secmon-lab · m-mizutani · Jun 22, 2026 · Jun 22, 2026 · Jun 22, 2026
diff --git a/.claude/rules/subagent-development.md b/.claude/rules/subagent-development.md
diff --git a/README.md b/README.md
@@ -33,20 +33,21 @@ This is not a generic AI agent with security tools bolted on. Warren is purpose-
 
 ## How It Works
 
-### Slack-Based Multi-Agent Investigation
+### Slack-Based AI Investigation
 
-Warren operates as a **Slack-native multi-agent system**. When an alert arrives, it is posted to a Slack channel with AI-generated analysis. Team members interact with Warren directly in Slack threads — `@warren` triggers an investigation agent that can delegate work to specialized sub-agents in parallel:
+Warren operates as a **Slack-native investigation system**. When an alert arrives, it is posted to a Slack channel with AI-generated analysis. Team members interact with Warren directly in Slack threads — `@warren` triggers an investigation agent that can call specialized tools as it works:
 
 ```
 User asks @warren in Slack thread
-  └─ Orchestrator Agent
-       ├─ BigQuery Agent  → query audit logs, access patterns
-       ├─ Falcon Agent    → pull EDR endpoint data from CrowdStrike
-       ├─ Slack Agent     → search related conversations
-       └─ Direct tools    → VirusTotal, OTX, Shodan, AbuseIPDB, URLScan
+  └─ Investigation Agent
+       ├─ BigQuery   → query audit logs, access patterns
+       ├─ Falcon     → pull EDR endpoint data from CrowdStrike
+       ├─ Slack      → search related conversations
+       ├─ Jira       → correlate with tracked tickets
+       └─ Threat intel → VirusTotal, OTX, Shodan, AbuseIPDB, URLScan
 ```
 
-Each sub-agent autonomously decides what queries to run and how to interpret results. Real-time progress traces in the Slack thread show what the agent is doing as it works.
+The agent autonomously decides which tools to call and how to interpret results. Real-time progress traces in the Slack thread show what the agent is doing as it works.
 
 <p align="center">
   <img src="./doc/images/slack.png" width="600" alt="Slack integration with interactive investigation" />
@@ -126,15 +127,12 @@ Visit http://127.0.0.1:8080 to access the dashboard.
 
 - [**GitHub App**](./pkg/tool/github/README.md) — code search, issue search, file content retrieval, commit history, file blame
 - [**Microsoft Intune**](./pkg/tool/intune/README.md) — device compliance status, sign-in history
+- [**CrowdStrike Falcon**](./pkg/tool/falcon/README.md) — EDR incidents, alerts, behaviors, devices, CrowdScores, and telemetry events
 - [**Slack Message Search**](./pkg/tool/slack/README.md) — search workspace messages for context
+- [**Jira**](./pkg/tool/jira/README.md) — list projects, search issues via JQL, fetch issue content
+- [**BigQuery**](./doc/reference/configuration.md#bigquery-tool) — query security log data with SQL and runbooks
 - [**WebFetch**](./pkg/tool/webfetch/README.md) — fetch a web page and return clean Markdown with indirect-prompt-injection screening
 
-### Sub-Agents
-
-- [**BigQuery Agent**](./pkg/agents/bigquery/README.md) — query security log data via natural language
-- [**CrowdStrike Falcon Agent**](./pkg/agents/falcon/README.md) — query EDR incidents, alerts, and endpoint events
-- [**Slack Search Agent**](./pkg/agents/slack/README.md) — search and summarize Slack conversations
-
 ### Collaboration & UI
 
 - **Slack** — native bot with interactive buttons, thread-based investigation, real-time progress traces

diff --git a/doc/concepts.md b/doc/concepts.md
@@ -225,14 +225,3 @@ Slack command:
 Limitations:
 - Unbound alert processing is capped at 100 alerts per run
 - Each consolidation group contains 2-10 alerts
-
-### Agent Memory
-
-Warren's AI agents can learn from previous investigations through agent memory:
-
-- **Quality Scoring**: Memories rated from -10 (harmful) to +10 (helpful)
-- **Adaptive Search**: Re-ranks memories by similarity (50%) + quality (30%) + recency (20%)
-- **LLM Feedback**: Automatically evaluates memory usefulness after each agent execution
-- **Conservative Pruning**: Strict deletion criteria to preserve valuable memories
-
-Agent memory is enabled automatically for sub-agents (BigQuery, Falcon, Slack). Memories are scoped per agent and accumulate over time.
diff --git a/doc/migration/v0.18.0.md b/doc/migration/v0.18.0.md
@@ -0,0 +1,73 @@
+# Migration Guide: v0.18.0
+
+This guide covers the tool-related changes in Warren v0.18.0. The release unifies all external integrations under the `pkg/tool/*` path (backed by [`github.com/gollem-dev/tools`](https://github.com/gollem-dev/tools)) and removes the legacy `pkg/agents` "sub-agent" framework.
+
+## Overview
+
+Before v0.18.0, Warren exposed two parallel mechanisms for external integrations:
+
+- **Tools** (`pkg/tool/*`) — single-call functions invoked directly by the investigation agent.
+- **Sub-agents** (`pkg/agents/*`) — BigQuery, CrowdStrike Falcon, and Slack, each wired through a separate `WARREN_AGENT_*` flag namespace.
+
+v0.18.0 retires the sub-agent mechanism entirely. CrowdStrike Falcon and Slack are now plain tools, BigQuery already had a fully featured tool equivalent, and a new **Jira** tool is added. The change is **configuration-only** for operators — no data migration is required.
+
+## Breaking Changes Summary
+
+| Area | Removed / Changed | Replacement |
+|------|-------------------|-------------|
+| CrowdStrike Falcon | `WARREN_AGENT_FALCON_CLIENT_ID` / `_CLIENT_SECRET` / `_BASE_URL` (and `--agent-falcon-*` flags) | `WARREN_FALCON_CLIENT_ID` / `_CLIENT_SECRET` / `_BASE_URL` (`--falcon-*`) |
+| Slack search | `WARREN_AGENT_SLACK_USER_TOKEN` (`--agent-slack-user-token`) | `WARREN_SLACK_TOOL_USER_TOKEN` (`--slack-tool-user-token`) — the existing Slack tool |
+| BigQuery | `WARREN_AGENT_BIGQUERY_*` (`--agent-bigquery-*`) | `WARREN_BIGQUERY_*` (`--bigquery-*`) — the existing BigQuery tool |
+| Jira | _(new)_ | `WARREN_JIRA_BASE_URL` / `_USER_EMAIL` / `_API_TOKEN` (`--jira-*`) |
+| Internals | `pkg/agents` package; the chat "sub-agent" budget concept (`subAgentToolNames`, shared-tracker context plumbing) | none — tools are budgeted via the standard per-task tracker |
+
+There are **no Firestore, Cloud Storage, or policy changes** in this release. Pre-existing alert / triage / enrichment policies are unaffected.
+
+## Environment Variable Migration
+
+Rename the variables you currently set. The semantics are unchanged; only the namespace differs.
+
+| Old (≤ v0.17.x) | New (v0.18.0) |
+|-----------------|---------------|
+| `WARREN_AGENT_FALCON_CLIENT_ID` | `WARREN_FALCON_CLIENT_ID` |
+| `WARREN_AGENT_FALCON_CLIENT_SECRET` | `WARREN_FALCON_CLIENT_SECRET` |
+| `WARREN_AGENT_FALCON_BASE_URL` | `WARREN_FALCON_BASE_URL` |
+| `WARREN_AGENT_SLACK_USER_TOKEN` | `WARREN_SLACK_TOOL_USER_TOKEN` |
+| `WARREN_AGENT_BIGQUERY_CONFIG` | `WARREN_BIGQUERY_CONFIG` |
+| `WARREN_AGENT_BIGQUERY_PROJECT_ID` | `WARREN_BIGQUERY_PROJECT_ID` |
+| `WARREN_AGENT_BIGQUERY_SCAN_SIZE_LIMIT` | `WARREN_BIGQUERY_SCAN_LIMIT` |
+| `WARREN_AGENT_BIGQUERY_RUNBOOK_DIR` | `WARREN_BIGQUERY_RUNBOOK_PATH` |
+| `WARREN_AGENT_BIGQUERY_IMPERSONATE_SERVICE_ACCOUNT` | `WARREN_BIGQUERY_IMPERSONATE_SERVICE_ACCOUNT` |
+
+> The old `WARREN_AGENT_*` variables are **no longer read**. Set the new names before deploying v0.18.0, or the corresponding integration will be silently disabled (Warren skips any tool whose required settings are absent).
+
+### BigQuery notes
+
+The BigQuery tool is a superset of the former sub-agent: it supports the same runbooks (`WARREN_BIGQUERY_RUNBOOK_PATH` + the `get_runbook_entry` function), service-account impersonation, scan limit, and config files, and additionally supports GCS result storage (`WARREN_BIGQUERY_STORAGE_BUCKET` / `_STORAGE_PREFIX`), a query timeout (`WARREN_BIGQUERY_TIMEOUT`), and explicit credentials (`WARREN_BIGQUERY_CREDENTIALS`). No functionality is lost.
+
+The config-file format is per-table (one table per `--bigquery-config` file; pass the flag multiple times for several tables). `scan_size_limit` / `query_timeout` are no longer config-file keys — use the `--bigquery-scan-limit` / `--bigquery-timeout` flags instead. See [configuration.md → BigQuery Tool](../reference/configuration.md#bigquery-tool).
+
+## New: Jira tool
+
+v0.18.0 adds a read-only Jira Cloud tool (list projects, search issues via JQL, fetch issue content). Configure it with:
+
+```bash
+export WARREN_JIRA_BASE_URL="https://your-domain.atlassian.net"
+export WARREN_JIRA_USER_EMAIL="bot@example.com"
+export WARREN_JIRA_API_TOKEN="<atlassian-api-token>"
+```
+
+Create the API token at [Atlassian account → Security → API tokens](https://id.atlassian.com/manage-profile/security/api-tokens). See [pkg/tool/jira/README.md](../../pkg/tool/jira/README.md).
+
+## Dependency updates
+
+The bundled `github.com/gollem-dev/tools` modules are updated to their latest versions (notably `slack`, `github`, and `webfetch` to v0.2.0, which add functions such as `slack_get_messages`, `github_get_issue`, and `github_get_pull_request`). No operator action is required.
+
+## Migration Steps
+
+1. **Rename environment variables** per the table above in your deployment (Cloud Run env vars / Secret Manager bindings / `.env`).
+2. **(Optional) Add the Jira tool** settings if you want Jira correlation.
+3. **Deploy v0.18.0.** On start-up, confirm each expected integration is active. A tool whose required settings are missing is skipped silently, so a missed rename surfaces as a quietly disabled tool rather than an error.
+4. **Remove the old `WARREN_AGENT_*` variables** once the deployment is verified.
+
+No data migration jobs are needed for this release.
diff --git a/doc/operation/alert-investigation.md b/doc/operation/alert-investigation.md
@@ -41,7 +41,7 @@ Click **[Salvage]** on a ticket to find similar unbound alerts using AI similari
 
 ### Talking to Warren
 
-Mention `@warren` in a ticket's Slack thread to start an AI-powered investigation. Warren will analyze the ticket's alerts using available tools and sub-agents.
+Mention `@warren` in a ticket's Slack thread to start an AI-powered investigation. Warren will analyze the ticket's alerts using the available tools.
 
 ```
 @warren Check if the source IPs in this ticket are malicious
@@ -142,6 +142,9 @@ Warren's AI agent has access to the following tools during investigation. Tools
 |------|-------------|---------|
 | GitHub | Code search, issue search, file content, commit history, file blame | [README](../../pkg/tool/github/README.md) |
 | Microsoft Intune | Device compliance, sign-in history | [README](../../pkg/tool/intune/README.md) |
+| CrowdStrike Falcon | EDR incidents, alerts, behaviors, devices, CrowdScores, telemetry events | [README](../../pkg/tool/falcon/README.md) |
+| BigQuery | Query security log data with SQL and runbooks | [configuration](../reference/configuration.md#bigquery-tool) |
+| Jira | List projects, search issues via JQL, fetch issue content | [README](../../pkg/tool/jira/README.md) |
 
 ### Other Tools
 
@@ -151,16 +154,6 @@ Warren's AI agent has access to the following tools during investigation. Tools
 | Knowledge | Save/retrieve investigation knowledge | [README](../../pkg/tool/knowledge/README.md) |
 | WebFetch | Fetch a web page and return Markdown (with indirect-prompt-injection screening) | [README](../../pkg/tool/webfetch/README.md) |
 
-## Sub-Agents
-
-Sub-agents are specialized AI agents that handle complex, multi-step operations. The main agent delegates to them when needed.
-
-| Sub-Agent | Description | Details |
-|-----------|-------------|---------|
-| BigQuery Agent | Query security log data via natural language | [README](../../pkg/agents/bigquery/README.md) |
-| CrowdStrike Falcon Agent | Query EDR incidents, alerts, and events | [README](../../pkg/agents/falcon/README.md) |
-| Slack Search Agent | Search Slack messages for context | [README](../../pkg/agents/slack/README.md) |
-
 ## Chat Strategy
 
 Warren uses the `aster` chat execution strategy by default. It parallelizes independent tasks for faster multi-tool investigations.