-run-query|tune-query|exclusions|versions|version|rollback> [options]\n'
+          + '  securenow alerts rules from-text "<what to catch, in English>" --app <key> [--env <environment>] [--instant|--periodic] [--yes|--draft-only]',
         flags: {
           json: 'Output as JSON',
-          name: 'With create: rule name',
+          env: 'With from-text or create --conditions: only watch this environment (default: every environment)',
+          instant: 'With from-text: ask for an instant rule (every request, as it arrives)',
+          periodic: 'With from-text: ask for a periodic rule (SQL on a schedule)',
+          'draft-only': 'With from-text: show the checked draft, create nothing',
+          conditions: 'With create: instant-rule conditions as JSON, @file or - ([{"field":"path","operator":"contains","value":"/.env"}])',
+          match: 'With create --conditions: any (default) | all',
+          name: 'With create/from-text: rule name',
           description: 'With create: rule description',
           nlp: 'With create: plain-English intent stored on the query',
           text: 'Alias for --nlp',

package/mcp/catalog.js

@@ -1378,6 +1378,70 @@ const TOOLS = [
       ...confirmSchema,
     }, ['text', 'confirm', 'reason']),
   },
+  {
+    name: 'securenow_alert_rule_draft',
+    title: 'Draft an Alert Rule From English',
+    description: 'Turn a detection idea in plain English into an alert rule draft for one app, checked against that app\'s data. It reads the app\'s real event types, attribute keys and routes, then picks the kind: instant (conditions checked on every incoming request, alerts within seconds; one request is enough evidence) or periodic (SQL run on a schedule: counts, thresholds, distinct counts, ratios, sequences, baselines, security events, app log lines). Periodic SQL is run once against the data; instant conditions are replayed over the app\'s last 2000 requests, so check.matches shows what would alert today (false positives). Nothing is saved: create it with securenow_alert_rule_create, passing the draft fields. Waits up to 120 seconds.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules/draft',
+    bodyFields: ['text', 'applicationKey', 'environment', 'kind'],
+    poll: {
+      tool: 'securenow_alert_rule_draft_status',
+      idField: 'draftId',
+      pending: ['running'],
+      timeoutMs: 120000,
+      intervalMs: 2000,
+    },
+    inputSchema: objectSchema({
+      text: string('What the rule should catch, in plain English, e.g. "one IP failing 10 sign-ins in 5 minutes" or "anyone requesting /.env or /.git".'),
+      applicationKey: string('App key the rule watches; the draft is checked against its data.'),
+      environment: string('Only watch this environment (e.g. production). Omit to watch every environment.'),
+      kind: string('Optional: instant or periodic. Omit to let the drafter choose.'),
+      ...confirmSchema,
+    }, ['text', 'applicationKey', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_draft_status',
+    title: 'Alert Rule Draft Result',
+    description: 'Get an alert rule draft started by securenow_alert_rule_draft: status (running, complete or failed), then the draft (kind, name, summary, SQL and schedule, or instant conditions) and the check against the app\'s data.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/draft/:draftId',
+    pathParams: ['draftId'],
+    inputSchema: objectSchema({
+      draftId: string('Draft id from securenow_alert_rule_draft.'),
+    }, ['draftId']),
+  },
+  {
+    name: 'securenow_alert_rule_create',
+    title: 'Create Alert Rule (Test Mode)',
+    description: 'Create an alert rule. It always starts in test mode: it alerts, but nothing blocks, rate-limits or acts on its alerts until a person promotes it. Instant rule: executionMode "instant" plus instant {matchMode: any|all, conditions: [{field: path|method|user_agent|status_code|request_body|request_headers|client_ip|host, operator, value}]}. Periodic rule: sqlQuery plus schedule {cronExpression}; the SQL must scope every table with the __USER_APP_KEYS__ placeholder, bound time on every table read, and return a column named ip (rows without an ip never alert). Easiest path: securenow_alert_rule_draft, then pass its draft fields here. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules',
+    bodyFields: ['name', 'description', 'nlpQuery', 'category', 'severity', 'applications', 'applicationsAll', 'executionMode', 'sqlQuery', 'schedule', 'instant', 'throttle'],
+    inputSchema: objectSchema({
+      name: string('Rule name.'),
+      description: string('What it catches, in a sentence.'),
+      nlpQuery: string('The detection idea in plain English (kept with the rule).'),
+      category: string('One word, e.g. authentication, scanning, exfiltration.'),
+      severity: string('low, medium, high or critical.'),
+      applications: { type: 'array', items: { type: 'string' }, description: 'App keys the rule watches.' },
+      applicationsAll: boolean('true watches every app instead of applications.'),
+      executionMode: string('scheduled (periodic SQL, the default) or instant (conditions on every request).'),
+      sqlQuery: string('Periodic rules: the detection SELECT.'),
+      schedule: { type: 'object', additionalProperties: true, description: 'Periodic rules: {cronExpression: "* * * * *", description: "Every minute"}. Default every 15 minutes.' },
+      instant: { type: 'object', additionalProperties: true, description: 'Instant rules: {matchMode: "any" | "all", conditions: [{field, operator, value}], environments: ["staging"] (optional; omit to watch every environment)}.' },
+      throttle: { type: 'object', additionalProperties: true, description: 'Optional {enabled: true, minutes: 15}: one alert per rule per window.' },
+      ...confirmSchema,
+    }, ['name', 'confirm', 'reason']),
+  },
   {
     name: 'securenow_alert_rules_list',
     title: 'List Alert Rules',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.15.0",
+  "version": "8.16.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",