securenow 8.7.0 → 8.8.0

package/cli/security.js

@@ -51,6 +51,9 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'delete' || sub === 'rm' || sub === 'remove') {
     return alertRuleDelete(args.slice(1), flags);
   }
+  if (sub === 'duplicate' || sub === 'clone') {
+    return alertRuleDuplicate(args.slice(1), flags);
+  }
   if (sub === 'test') {
     return alertRuleTest(args.slice(1), flags);
   }
@@ -111,6 +114,52 @@ async function alertRuleSetMode(args, flags, mode) {
   else ui.info('Detect-only — no mitigation will act. Promote when confident: securenow alerts rules promote <id>');
 }
 
+// Duplicate any rule (including a read-only system template) into a new CUSTOM rule you
+// own. System rules are view-only examples — fork one with this to enable / edit it. The
+// copy defaults to Disabled (opt in with --enable / --status active); SQL, instant.block,
+// schedule, scope, and mode are copied from the source.
+async function alertRuleDuplicate(args, flags) {
+  requireAuth();
+  const id = args[0];
+  if (!id) {
+    ui.error('Usage: securenow alerts rules duplicate <rule-id> [--enable] [--status active|disabled|paused] [--name "..."] [--mode test|prod]');
+    process.exit(1);
+  }
+  const body = {};
+  if (flags.enable) body.status = 'Active';
+  else if (flags.disable) body.status = 'Disabled';
+  else if (flags.pause) body.status = 'Paused';
+  else if (flags.status) {
+    const s = String(flags.status).toLowerCase();
+    body.status = s === 'active' ? 'Active' : s === 'paused' ? 'Paused' : 'Disabled';
+  }
+  if (flags.name) body.name = String(flags.name);
+  if (flags.mode === 'test' || flags.mode === 'prod') body.mode = flags.mode;
+
+  const spin = ui.spinner(`Duplicating ${ui.truncate(id, 12)}`);
+  let data;
+  try {
+    data = await api.post(`/alert-rules/${id}/duplicate`, body);
+    spin.stop('Duplicated');
+  } catch (err) {
+    spin.fail(`Failed to duplicate: ${err.message}`);
+    process.exit(1);
+  }
+
+  if (flags.json) { ui.json(data); return; }
+  const r = data.alertRule || {};
+  const newId = r.id || r._id || '';
+  console.log('');
+  ui.success(`Created custom rule ${newId}`);
+  console.log(`  Name        ${r.name || ''}`);
+  console.log(`  Status      ${r.status || ''}`);
+  console.log(`  Mode        ${r.mode || ''}`);
+  console.log(`  Exec mode   ${r.executionMode || ''}`);
+  console.log(`  Custom      ${r.isSystem ? 'NO — still a system rule (unexpected)' : 'yes (editable / enable-able)'}`);
+  if (data.duplicatedFromSystem) ui.info('Forked from a read-only system template — edit or enable this custom copy freely.');
+  if (r.status !== 'Active') ui.info(`Disabled by default. Enable with: securenow alerts rules update ${newId} --enable`);
+}
+
 async function alertRulesList(args, flags) {
   requireAuth();
   // Server-side filters (API supports ?mode/status/active/isSystem).