Natural-language query

What it is

A natural-language → SmartSearch translator powered by Anthropic Claude Haiku, with a hand-curated grammar + intent cookbook. Type an English sentence in any list view’s search box; the AI returns the equivalent tokenised query; the operator confirms and the page filters.

What it produces

For each translation:

• The tokenised query (one of the SmartSearch grammars: services / hosts / findings / targets)
• A confidence indicator: when the AI couldn’t map to clean tokens, it echoes salient keywords as free text instead of inventing token keys.

Sample translations (verified against the live cookbook):

• “internal services with apache” → internal:true product:apache
• ”external surface with critical cves” → internal:false has_cve:true cve_severity:critical
• ”what did the prod-bastion agent find” → agent:prod-bastion
• ”german databases” → category:database country:DE
• ”cameras or routers” → device_type:camera,router

What to use it for

• Onboarding: operators who haven’t memorised the token grammar yet
• Slack /umbra ask: type a question, get an answer
• Cross-team handoff: your CEO can ask “show me everything exploitable” and get an answer

Why it matters

The dashboard’s expressiveness gates how often security ops actually USE the dashboard. A grammar that’s typeable in any sentence collapses the activation energy from “open the docs, find the right filter, type the right keys” to “type what you mean.”

Why it’s valuable

• Anthropic Haiku. Fast (<1 s typical), cheap (cents per 1k queries), high-quality on this constrained translation task.
• Grounded in a cookbook. Hand-curated intent → tokens pairs cover the long tail; no hallucinated token keys.
• Per-view grammars. Services / hosts / findings each get their own translator with their own token vocabulary, no cross-contamination.

How to use it

• Slack: /umbra ask critical cves on internal apache
• Dashboard: click the AI button in any list view’s search bar. Type the question. The translator suggests the tokenised query; press enter to run.

Cost is debited from your bundled AI allowance, same as exploit runs. Typical per-translation cost is fractions of a cent.