souleyez 2.28.0__py3-none-any.whl → 2.39.0__py3-none-any.whl

souleyez/ui/interactive.py

@@ -5356,12 +5356,43 @@ def view_job_detail(job_id: int):
             # Check if exploitation was detected
             if job.get('exploitation_detected'):
                 session_info = job.get('session_info', 'Session opened')
-                click.echo(f"Status:  {click.style('🎯 EXPLOITED', fg='green', bold=True)} - {session_info}{elapsed_str}")
+                click.echo(f"Status:  {click.style('EXPLOITED', fg='green', bold=True)} - {session_info}{elapsed_str}")
             else:
                 click.echo(f"Status:  {click.style('▶ ' + status, fg=status_color, bold=True)}{elapsed_str}")
         else:
             click.echo(f"Status:  {click.style(status, fg=status_color)}{elapsed_str}")
 
+        # Check for connection issues in running jobs
+        connection_warning = None
+        log_path = job.get('log')
+        if status == 'running' and log_path and os.path.exists(log_path):
+            try:
+                with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
+                    # Read last 5KB of log to check for recent connection issues
+                    f.seek(0, 2)  # Seek to end
+                    file_size = f.tell()
+                    read_size = min(5000, file_size)
+                    f.seek(max(0, file_size - read_size))
+                    recent_log = f.read().lower()
+
+                # Count connection failure patterns
+                connection_patterns = [
+                    'unable to connect',
+                    'connection refused',
+                    'connection timed out',
+                    'going to retry',
+                    'target url content is not stable',
+                    'considerable lagging has been detected',
+                ]
+                failure_count = sum(recent_log.count(pattern) for pattern in connection_patterns)
+
+                if failure_count >= 5:
+                    connection_warning = f"Connection issues detected ({failure_count} failures) - target may be overloaded"
+                elif failure_count >= 2:
+                    connection_warning = f"Some connection issues detected ({failure_count} retries)"
+            except Exception:
+                pass
+
         # Human-readable status summary
         status_summaries = {
             'done': 'Scan completed successfully with findings',
@@ -5377,6 +5408,11 @@ def view_job_detail(job_id: int):
             summary_color = 'yellow' if status in ['warning', 'error', 'killed'] else 'bright_black'
             click.echo(f"         {click.style(summary, fg=summary_color)}")
 
+        # Show connection warning if detected
+        if connection_warning:
+            click.echo(f"         {click.style('WARNING: ' + connection_warning, fg='yellow', bold=True)}")
+            click.echo(f"         {click.style('Consider: Kill job [k] and retry with fewer threads or --time-sec=10', fg='yellow', dim=True)}")
+
         click.echo(f"Created: {job.get('created_at', 'N/A')}")
 
         if job.get('args'):
@@ -5388,10 +5424,14 @@ def view_job_detail(job_id: int):
         # Show reason (how the job was created)
         metadata = job.get('metadata', {})
         reason = metadata.get('reason', '')
-        if reason:
+        parent_id = job.get('parent_id')
+        if reason and parent_id:
+            # Show both reason and parent job reference
+            click.echo(f"Reason:  {reason} (from job #{parent_id})")
+        elif reason:
             click.echo(f"Reason:  {reason}")
-        elif job.get('parent_id'):
-            click.echo(f"Reason:  Auto-chained from job #{job.get('parent_id')}")
+        elif parent_id:
+            click.echo(f"Reason:  Auto-chained from job #{parent_id}")
         else:
             click.echo(f"Reason:  Manual (created by user)")
 
@@ -5593,7 +5633,7 @@ def view_job_detail(job_id: int):
                 pass
     
         # Parse and display SQLMap results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'sqlmap' and job.get('status') == 'done' and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'sqlmap' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
                     log_content = f.read()
@@ -5602,11 +5642,17 @@ def view_job_detail(job_id: int):
                 parsed = parse_sqlmap_output(log_content, job.get('target', ''))
                 stats = get_sqli_stats(parsed)
             
+                # Always show summary header
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo(click.style("SQL INJECTION SCAN", bold=True, fg='cyan'))
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
+
+                click.echo(click.style(f"Target: {job.get('target', 'unknown')}", bold=True))
+
                 # Show summary if anything was found
                 if stats['total_vulns'] > 0 or stats['databases_found'] > 0:
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo(click.style("SQLMAP RESULTS SUMMARY", bold=True, fg='cyan'))
-                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo(click.style(f"Result: {stats['total_vulns']} vulnerability(ies) found", fg='red', bold=True))
                     click.echo()
 
                     # Injection details with techniques and payloads
@@ -5737,15 +5783,15 @@ def view_job_detail(job_id: int):
                     if engagement_id and stats['total_vulns'] > 0:
                         fm = FindingsManager()
                         all_findings = fm.list_findings(engagement_id)
-                    
+
                         # Check if findings from this job already exist
                         target = job.get('target', '')
                         job_id = job.get('id')
-                    
+
                         # Look for findings with matching tool and target URL
-                        existing_findings = [f for f in all_findings 
+                        existing_findings = [f for f in all_findings
                                            if f.get('tool') == 'sqlmap' and target in f.get('path', '')]
-                    
+
                         if existing_findings:
                             click.echo(click.style(f"✓ Findings already saved ({len(existing_findings)} findings from this scan)", fg='green'))
                         else:
@@ -5755,14 +5801,30 @@ def view_job_detail(job_id: int):
                                     _save_sqlmap_findings(engagement_id, job, parsed)
                                 else:
                                     click.echo(click.style("⚠ No engagement set - findings not saved", fg='yellow'))
-                
+                else:
+                    # No vulnerabilities found - show friendly message
+                    click.echo(click.style("Result: No SQL injection vulnerabilities found", fg='yellow'))
+                    click.echo()
+                    click.echo(f"URLs tested: {stats.get('urls_tested', 0)}")
+                    click.echo()
+                    click.echo("The target was tested but no injectable parameters were found.")
+                    click.echo()
+                    click.echo(click.style("Tips:", fg='bright_black'))
+                    click.echo(click.style("  - Try increasing --level and --risk for deeper testing", fg='bright_black'))
+                    click.echo(click.style("  - Test with authenticated session cookies", fg='bright_black'))
+                    click.echo(click.style("  - Try different injection techniques (--technique=BEUST)", fg='bright_black'))
+                    click.echo()
+
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
+
             except Exception as e:
                 click.echo(click.style(f"Error parsing SQLMap results: {e}", fg='yellow'))
                 import traceback
                 traceback.print_exc()
 
         # Parse and display WPScan results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'wpscan' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'wpscan' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
                     log_content = f.read()
@@ -5927,12 +5989,35 @@ def view_job_detail(job_id: int):
                             click.echo(f"  ... and {len(users) - 10} more users")
                         click.echo()
 
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo()
+                else:
+                    # No results - show friendly message
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo(click.style("WPSCAN WORDPRESS SECURITY SCAN", bold=True, fg='cyan'))
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo()
+
+                    click.echo(click.style(f"Target: {job.get('target', 'unknown')}", bold=True))
+                    click.echo()
+                    click.echo(click.style("Result: No WordPress detected or no issues found", fg='green', bold=True))
+                    click.echo()
+                    click.echo("  The scan did not find WordPress or any security issues.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Verify the target is a WordPress site")
+                    click.echo("  • Try enumeration: --enumerate ap,at,u")
+                    click.echo("  • Check API token for vuln database access")
+                    click.echo()
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo()
+
             except Exception as e:
                 # Silently fail - not critical
                 pass
 
         # Parse and display DNSRecon results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'dnsrecon' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'dnsrecon' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.dnsrecon_parser import parse_dnsrecon_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -5945,50 +6030,69 @@ def view_job_detail(job_id: int):
                 click.echo(click.style("=" * 70, fg='cyan'))
                 click.echo()
 
-                # Hosts (A records)
-                hosts = parsed.get('hosts', [])
-                if hosts:
-                    click.echo(click.style(f"Hosts (A Records): {len(hosts)}", bold=True))
-                    for host in hosts:
-                        click.echo(f"  • {host['hostname']} → {host['ip']}")
-                    click.echo()
+                click.echo(click.style(f"Target: {job.get('target', 'unknown')}", bold=True))
+                click.echo()
 
-                # Nameservers
+                # Collect all results
+                hosts = parsed.get('hosts', [])
                 ns = parsed.get('nameservers', [])
-                if ns:
-                    click.echo(click.style(f"Nameservers (NS): {len(ns)}", bold=True))
-                    for server in ns:
-                        click.echo(f"  • {server}")
-                    click.echo()
-
-                # Mail servers
                 mx = parsed.get('mail_servers', [])
-                if mx:
-                    click.echo(click.style(f"Mail Servers (MX): {len(mx)}", bold=True))
-                    for server in mx[:5]:  # Show first 5
-                        click.echo(f"  • {server}")
-                    if len(mx) > 5:
-                        click.echo(f"  ... and {len(mx) - 5} more")
-                    click.echo()
-
-                # TXT records
                 txt = parsed.get('txt_records', [])
-                if txt:
-                    click.echo(click.style(f"TXT Records: {len(txt)}", bold=True))
-                    for record in txt:
-                        # Truncate long records
-                        display = record[:80] + "..." if len(record) > 80 else record
-                        click.echo(f"  • {display}")
-                    click.echo()
-
-                # Subdomains
                 subdomains = parsed.get('subdomains', [])
-                if subdomains:
-                    click.echo(click.style(f"Subdomains: {len(subdomains)}", bold=True))
-                    for sub in subdomains[:10]:  # Show first 10
-                        click.echo(f"  • {sub}")
-                    if len(subdomains) > 10:
-                        click.echo(f"  ... and {len(subdomains) - 10} more")
+
+                has_results = hosts or ns or mx or txt or subdomains
+
+                if has_results:
+                    # Hosts (A records)
+                    if hosts:
+                        click.echo(click.style(f"Hosts (A Records): {len(hosts)}", bold=True))
+                        for host in hosts:
+                            click.echo(f"  • {host['hostname']} → {host['ip']}")
+                        click.echo()
+
+                    # Nameservers
+                    if ns:
+                        click.echo(click.style(f"Nameservers (NS): {len(ns)}", bold=True))
+                        for server in ns:
+                            click.echo(f"  • {server}")
+                        click.echo()
+
+                    # Mail servers
+                    if mx:
+                        click.echo(click.style(f"Mail Servers (MX): {len(mx)}", bold=True))
+                        for server in mx[:5]:  # Show first 5
+                            click.echo(f"  • {server}")
+                        if len(mx) > 5:
+                            click.echo(f"  ... and {len(mx) - 5} more")
+                        click.echo()
+
+                    # TXT records
+                    if txt:
+                        click.echo(click.style(f"TXT Records: {len(txt)}", bold=True))
+                        for record in txt:
+                            # Truncate long records
+                            display = record[:80] + "..." if len(record) > 80 else record
+                            click.echo(f"  • {display}")
+                        click.echo()
+
+                    # Subdomains
+                    if subdomains:
+                        click.echo(click.style(f"Subdomains: {len(subdomains)}", bold=True))
+                        for sub in subdomains[:10]:  # Show first 10
+                            click.echo(f"  • {sub}")
+                        if len(subdomains) > 10:
+                            click.echo(f"  ... and {len(subdomains) - 10} more")
+                        click.echo()
+                else:
+                    # No results - show friendly message
+                    click.echo(click.style("Result: No DNS records discovered", fg='yellow', bold=True))
+                    click.echo()
+                    click.echo("  The scan did not find any DNS records.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Verify the domain name is correct")
+                    click.echo("  • Try zone transfer: -a -t axfr")
+                    click.echo("  • Check if domain has public DNS records")
                     click.echo()
 
                 click.echo(click.style("=" * 70, fg='cyan'))
@@ -6167,7 +6271,7 @@ def view_job_detail(job_id: int):
                 pass
 
         # Parse and display Nuclei results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'nuclei' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'nuclei' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.nuclei_parser import parse_nuclei_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -6175,10 +6279,17 @@ def view_job_detail(job_id: int):
                 parsed = parse_nuclei_output(log_content, job.get('target', ''))
 
                 findings = parsed.get('findings', [])
+
+                # Always show summary header
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo(click.style("VULNERABILITY SCAN", bold=True, fg='cyan'))
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
+
+                click.echo(click.style(f"Target: {job.get('target', 'unknown')}", bold=True))
+
                 if findings:
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo(click.style("NUCLEI FINDINGS", bold=True, fg='cyan'))
-                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo(click.style(f"Result: {len(findings)} vulnerability(ies) found", fg='red', bold=True))
                     click.echo()
 
                     # Group by severity
@@ -6215,13 +6326,27 @@ def view_job_detail(job_id: int):
                                 click.echo(f"    ... and {len(items) - 5} more")
                             click.echo()
 
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo()
+                else:
+                    # No findings - show friendly message
+                    click.echo(click.style("Result: No vulnerabilities detected", fg='green', bold=True))
+                    click.echo()
+                    click.echo("  The scan completed without finding any vulnerabilities.")
+                    click.echo("  This could mean the target is secure or templates didn't match.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Try different severity levels: -severity critical,high,medium,low")
+                    click.echo("  • Try specific tags: -tags cve,exposure,misconfiguration")
+                    click.echo("  • Update templates: nuclei -update-templates")
+                    click.echo()
                     click.echo(click.style("=" * 70, fg='cyan'))
                     click.echo()
             except Exception as e:
                 pass
 
         # Parse and display theHarvester results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'theharvester' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'theharvester' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.theharvester_parser import parse_theharvester_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -6233,54 +6358,73 @@ def view_job_detail(job_id: int):
                 click.echo(click.style("=" * 70, fg='cyan'))
                 click.echo()
 
-                # Emails
-                emails = parsed.get('emails', [])
-                if emails:
-                    click.echo(click.style(f"Emails: {len(emails)}", bold=True))
-                    for email in emails[:10]:
-                        click.echo(f"  • {email}")
-                    if len(emails) > 10:
-                        click.echo(f"  ... and {len(emails) - 10} more")
-                    click.echo()
+                click.echo(click.style(f"Target: {job.get('target', 'unknown')}", bold=True))
+                click.echo()
 
-                # IPs
+                # Collect all results
+                emails = parsed.get('emails', [])
                 ips = parsed.get('ips', [])
-                if ips:
-                    click.echo(click.style(f"IP Addresses: {len(ips)}", bold=True))
-                    for ip in ips[:10]:
-                        click.echo(f"  • {ip}")
-                    if len(ips) > 10:
-                        click.echo(f"  ... and {len(ips) - 10} more")
-                    click.echo()
-
-                # ASNs
                 asns = parsed.get('asns', [])
-                if asns:
-                    click.echo(click.style(f"ASNs: {len(asns)}", bold=True))
-                    for asn in asns[:10]:
-                        click.echo(f"  • {asn}")
-                    if len(asns) > 10:
-                        click.echo(f"  ... and {len(asns) - 10} more")
-                    click.echo()
-
-                # Interesting URLs
                 urls = parsed.get('urls', parsed.get('base_urls', []))
-                if urls:
-                    click.echo(click.style(f"Interesting URLs: {len(urls)}", bold=True))
-                    for url in urls[:15]:
-                        click.echo(f"  • {url}")
-                    if len(urls) > 15:
-                        click.echo(f"  ... and {len(urls) - 15} more")
-                    click.echo()
-
-                # Subdomains
                 subdomains = parsed.get('subdomains', [])
-                if subdomains:
-                    click.echo(click.style(f"Hosts Found: {len(subdomains)}", bold=True))
-                    for sub in subdomains[:15]:
-                        click.echo(f"  • {sub}")
-                    if len(subdomains) > 15:
-                        click.echo(f"  ... and {len(subdomains) - 15} more")
+
+                has_results = emails or ips or asns or urls or subdomains
+
+                if has_results:
+                    # Emails
+                    if emails:
+                        click.echo(click.style(f"Emails: {len(emails)}", bold=True))
+                        for email in emails[:10]:
+                            click.echo(f"  • {email}")
+                        if len(emails) > 10:
+                            click.echo(f"  ... and {len(emails) - 10} more")
+                        click.echo()
+
+                    # IPs
+                    if ips:
+                        click.echo(click.style(f"IP Addresses: {len(ips)}", bold=True))
+                        for ip in ips[:10]:
+                            click.echo(f"  • {ip}")
+                        if len(ips) > 10:
+                            click.echo(f"  ... and {len(ips) - 10} more")
+                        click.echo()
+
+                    # ASNs
+                    if asns:
+                        click.echo(click.style(f"ASNs: {len(asns)}", bold=True))
+                        for asn in asns[:10]:
+                            click.echo(f"  • {asn}")
+                        if len(asns) > 10:
+                            click.echo(f"  ... and {len(asns) - 10} more")
+                        click.echo()
+
+                    # Interesting URLs
+                    if urls:
+                        click.echo(click.style(f"Interesting URLs: {len(urls)}", bold=True))
+                        for url in urls[:15]:
+                            click.echo(f"  • {url}")
+                        if len(urls) > 15:
+                            click.echo(f"  ... and {len(urls) - 15} more")
+                        click.echo()
+
+                    # Subdomains
+                    if subdomains:
+                        click.echo(click.style(f"Hosts Found: {len(subdomains)}", bold=True))
+                        for sub in subdomains[:15]:
+                            click.echo(f"  • {sub}")
+                        if len(subdomains) > 15:
+                            click.echo(f"  ... and {len(subdomains) - 15} more")
+                        click.echo()
+                else:
+                    # No results - show friendly message
+                    click.echo(click.style("Result: No assets discovered", fg='yellow', bold=True))
+                    click.echo()
+                    click.echo("  The scan completed without finding any publicly exposed assets.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Try different data sources (-b google,bing,linkedin)")
+                    click.echo("  • Check if the domain is correct")
+                    click.echo("  • Some organizations have minimal public exposure")
                     click.echo()
 
                 click.echo(click.style("=" * 70, fg='cyan'))
@@ -6290,7 +6434,7 @@ def view_job_detail(job_id: int):
                 pass
 
         # Parse and display Nikto results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'nikto' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'nikto' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.nikto_parser import parse_nikto_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -6298,21 +6442,25 @@ def view_job_detail(job_id: int):
                 parsed = parse_nikto_output(log_content, job.get('target', ''))
 
                 findings = parsed.get('findings', [])
-                if findings:
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo(click.style("NIKTO SCAN RESULTS", bold=True, fg='cyan'))
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo()
 
-                    # Target info
-                    if parsed.get('target_ip'):
-                        click.echo(click.style(f"Target: {parsed['target_ip']}", bold=True))
-                    if parsed.get('server'):
-                        click.echo(f"Server: {parsed['server']}")
-                    if parsed.get('target_port'):
-                        click.echo(f"Port: {parsed['target_port']}")
-                    click.echo()
+                # Always show header
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo(click.style("NIKTO SCAN RESULTS", bold=True, fg='cyan'))
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
 
+                # Target info
+                if parsed.get('target_ip'):
+                    click.echo(click.style(f"Target: {parsed['target_ip']}", bold=True))
+                elif job.get('target'):
+                    click.echo(click.style(f"Target: {job.get('target')}", bold=True))
+                if parsed.get('server'):
+                    click.echo(f"Server: {parsed['server']}")
+                if parsed.get('target_port'):
+                    click.echo(f"Port: {parsed['target_port']}")
+                click.echo()
+
+                if findings:
                     # Stats
                     stats = parsed.get('stats', {})
                     by_severity = stats.get('by_severity', {})
@@ -6356,15 +6504,26 @@ def view_job_detail(job_id: int):
                     if len(findings) > 15:
                         click.echo(f"  ... and {len(findings) - 15} more findings")
                     click.echo()
-
-                    click.echo(click.style("=" * 70, fg='cyan'))
+                else:
+                    # No findings - show friendly message
+                    click.echo(click.style("Result: No issues detected", fg='green', bold=True))
+                    click.echo()
+                    click.echo("  The scan completed without finding any web server issues.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Try with different tuning: -T 1-9 for specific test types")
+                    click.echo("  • Check if the target web server is running")
+                    click.echo("  • Use -Cgidirs to specify CGI directories")
                     click.echo()
+
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
             except Exception as e:
                 # Fall back to raw log if parsing fails
                 pass
 
         # Parse and display WHOIS results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'whois' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'whois' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.whois_parser import parse_whois_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -6376,44 +6535,65 @@ def view_job_detail(job_id: int):
                 click.echo(click.style("=" * 70, fg='cyan'))
                 click.echo()
 
-                # Domain and registrar
-                if parsed.get('domain'):
-                    click.echo(click.style(f"Domain: {parsed['domain']}", bold=True))
-                if parsed.get('registrar'):
-                    click.echo(f"Registrar: {parsed['registrar']}")
-                click.echo()
+                # Check if we have any data
+                has_data = (parsed.get('domain') or parsed.get('registrar') or
+                           parsed.get('dates') or parsed.get('nameservers') or
+                           parsed.get('status') or parsed.get('dnssec'))
 
-                # Registration dates
-                dates = parsed.get('dates', {})
-                if dates:
-                    click.echo(click.style("Registration Information:", bold=True))
-                    if dates.get('created'):
-                        click.echo(f"  Created: {dates['created']}")
-                    if dates.get('updated'):
-                        click.echo(f"  Updated: {dates['updated']}")
-                    if dates.get('expires'):
-                        click.echo(f"  Expires: {dates['expires']}")
+                if has_data:
+                    # Domain and registrar
+                    if parsed.get('domain'):
+                        click.echo(click.style(f"Domain: {parsed['domain']}", bold=True))
+                    elif job.get('target'):
+                        click.echo(click.style(f"Target: {job.get('target')}", bold=True))
+                    if parsed.get('registrar'):
+                        click.echo(f"Registrar: {parsed['registrar']}")
                     click.echo()
 
-                # Nameservers
-                ns = parsed.get('nameservers', [])
-                if ns:
-                    click.echo(click.style(f"Nameservers: {len(ns)}", bold=True))
-                    for server in ns:
-                        click.echo(f"  • {server}")
-                    click.echo()
+                    # Registration dates
+                    dates = parsed.get('dates', {})
+                    if dates:
+                        click.echo(click.style("Registration Information:", bold=True))
+                        if dates.get('created'):
+                            click.echo(f"  Created: {dates['created']}")
+                        if dates.get('updated'):
+                            click.echo(f"  Updated: {dates['updated']}")
+                        if dates.get('expires'):
+                            click.echo(f"  Expires: {dates['expires']}")
+                        click.echo()
 
-                # Status
-                status_list = parsed.get('status', [])
-                if status_list:
-                    click.echo(click.style("Domain Status:", bold=True))
-                    for status in status_list:
-                        click.echo(f"  • {status}")
-                    click.echo()
+                    # Nameservers
+                    ns = parsed.get('nameservers', [])
+                    if ns:
+                        click.echo(click.style(f"Nameservers: {len(ns)}", bold=True))
+                        for server in ns:
+                            click.echo(f"  • {server}")
+                        click.echo()
+
+                    # Status
+                    status_list = parsed.get('status', [])
+                    if status_list:
+                        click.echo(click.style("Domain Status:", bold=True))
+                        for status in status_list:
+                            click.echo(f"  • {status}")
+                        click.echo()
 
-                # DNSSEC
-                if parsed.get('dnssec'):
-                    click.echo(f"DNSSEC: {parsed['dnssec']}")
+                    # DNSSEC
+                    if parsed.get('dnssec'):
+                        click.echo(f"DNSSEC: {parsed['dnssec']}")
+                        click.echo()
+                else:
+                    # No results - show friendly message
+                    click.echo(click.style(f"Target: {job.get('target', 'unknown')}", bold=True))
+                    click.echo()
+                    click.echo(click.style("Result: No WHOIS information found", fg='yellow', bold=True))
+                    click.echo()
+                    click.echo("  The WHOIS lookup did not return any information.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Verify the domain name is correct")
+                    click.echo("  • Some domains have private WHOIS")
+                    click.echo("  • Try a different WHOIS server")
                     click.echo()
 
                 click.echo(click.style("=" * 70, fg='cyan'))
@@ -6471,7 +6651,7 @@ def view_job_detail(job_id: int):
                 pass
 
         # Parse and display SMBMap results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'smbmap' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'smbmap' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.smbmap_parser import parse_smbmap_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -6479,19 +6659,23 @@ def view_job_detail(job_id: int):
                 parsed = parse_smbmap_output(log_content, job.get('target', ''))
 
                 shares = parsed.get('shares', [])
-                if shares:
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo(click.style("SMB SHARE ENUMERATION", bold=True, fg='cyan'))
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo()
 
-                    if parsed.get('target'):
-                        click.echo(click.style(f"Target: {parsed['target']}", bold=True))
-                    if parsed.get('status'):
-                        auth_color = 'green' if parsed['status'] == 'Authenticated' else 'yellow'
-                        click.echo(f"Authentication: {click.style(parsed['status'], fg=auth_color)}")
-                    click.echo()
+                # Always show header
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo(click.style("SMB SHARE ENUMERATION", bold=True, fg='cyan'))
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
+
+                if parsed.get('target'):
+                    click.echo(click.style(f"Target: {parsed['target']}", bold=True))
+                elif job.get('target'):
+                    click.echo(click.style(f"Target: {job.get('target')}", bold=True))
+                if parsed.get('status'):
+                    auth_color = 'green' if parsed['status'] == 'Authenticated' else 'yellow'
+                    click.echo(f"Authentication: {click.style(parsed['status'], fg=auth_color)}")
+                click.echo()
 
+                if shares:
                     # Group shares by permissions
                     writable = [s for s in shares if s.get('writable')]
                     readable = [s for s in shares if s.get('readable') and not s.get('writable')]
@@ -6528,14 +6712,25 @@ def view_job_detail(job_id: int):
                     if files:
                         click.echo(click.style(f"Files Enumerated: {len(files)}", bold=True))
                         click.echo()
-
-                    click.echo(click.style("=" * 70, fg='cyan'))
+                else:
+                    # No results - show friendly message
+                    click.echo(click.style("Result: No SMB shares found", fg='yellow', bold=True))
+                    click.echo()
+                    click.echo("  The scan did not find any accessible SMB shares.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Try with credentials: -u user -p password")
+                    click.echo("  • Check if SMB is enabled on the target")
+                    click.echo("  • Verify the target IP is correct")
                     click.echo()
+
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
             except Exception as e:
                 pass
 
         # Parse and display enum4linux results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'enum4linux' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'enum4linux' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.enum4linux_parser import parse_enum4linux_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -6549,52 +6744,70 @@ def view_job_detail(job_id: int):
 
                 if parsed.get('target'):
                     click.echo(click.style(f"Target: {parsed['target']}", bold=True))
+                elif job.get('target'):
+                    click.echo(click.style(f"Target: {job.get('target')}", bold=True))
                 if parsed.get('workgroup'):
                     click.echo(f"Workgroup/Domain: {parsed['workgroup']}")
                 if parsed.get('domain_sid'):
                     click.echo(f"Domain SID: {parsed['domain_sid']}")
                 click.echo()
 
-                # Users
+                # Collect all results
                 users = parsed.get('users', [])
-                if users:
-                    click.echo(click.style(f"Users Discovered ({len(users)}):", bold=True, fg='green'))
-                    for user in users[:15]:
-                        click.echo(f"  • {user}")
-                    if len(users) > 15:
-                        click.echo(f"  ... and {len(users) - 15} more")
-                    click.echo()
-
-                # Groups
                 groups = parsed.get('groups', [])
-                if groups:
-                    click.echo(click.style(f"Groups Discovered ({len(groups)}):", bold=True, fg='cyan'))
-                    for group in groups[:10]:
-                        click.echo(f"  • {group}")
-                    if len(groups) > 10:
-                        click.echo(f"  ... and {len(groups) - 10} more")
-                    click.echo()
-
-                # Shares
                 shares = parsed.get('shares', [])
-                if shares:
-                    click.echo(click.style(f"Shares Found ({len(shares)}):", bold=True, fg='yellow'))
-                    for share in shares:
-                        name = share.get('name', '')
-                        share_type = share.get('type', '')
-                        comment = share.get('comment', '')
-                        mapping = share.get('mapping', 'N/A')
-
-                        # Color code by access
-                        if mapping == 'OK':
-                            access_display = click.style('Accessible', fg='green')
-                        elif mapping == 'DENIED':
-                            access_display = click.style('Denied', fg='red')
-                        else:
-                            access_display = click.style('Unknown', dim=True)
 
-                        comment_str = f" - {comment}" if comment else ""
-                        click.echo(f"  • {name} ({share_type}) [{access_display}]{comment_str}")
+                has_results = users or groups or shares or parsed.get('workgroup') or parsed.get('domain_sid')
+
+                if has_results:
+                    # Users
+                    if users:
+                        click.echo(click.style(f"Users Discovered ({len(users)}):", bold=True, fg='green'))
+                        for user in users[:15]:
+                            click.echo(f"  • {user}")
+                        if len(users) > 15:
+                            click.echo(f"  ... and {len(users) - 15} more")
+                        click.echo()
+
+                    # Groups
+                    if groups:
+                        click.echo(click.style(f"Groups Discovered ({len(groups)}):", bold=True, fg='cyan'))
+                        for group in groups[:10]:
+                            click.echo(f"  • {group}")
+                        if len(groups) > 10:
+                            click.echo(f"  ... and {len(groups) - 10} more")
+                        click.echo()
+
+                    # Shares
+                    if shares:
+                        click.echo(click.style(f"Shares Found ({len(shares)}):", bold=True, fg='yellow'))
+                        for share in shares:
+                            name = share.get('name', '')
+                            share_type = share.get('type', '')
+                            comment = share.get('comment', '')
+                            mapping = share.get('mapping', 'N/A')
+
+                            # Color code by access
+                            if mapping == 'OK':
+                                access_display = click.style('Accessible', fg='green')
+                            elif mapping == 'DENIED':
+                                access_display = click.style('Denied', fg='red')
+                            else:
+                                access_display = click.style('Unknown', dim=True)
+
+                            comment_str = f" - {comment}" if comment else ""
+                            click.echo(f"  • {name} ({share_type}) [{access_display}]{comment_str}")
+                        click.echo()
+                else:
+                    # No results - show friendly message
+                    click.echo(click.style("Result: No SMB/Samba information discovered", fg='yellow', bold=True))
+                    click.echo()
+                    click.echo("  The scan did not find any users, groups, or shares.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Check if SMB is enabled on the target")
+                    click.echo("  • Try with credentials for authenticated enumeration")
+                    click.echo("  • Verify the target IP is correct")
                     click.echo()
 
                 click.echo(click.style("=" * 70, fg='cyan'))
@@ -6670,7 +6883,7 @@ def view_job_detail(job_id: int):
                 pass
 
         # Parse and display Hydra results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'hydra' and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'hydra' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.hydra_parser import parse_hydra_output
                 with open(log_path, 'r', encoding='utf-8', errors='replace') as f:
@@ -6690,7 +6903,7 @@ def view_job_detail(job_id: int):
                     # Summary info
                     click.echo(click.style(f"Target: {parsed.get('target_host', 'unknown')}", bold=True))
                     click.echo(f"Service: {parsed.get('service', 'unknown')} (port {parsed.get('port', 'unknown')})")
-                    click.echo(click.style(f"\n✓ {len(credentials)} Valid Credential(s) Found", fg='green', bold=True))
+                    click.echo(click.style(f"\n{len(credentials)} Valid Credential(s) Found", fg='green', bold=True))
                     click.echo()
 
                     # Display credentials in table format
@@ -6710,7 +6923,7 @@ def view_job_detail(job_id: int):
 
                     # Show password visibility status
                     if not show_passwords:
-                        click.echo(click.style("🔒 Passwords are hidden. Use [p] to reveal.", fg='yellow', dim=True))
+                        click.echo(click.style("Passwords are hidden. Use [p] to reveal.", fg='yellow', dim=True))
                         click.echo()
 
                     # Show if credentials were saved
@@ -6722,7 +6935,7 @@ def view_job_detail(job_id: int):
                         all_creds = cm.list_credentials(engagement_id)
                         hydra_creds = [c for c in all_creds if c.get('tool') == 'hydra']
                         if hydra_creds:
-                            click.echo(click.style(f"✓ Credentials saved to database ({len(hydra_creds)} total from Hydra)", fg='green'))
+                            click.echo(click.style(f"Credentials saved to database ({len(hydra_creds)} total from Hydra)", fg='green'))
                             click.echo()
 
                     click.echo(click.style("=" * 70, fg='cyan'))
@@ -6738,7 +6951,7 @@ def view_job_detail(job_id: int):
                     # Summary info
                     click.echo(click.style(f"Target: {parsed.get('target_host', 'unknown')}", bold=True))
                     click.echo(f"Service: {parsed.get('service', 'unknown')} (port {parsed.get('port', 'unknown')})")
-                    click.echo(click.style(f"\n✓ {len(usernames)} Valid Username(s) Found (password unknown)", fg='yellow', bold=True))
+                    click.echo(click.style(f"\n{len(usernames)} Valid Username(s) Found (password unknown)", fg='yellow', bold=True))
                     click.echo()
 
                     # Display usernames
@@ -6752,24 +6965,63 @@ def view_job_detail(job_id: int):
 
                     click.echo(click.style("=" * 70, fg='yellow'))
                     click.echo()
+                else:
+                    # No credentials or usernames found
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo(click.style("HYDRA PASSWORD ATTACK", bold=True, fg='cyan'))
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo()
+
+                    # Summary info
+                    target = parsed.get('target_host') or job.get('target', 'unknown')
+                    click.echo(click.style(f"Target: {target}", bold=True))
+                    service = parsed.get('service', 'unknown')
+                    port = parsed.get('port', 'unknown')
+                    if service != 'unknown' or port != 'unknown':
+                        click.echo(f"Service: {service} (port {port})")
+                    click.echo()
+
+                    click.echo(click.style("Result: No valid credentials found", fg='yellow', bold=True))
+                    click.echo()
+                    click.echo("  The password attack completed without finding valid credentials.")
+                    click.echo()
+                    click.echo(click.style("Tips:", dim=True))
+                    click.echo("  • Try a larger wordlist")
+                    click.echo("  • Verify the service is accessible")
+                    click.echo("  • Check if account lockout is enabled")
+                    click.echo()
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo()
             except Exception as e:
                 # Silently fail - not critical
                 pass
 
         # Parse and display SearchSploit results if available (only when not showing raw logs)
-        if not show_raw_logs and job.get('tool') == 'searchsploit' and job.get('status') in ['done', 'completed'] and log_path and os.path.exists(log_path):
+        if not show_raw_logs and job.get('tool') == 'searchsploit' and job.get('status') in ['done', 'completed', 'no_results'] and log_path and os.path.exists(log_path):
             try:
                 from souleyez.parsers.searchsploit_parser import parse_searchsploit
                 parsed = parse_searchsploit(log_path, job.get('target', ''))
 
                 exploits = parsed.get('exploits', [])
-                if exploits:
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo(click.style("SEARCHSPLOIT RESULTS", bold=True, fg='cyan'))
-                    click.echo(click.style("=" * 70, fg='cyan'))
-                    click.echo()
 
-                    click.echo(click.style(f"Search Term: {parsed.get('target', 'unknown')}", bold=True))
+                # Always show summary header
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo(click.style("EXPLOIT SEARCH", bold=True, fg='cyan'))
+                click.echo(click.style("=" * 70, fg='cyan'))
+                click.echo()
+
+                # Extract search term from args or target
+                search_term = parsed.get('target', '')
+                if not search_term:
+                    # Try to get from job args
+                    args = job.get('args', [])
+                    non_flag_args = [a for a in args if not a.startswith('-') and a != '--json']
+                    if non_flag_args:
+                        search_term = ' '.join(non_flag_args)
+
+                click.echo(click.style(f"Search Term: {search_term or 'unknown'}", bold=True))
+
+                if exploits:
                     click.echo(click.style(f"Found: {len(exploits)} exploit(s)", fg='green', bold=True))
                     click.echo()
 
@@ -6818,6 +7070,19 @@ def view_job_detail(job_id: int):
 
                     click.echo(click.style("=" * 70, fg='cyan'))
                     click.echo()
+                else:
+                    # No exploits found - show friendly message
+                    click.echo(click.style("Results: 0 exploits found", fg='yellow'))
+                    click.echo()
+                    click.echo("No matching exploits found in Exploit-DB database.")
+                    click.echo()
+                    click.echo(click.style("Tips:", fg='bright_black'))
+                    click.echo(click.style("  - Try broader search terms (e.g., 'Apache' instead of 'Apache 2.4.49')", fg='bright_black'))
+                    click.echo(click.style("  - Check for typos in the search term", fg='bright_black'))
+                    click.echo(click.style("  - Update Exploit-DB: searchsploit -u", fg='bright_black'))
+                    click.echo()
+                    click.echo(click.style("=" * 70, fg='cyan'))
+                    click.echo()
 
             except Exception as e:
                 # Silently fail - not critical
@@ -7887,6 +8152,40 @@ def manage_engagements_menu():
                     click.echo(click.style(f"  ✓ Created engagement '{ws_name}' (ID: {ws_id})", fg='green'))
                     if selected_template:
                         click.echo(click.style(f"  ✓ Applied preset: {selected_template.name}", fg='green'))
+
+                    # Save scope to engagement_scope table if provided
+                    if ws_scope.strip():
+                        from souleyez.security.scope_validator import ScopeManager
+                        import ipaddress
+                        scope_mgr = ScopeManager()
+                        scope_value = ws_scope.strip()
+
+                        # Determine scope type
+                        scope_type = None
+                        try:
+                            # Check if CIDR
+                            ipaddress.ip_network(scope_value, strict=False)
+                            scope_type = 'cidr'
+                        except ValueError:
+                            try:
+                                # Check if single IP
+                                ipaddress.ip_address(scope_value)
+                                scope_type = 'cidr'
+                                scope_value = f"{scope_value}/32"  # Convert single IP to CIDR
+                            except ValueError:
+                                # Check if URL
+                                if scope_value.startswith(('http://', 'https://')):
+                                    scope_type = 'url'
+                                else:
+                                    # Assume domain
+                                    scope_type = 'domain'
+
+                        try:
+                            scope_mgr.add_scope(ws_id, scope_type, scope_value, description="Added during engagement creation")
+                            click.echo(click.style(f"  ✓ Added scope: {scope_type}={scope_value}", fg='green'))
+                        except Exception as scope_err:
+                            click.echo(click.style(f"  ⚠ Could not save scope: {scope_err}", fg='yellow'))
+
                     click.echo()
 
                     # Show next steps based on preset
@@ -8631,18 +8930,48 @@ def _select_siem_type(engagement_id: int):
     config = WazuhConfig.get_config(engagement_id)
     current_type = config.get('siem_type', 'wazuh') if config else 'wazuh'
 
-    # Show available SIEM types
-    siem_types = SIEMFactory.get_available_types()
-    click.echo("  Available SIEM platforms:")
+    # Define SIEM categories with emojis
+    siem_emojis = {
+        'wazuh': '🦎',
+        'elastic': '🦌',
+        'splunk': '⚡',
+        'sentinel': '🛡️',
+        'google_secops': '🔍',
+    }
+    open_source_siems = ['wazuh', 'elastic']
+    commercial_siems = ['splunk', 'sentinel', 'google_secops']
+
+    # Build ordered list for selection (open source first)
+    siem_types = open_source_siems + commercial_siems
+
+    # Show Open Source section
+    click.echo("  🌐 " + click.style("OPEN SOURCE", fg='green', bold=True))
+    click.echo("  " + "─" * 60)
+    idx = 1
+    for siem_type in open_source_siems:
+        info = SIEMFactory.get_type_info(siem_type)
+        emoji = siem_emojis.get(siem_type, '📊')
+        current_marker = click.style(" (current)", fg='green') if siem_type == current_type else ""
+        # Remove [Open Source] prefix from description since we have section header
+        desc = info['description'].replace('[Open Source] ', '')
+        click.echo(f"    [{idx}] {emoji} {click.style(info['name'], bold=True)}{current_marker}")
+        click.echo(f"        {click.style(desc, dim=True)}")
+        idx += 1
     click.echo()
 
-    for i, siem_type in enumerate(siem_types, 1):
+    # Show Commercial section
+    click.echo("  💼 " + click.style("COMMERCIAL", fg='cyan', bold=True))
+    click.echo("  " + "─" * 60)
+    for siem_type in commercial_siems:
         info = SIEMFactory.get_type_info(siem_type)
-        is_current = " (current)" if siem_type == current_type else ""
-        marker = click.style("*", fg='green') if siem_type == current_type else " "
-        click.echo(f"  {marker} [{i}] {click.style(info['name'], bold=True)}{is_current}")
-        click.echo(f"       {info['description']}")
-        click.echo()
+        emoji = siem_emojis.get(siem_type, '📊')
+        current_marker = click.style(" (current)", fg='green') if siem_type == current_type else ""
+        # Remove [Commercial] prefix from description since we have section header
+        desc = info['description'].replace('[Commercial] ', '')
+        click.echo(f"    [{idx}] {emoji} {click.style(info['name'], bold=True)}{current_marker}")
+        click.echo(f"        {click.style(desc, dim=True)}")
+        idx += 1
+    click.echo()
 
     click.echo("    [q] Cancel")
     click.echo()
@@ -8664,19 +8993,28 @@ def _select_siem_type(engagement_id: int):
                 if new_type == current_type:
                     click.echo(f"\n  {info['name']} is already selected.")
                 else:
-                    # If switching SIEM types, we need to reconfigure
-                    click.echo(f"\n  Switching to {click.style(info['name'], bold=True)}...")
-                    click.echo("  You'll need to configure the connection settings.")
-
-                    # Save minimal config to set the SIEM type
-                    WazuhConfig.save_siem_config(
-                        engagement_id=engagement_id,
-                        siem_type=new_type,
-                        config={'siem_type': new_type},
-                        enabled=False  # Not enabled until configured
-                    )
-                    click.echo(click.style(f"\n  ✓ SIEM type set to {info['name']}", fg='green'))
-                    click.echo("  Use 'Configure Connection' to set up credentials.")
+                    # Check if this SIEM type already has a config
+                    existing_config = WazuhConfig.get_config(engagement_id, new_type)
+
+                    if existing_config and existing_config.get('enabled'):
+                        # Already configured - just make it current by updating timestamp
+                        click.echo(f"\n  Switching to {click.style(info['name'], bold=True)}...")
+                        WazuhConfig.set_current_siem(engagement_id, new_type)
+                        click.echo(click.style(f"\n  ✓ Switched to {info['name']} (existing config restored)", fg='green'))
+                    else:
+                        # Not configured - create placeholder
+                        click.echo(f"\n  Switching to {click.style(info['name'], bold=True)}...")
+                        click.echo("  You'll need to configure the connection settings.")
+
+                        # Save minimal config to set the SIEM type
+                        WazuhConfig.save_siem_config(
+                            engagement_id=engagement_id,
+                            siem_type=new_type,
+                            config={'siem_type': new_type},
+                            enabled=False  # Not enabled until configured
+                        )
+                        click.echo(click.style(f"\n  ✓ SIEM type set to {info['name']}", fg='green'))
+                        click.echo("  Use 'Configure Connection' to set up credentials.")
             else:
                 click.echo(click.style("\n  ✗ Invalid choice", fg='red'))
         except ValueError: