securenow 8.22.0 → 8.23.0

package/SKILL-CLI.md

@@ -208,10 +208,28 @@ Auto-detects framework (Next.js, Nuxt, Express, Fastify, Koa, Hapi, Node) from `
 ### Dashboard & Status
 
 ```bash
+securenow today [--since 24h|7d] [--attackers 20] [--json]  # the Overview: what happened, what SecureNow did, what needs you
+securenow attacker <ip> [--json]             # why an address was flagged: verdict, signals, traffic vs normal, detections, timeline
 securenow status [--app <key>] [--env local|production|all] # dashboard overview
 securenow analytics [--app <key>]            # response analytics
 ```
 
+`today` is the dashboard's home in the terminal:
+- whether each app is covered (data flowing, firewall on, detection monitoring or blocking);
+- attack requests, attackers, what the firewall stopped and what got through;
+- the decisions waiting for you, the top attackers, and what SecureNow did (the agent's actions, automatic blocks,
+  closed probes).
+
+`attacker <ip>` explains one address:
+- the verdict and score with the signals behind them, and its reputation;
+- where it is blocked;
+- its last 3 days of traffic against your apps' normal (error rate, share of traffic, scanner probes, attack
+  payloads answered 2xx);
+- the detections it triggered and what happened to each, a timeline, and questions to paste into
+  `securenow forensics chat`.
+
+MCP: `securenow_overview` and `securenow_attacker` (read).
+
 ---
 
 ### Traces

package/cli/today.js

@@ -0,0 +1,176 @@
+'use strict';
+
+// The dashboard's one view in the terminal (GET /overview): is every app covered, what happened, what needs you,
+// the top attackers and what SecureNow did. `securenow attacker <ip>` explains one address
+// (GET /overview/attackers/:ip). The same words as the dashboard.
+const { api, requireAuth } = require('./client');
+const ui = require('./ui');
+
+const OUTCOMES = {
+  stopped: 'Stopped',
+  not_a_threat: 'Not a threat',
+  no_action: 'No action needed',
+  needs_you: 'Needs you',
+  being_checked: 'Being checked',
+  watching: 'Watching',
+};
+const LEVELS = { malicious: 'Malicious', blocked: 'Known attacker', suspicious: 'Suspicious', low: 'Low risk', unknown: 'Not scored', benign: 'Looks benign', insufficient_data: 'Not enough data', never_block: 'Never blocked' };
+const MODES = { blocking: 'Blocking', monitoring: 'Monitoring', off: 'Off' };
+
+function count(n) {
+  if (n === null || n === undefined) return '—';
+  return Number(n).toLocaleString('en-US');
+}
+
+function when(value) {
+  if (!value) return '';
+  const date = new Date(value);
+  const sameDay = date.toDateString() === new Date().toDateString();
+  return sameDay
+    ? date.toLocaleTimeString('en-GB', { hour: '2-digit', minute: '2-digit' })
+    : date.toLocaleString('en-GB', { month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit' });
+}
+
+function level(item) {
+  const label = LEVELS[item.level] || item.level || '';
+  const text = item.score !== null && item.score !== undefined ? `${label} ${Math.round(item.score)}` : label;
+  return item.level === 'malicious' || item.level === 'blocked' ? ui.c.red(text) : item.level === 'suspicious' ? ui.c.yellow(text) : ui.c.dim(text);
+}
+
+function hoursFrom(flags) {
+  const since = String(flags.since || '24h');
+  const match = since.match(/^(\d+)\s*([hd])$/i);
+  if (!match) return 24;
+  const hours = Number(match[1]) * (match[2].toLowerCase() === 'd' ? 24 : 1);
+  return Math.min(168, Math.max(1, hours));
+}
+
+async function today(args, flags) {
+  requireAuth();
+  const hours = hoursFrom(flags);
+  const s = ui.spinner('Reading what happened');
+  let data;
+  try {
+    data = await api.get('/overview', { query: { hours, attackers: flags.attackers || 8 } });
+    s.stop('SecureNow');
+  } catch (err) {
+    s.fail('Could not read the overview');
+    throw err;
+  }
+  if (flags.json) { ui.json(data); return; }
+
+  const totals = data.totals || {};
+  console.log('');
+  console.log(`  ${ui.c.bold(data.headline || '')}  ${ui.c.dim(data.agent?.label || '')}`);
+  console.log(`  ${ui.c.dim(`Last ${hours >= 48 ? `${Math.round(hours / 24)} days` : `${hours} hours`}:`)} ${count(totals.attackRequests)} attack requests · ${count(totals.attackers)} attackers · ${ui.c.green(`${count(totals.stopped)} stopped`)} · got through: ${totals.gotThrough === null || totals.gotThrough === undefined ? '—' : count(totals.gotThrough)}`);
+
+  console.log('');
+  const cards = data.needsYou || [];
+  console.log(`  ${ui.c.bold(`Needs you (${data.needsYouTotal || 0})`)}`);
+  if (cards.length === 0) console.log(`    ${ui.c.green('Nothing needs you.')} ${ui.c.dim(`SecureNow handled ${count(totals.handled)} things.`)}`);
+  for (const card of cards) {
+    console.log(`    ${ui.c.yellow('!')} ${card.title}`);
+    if (card.detail) console.log(`      ${ui.c.dim(card.detail)}`);
+  }
+
+  const attackers = data.attackers || [];
+  if (attackers.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Top attackers')}`);
+    for (const item of attackers) {
+      const status = item.blockedUntil ? (item.blockedUntil === 'permanent' ? 'Blocked' : `Blocked until ${when(item.blockedUntil)}`) : OUTCOMES[item.outcome] || '';
+      console.log(`    ${item.ip.padEnd(16)} ${level(item)}  ${ui.c.dim([item.what, (item.apps || []).map((app) => app.name).join(', '), `${count(item.requests)} req`].filter(Boolean).join(' · '))}  ${status}`);
+    }
+    console.log(`    ${ui.c.dim('Why an address was flagged: securenow attacker <ip>')}`);
+  }
+
+  const activity = (data.activity || []).slice(0, 8);
+  if (activity.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('What SecureNow did')}`);
+    for (const item of activity) {
+      console.log(`    ${ui.c.dim(when(item.at).padEnd(13))} ${item.text}${item.by === 'agent' ? ui.c.dim(' (agent)') : ''}`);
+      if (item.note) console.log(`    ${' '.repeat(13)} ${ui.c.yellow(item.note)}`);
+    }
+  }
+
+  const apps = (data.apps || []).filter((app) => app.state === 'protected' || app.state === 'attention');
+  if (apps.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Apps')}`);
+    for (const app of apps) {
+      const dot = app.state === 'attention' ? ui.c.yellow('●') : ui.c.green('●');
+      const issues = (app.issues || []).map((issue) => issue.text).join('; ');
+      console.log(`    ${dot} ${String(app.name).padEnd(30)} ${(MODES[app.mode] || app.mode).padEnd(11)} ${issues ? ui.c.yellow(issues) : ui.c.dim(`${count(app.stopped)} stopped`)}`);
+    }
+  }
+  console.log('');
+}
+
+async function attacker(args, flags) {
+  requireAuth();
+  const ip = String(args[0] || flags.ip || '').trim();
+  if (!ip) {
+    ui.error('Usage: securenow attacker <ip> [--json]');
+    process.exit(1);
+  }
+  const s = ui.spinner(`Reading ${ip}`);
+  let data;
+  try {
+    data = await api.get(`/overview/attackers/${encodeURIComponent(ip)}`);
+    s.stop(ip);
+  } catch (err) {
+    s.fail('Could not read this address');
+    throw err;
+  }
+  if (flags.json) { ui.json(data); return; }
+
+  const { verdict, reputation, state, summary } = data;
+  console.log('');
+  console.log(`  ${ui.c.bold(ip)}  ${level({ level: verdict.level, score: verdict.score })}  ${ui.c.dim([reputation?.country, reputation?.isp, reputation?.usageType].filter(Boolean).join(' · '))}`);
+  const blocked = state.blocked
+    ? ui.c.green(`Blocked ${state.blocks.map((block) => `on ${block.app?.name || 'every app'}${block.until ? ` until ${when(block.until)}` : ''}`).join(', ')}`)
+    : state.neverBlock ? 'Never blocked (trusted)' : 'Not blocked';
+  console.log(`  ${blocked}`);
+  console.log(`  ${ui.c.dim(`First seen ${when(summary.firstSeen) || '—'} · last seen ${when(summary.lastSeen) || '—'} · ${count(summary.alerts)} detection(s) · ${count(summary.stopped)} stopped by the firewall in 7 days`)}`);
+  if (summary.categories?.length) console.log(`  Tried: ${summary.categories.join(', ')}`);
+
+  console.log('');
+  console.log(`  ${ui.c.bold('Why')}${verdict.analyzedAt ? ui.c.dim(` (analyzed ${when(verdict.analyzedAt)})`) : ''}`);
+  const signals = [...(verdict.signals?.malicious || []).map((line) => ui.c.red(`+ ${line}`)), ...(verdict.signals?.benign || []).map((line) => ui.c.green(`- ${line}`))];
+  if (signals.length) for (const line of signals) console.log(`    ${line}`);
+  else console.log(`    ${ui.c.dim(`No analysis yet: securenow agent verify ${ip}`)}`);
+
+  if (data.traffic) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Traffic, last 3 days')}  ${count(data.traffic.requests)} requests on ${data.traffic.activeDays} day(s)`);
+    for (const signal of data.traffic.signals) {
+      const value = signal.format === 'percent' ? (signal.value === null ? '—' : `${Math.round(signal.value * 1000) / 10}%`) : count(signal.value);
+      const normal = signal.normal !== null && signal.normal !== undefined ? ui.c.dim(` (normal ${Math.round(signal.normal * 1000) / 10}%)`) : '';
+      console.log(`    ${signal.label.padEnd(30)} ${signal.unusual ? ui.c.red(value) : value}${normal}${signal.unusual ? ui.c.red('  unusual') : ''}`);
+    }
+  }
+
+  if (data.alerts?.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Detections')}`);
+    for (const alert of data.alerts.slice(0, 10)) {
+      console.log(`    ${ui.c.dim(when(alert.at).padEnd(13))} ${alert.title}  ${ui.c.dim([alert.app?.name, `${count(alert.requests)} req`].filter(Boolean).join(' · '))}  ${OUTCOMES[alert.outcome] || alert.status}`);
+    }
+  }
+
+  if (data.timeline?.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Timeline')}`);
+    for (const event of data.timeline.slice(0, 12)) console.log(`    ${ui.c.dim(when(event.at).padEnd(13))} ${event.text}`);
+  }
+
+  if (data.questions?.length) {
+    console.log('');
+    console.log(`  ${ui.c.bold('Ask the forensics chat')}`);
+    for (const question of data.questions) console.log(`    ${ui.c.dim('securenow forensics chat')} "${question}"`);
+  }
+  console.log('');
+}
+
+module.exports = { today, attacker };

package/cli.js

@@ -457,6 +457,18 @@ const COMMANDS = {
     },
     defaultSub: 'status',
   },
+  today: {
+    desc: 'What happened, what SecureNow did and what needs you (the dashboard Overview)',
+    usage: 'securenow today [--since 24h|7d] [--attackers <n>] [--json]',
+    flags: { since: 'Look-back window, 1h to 7d (default 24h)', attackers: 'How many top attackers to list (default 8)', json: 'Output as JSON' },
+    run: (a, f) => require('./cli/today').today(a, f),
+  },
+  attacker: {
+    desc: 'Why SecureNow flagged an address: verdict, signals, traffic, detections, timeline, questions to ask',
+    usage: 'securenow attacker <ip> [--json]',
+    flags: { json: 'Output as JSON' },
+    run: (a, f) => require('./cli/today').attacker(a, f),
+  },
   protect: {
     desc: 'Starter protection per app: the rules every app gets, monitor or block mode',
     usage: 'securenow protect <status|enable|disable|block|monitor|learn> [--app <key>] [--json]',
@@ -911,7 +923,7 @@ function showHelp(commandName) {
     'Authentication': ['login', 'logout', 'whoami', 'credentials', 'admin', 'api-key'],
     'Applications': ['apps', 'app', 'init', 'status'],
     'Observe': ['traces', 'logs', 'analytics'],
-    'Detect & Respond': ['protect', 'agent', 'human', 'review', 'notifications', 'alerts', 'fp'],
+    'Detect & Respond': ['today', 'attacker', 'protect', 'agent', 'human', 'review', 'notifications', 'alerts', 'fp'],
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],

package/mcp/catalog.js

@@ -1315,6 +1315,34 @@ const TOOLS = [
       app: string('Optional application key; every app the caller can see when left out.'),
     }),
   },
+  {
+    name: 'securenow_overview',
+    title: 'Overview: What Happened and What Needs You',
+    description: 'The dashboard Overview for the last hours (default 24, at most 168, or since an ISO time). Whether each app is covered (data flowing, firewall on, detection monitoring or blocking, with what is missing); attack requests, attackers, requests the firewall stopped, and attacks that got through (whose impact check found possible or confirmed impact; null when none was checked), with attacks per hour; the decisions waiting for a person (block recommendations, coverage problems, apps ready to block, detection promotions); the top attackers (verdict, score, what they tried, apps, requests, whether blocked); and what SecureNow did (the agent\'s actions, automatic blocks, failed probes and rule-fix closes, learned exclusions).',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/overview',
+    queryFields: ['hours', 'since', 'attackers'],
+    inputSchema: objectSchema({
+      hours: number('Look-back window in hours (default 24).', { minimum: 1, maximum: 168 }),
+      since: string('Start of the window as an ISO time, at most 7 days ago; used instead of hours.'),
+      attackers: number('How many top attackers to list (default 8).', { minimum: 1, maximum: 200 }),
+    }),
+  },
+  {
+    name: 'securenow_attacker',
+    title: 'Attacker: Why an Address Was Flagged',
+    description: 'One address across the caller\'s apps: the verdict and risk score with the signals behind them (from the latest verification), reputation, whether it is blocked (where and until when) or never blocked, first and last seen, what it tried, the detections it triggered in 30 days with their outcomes, its block history, a timeline of its events, its traffic over the last 3 days against the apps\' normal (error rate, share of traffic, distinct paths, scanner-path requests, attack payloads answered 2xx), and suggested questions for the forensics chat.',
+    scope: 'notifications:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/overview/attackers/:ip',
+    pathParams: ['ip'],
+    inputSchema: objectSchema({
+      ip: string('IPv4 or IPv6 address.'),
+    }, ['ip']),
+  },
   {
     name: 'securenow_protection_enable',
     title: 'Turn Starter Protection On',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.22.0",
+  "version": "8.23.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",