nox-openclaw-hunter 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +140 -0
- package/bin/nox.js +2 -0
- package/dist/branding.d.ts +39 -0
- package/dist/branding.d.ts.map +1 -0
- package/dist/branding.js +66 -0
- package/dist/branding.js.map +1 -0
- package/dist/cli.d.ts +15 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +94 -0
- package/dist/cli.js.map +1 -0
- package/dist/commands/export.d.ts +21 -0
- package/dist/commands/export.d.ts.map +1 -0
- package/dist/commands/export.js +616 -0
- package/dist/commands/export.js.map +1 -0
- package/dist/commands/index.d.ts +8 -0
- package/dist/commands/index.d.ts.map +1 -0
- package/dist/commands/index.js +8 -0
- package/dist/commands/index.js.map +1 -0
- package/dist/commands/isolate.d.ts +30 -0
- package/dist/commands/isolate.d.ts.map +1 -0
- package/dist/commands/isolate.js +547 -0
- package/dist/commands/isolate.js.map +1 -0
- package/dist/commands/purge.d.ts +22 -0
- package/dist/commands/purge.d.ts.map +1 -0
- package/dist/commands/purge.js +295 -0
- package/dist/commands/purge.js.map +1 -0
- package/dist/commands/scan.d.ts +23 -0
- package/dist/commands/scan.d.ts.map +1 -0
- package/dist/commands/scan.js +155 -0
- package/dist/commands/scan.js.map +1 -0
- package/dist/detector/app-bundle.d.ts +13 -0
- package/dist/detector/app-bundle.d.ts.map +1 -0
- package/dist/detector/app-bundle.js +27 -0
- package/dist/detector/app-bundle.js.map +1 -0
- package/dist/detector/cli-binary.d.ts +12 -0
- package/dist/detector/cli-binary.d.ts.map +1 -0
- package/dist/detector/cli-binary.js +66 -0
- package/dist/detector/cli-binary.js.map +1 -0
- package/dist/detector/config.d.ts +21 -0
- package/dist/detector/config.d.ts.map +1 -0
- package/dist/detector/config.js +337 -0
- package/dist/detector/config.js.map +1 -0
- package/dist/detector/detection-config.d.ts +24 -0
- package/dist/detector/detection-config.d.ts.map +1 -0
- package/dist/detector/detection-config.js +242 -0
- package/dist/detector/detection-config.js.map +1 -0
- package/dist/detector/docker.d.ts +10 -0
- package/dist/detector/docker.d.ts.map +1 -0
- package/dist/detector/docker.js +94 -0
- package/dist/detector/docker.js.map +1 -0
- package/dist/detector/index.d.ts +50 -0
- package/dist/detector/index.d.ts.map +1 -0
- package/dist/detector/index.js +155 -0
- package/dist/detector/index.js.map +1 -0
- package/dist/detector/network.d.ts +34 -0
- package/dist/detector/network.d.ts.map +1 -0
- package/dist/detector/network.js +205 -0
- package/dist/detector/network.js.map +1 -0
- package/dist/detector/process.d.ts +16 -0
- package/dist/detector/process.d.ts.map +1 -0
- package/dist/detector/process.js +47 -0
- package/dist/detector/process.js.map +1 -0
- package/dist/detector/service.d.ts +17 -0
- package/dist/detector/service.d.ts.map +1 -0
- package/dist/detector/service.js +51 -0
- package/dist/detector/service.js.map +1 -0
- package/dist/enforcer/docker-cleaner.d.ts +30 -0
- package/dist/enforcer/docker-cleaner.d.ts.map +1 -0
- package/dist/enforcer/docker-cleaner.js +163 -0
- package/dist/enforcer/docker-cleaner.js.map +1 -0
- package/dist/enforcer/file-remover.d.ts +34 -0
- package/dist/enforcer/file-remover.d.ts.map +1 -0
- package/dist/enforcer/file-remover.js +137 -0
- package/dist/enforcer/file-remover.js.map +1 -0
- package/dist/enforcer/index.d.ts +33 -0
- package/dist/enforcer/index.d.ts.map +1 -0
- package/dist/enforcer/index.js +142 -0
- package/dist/enforcer/index.js.map +1 -0
- package/dist/enforcer/process-killer.d.ts +18 -0
- package/dist/enforcer/process-killer.d.ts.map +1 -0
- package/dist/enforcer/process-killer.js +80 -0
- package/dist/enforcer/process-killer.js.map +1 -0
- package/dist/enforcer/service-stopper.d.ts +23 -0
- package/dist/enforcer/service-stopper.d.ts.map +1 -0
- package/dist/enforcer/service-stopper.js +95 -0
- package/dist/enforcer/service-stopper.js.map +1 -0
- package/dist/index.d.ts +6 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +10 -0
- package/dist/index.js.map +1 -0
- package/dist/isolator/firewall.d.ts +25 -0
- package/dist/isolator/firewall.d.ts.map +1 -0
- package/dist/isolator/firewall.js +114 -0
- package/dist/isolator/firewall.js.map +1 -0
- package/dist/isolator/index.d.ts +63 -0
- package/dist/isolator/index.d.ts.map +1 -0
- package/dist/isolator/index.js +201 -0
- package/dist/isolator/index.js.map +1 -0
- package/dist/isolator/lockdown.d.ts +22 -0
- package/dist/isolator/lockdown.d.ts.map +1 -0
- package/dist/isolator/lockdown.js +401 -0
- package/dist/isolator/lockdown.js.map +1 -0
- package/dist/isolator/quarantine.d.ts +39 -0
- package/dist/isolator/quarantine.d.ts.map +1 -0
- package/dist/isolator/quarantine.js +364 -0
- package/dist/isolator/quarantine.js.map +1 -0
- package/dist/mdm/index.d.ts +93 -0
- package/dist/mdm/index.d.ts.map +1 -0
- package/dist/mdm/index.js +414 -0
- package/dist/mdm/index.js.map +1 -0
- package/dist/mdm/intune.d.ts +69 -0
- package/dist/mdm/intune.d.ts.map +1 -0
- package/dist/mdm/intune.js +409 -0
- package/dist/mdm/intune.js.map +1 -0
- package/dist/mdm/jamf.d.ts +58 -0
- package/dist/mdm/jamf.d.ts.map +1 -0
- package/dist/mdm/jamf.js +441 -0
- package/dist/mdm/jamf.js.map +1 -0
- package/dist/mdm/jumpcloud.d.ts +73 -0
- package/dist/mdm/jumpcloud.d.ts.map +1 -0
- package/dist/mdm/jumpcloud.js +470 -0
- package/dist/mdm/jumpcloud.js.map +1 -0
- package/dist/mdm/templates/detect.ps1.d.ts +30 -0
- package/dist/mdm/templates/detect.ps1.d.ts.map +1 -0
- package/dist/mdm/templates/detect.ps1.js +463 -0
- package/dist/mdm/templates/detect.ps1.js.map +1 -0
- package/dist/mdm/templates/detect.sh.d.ts +30 -0
- package/dist/mdm/templates/detect.sh.d.ts.map +1 -0
- package/dist/mdm/templates/detect.sh.js +474 -0
- package/dist/mdm/templates/detect.sh.js.map +1 -0
- package/dist/mdm/templates/enforce.ps1.d.ts +33 -0
- package/dist/mdm/templates/enforce.ps1.d.ts.map +1 -0
- package/dist/mdm/templates/enforce.ps1.js +681 -0
- package/dist/mdm/templates/enforce.ps1.js.map +1 -0
- package/dist/mdm/templates/enforce.sh.d.ts +33 -0
- package/dist/mdm/templates/enforce.sh.d.ts.map +1 -0
- package/dist/mdm/templates/enforce.sh.js +591 -0
- package/dist/mdm/templates/enforce.sh.js.map +1 -0
- package/dist/platform/darwin.d.ts +6 -0
- package/dist/platform/darwin.d.ts.map +1 -0
- package/dist/platform/darwin.js +192 -0
- package/dist/platform/darwin.js.map +1 -0
- package/dist/platform/index.d.ts +43 -0
- package/dist/platform/index.d.ts.map +1 -0
- package/dist/platform/index.js +27 -0
- package/dist/platform/index.js.map +1 -0
- package/dist/platform/linux.d.ts +6 -0
- package/dist/platform/linux.d.ts.map +1 -0
- package/dist/platform/linux.js +134 -0
- package/dist/platform/linux.js.map +1 -0
- package/dist/platform/windows.d.ts +6 -0
- package/dist/platform/windows.d.ts.map +1 -0
- package/dist/platform/windows.js +134 -0
- package/dist/platform/windows.js.map +1 -0
- package/dist/reporter/console.d.ts +27 -0
- package/dist/reporter/console.d.ts.map +1 -0
- package/dist/reporter/console.js +431 -0
- package/dist/reporter/console.js.map +1 -0
- package/dist/reporter/index.d.ts +11 -0
- package/dist/reporter/index.d.ts.map +1 -0
- package/dist/reporter/index.js +13 -0
- package/dist/reporter/index.js.map +1 -0
- package/dist/reporter/json.d.ts +61 -0
- package/dist/reporter/json.d.ts.map +1 -0
- package/dist/reporter/json.js +75 -0
- package/dist/reporter/json.js.map +1 -0
- package/dist/reporter/webhook.d.ts +57 -0
- package/dist/reporter/webhook.d.ts.map +1 -0
- package/dist/reporter/webhook.js +230 -0
- package/dist/reporter/webhook.js.map +1 -0
- package/dist/types/config.d.ts +116 -0
- package/dist/types/config.d.ts.map +1 -0
- package/dist/types/config.js +6 -0
- package/dist/types/config.js.map +1 -0
- package/dist/types/detection.d.ts +85 -0
- package/dist/types/detection.d.ts.map +1 -0
- package/dist/types/detection.js +5 -0
- package/dist/types/detection.js.map +1 -0
- package/dist/types/enforcement.d.ts +33 -0
- package/dist/types/enforcement.d.ts.map +1 -0
- package/dist/types/enforcement.js +5 -0
- package/dist/types/enforcement.js.map +1 -0
- package/dist/types/index.d.ts +8 -0
- package/dist/types/index.d.ts.map +1 -0
- package/dist/types/index.js +8 -0
- package/dist/types/index.js.map +1 -0
- package/dist/types/isolation.d.ts +55 -0
- package/dist/types/isolation.d.ts.map +1 -0
- package/dist/types/isolation.js +5 -0
- package/dist/types/isolation.js.map +1 -0
- package/dist/utils/exec.d.ts +48 -0
- package/dist/utils/exec.d.ts.map +1 -0
- package/dist/utils/exec.js +103 -0
- package/dist/utils/exec.js.map +1 -0
- package/dist/utils/fs.d.ts +34 -0
- package/dist/utils/fs.d.ts.map +1 -0
- package/dist/utils/fs.js +111 -0
- package/dist/utils/fs.js.map +1 -0
- package/dist/utils/index.d.ts +7 -0
- package/dist/utils/index.d.ts.map +1 -0
- package/dist/utils/index.js +7 -0
- package/dist/utils/index.js.map +1 -0
- package/dist/utils/logger.d.ts +14 -0
- package/dist/utils/logger.d.ts.map +1 -0
- package/dist/utils/logger.js +48 -0
- package/dist/utils/logger.js.map +1 -0
- package/docs/intune.md +390 -0
- package/docs/jamf.md +400 -0
- package/docs/jumpcloud.md +510 -0
- package/package.json +65 -0
|
@@ -0,0 +1,470 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* JumpCloud MDM integration module.
|
|
3
|
+
* Generates JumpCloud-specific deployment scripts and documentation.
|
|
4
|
+
*/
|
|
5
|
+
import { VERSION, COMPANY } from '../branding.js';
|
|
6
|
+
import { generateDetectShellScript, } from './templates/detect.sh.js';
|
|
7
|
+
import { generateDetectPowerShellScript, } from './templates/detect.ps1.js';
|
|
8
|
+
import { generateEnforceShellScript, } from './templates/enforce.sh.js';
|
|
9
|
+
import { generateEnforcePowerShellScript, } from './templates/enforce.ps1.js';
|
|
10
|
+
/**
|
|
11
|
+
* Generate JumpCloud-formatted macOS/Linux detection command.
|
|
12
|
+
*/
|
|
13
|
+
export function generateJumpCloudUnixDetectCommand(options = {}, platform = 'mac') {
|
|
14
|
+
const scriptOptions = {
|
|
15
|
+
webhookUrl: options.webhookUrl,
|
|
16
|
+
webhookToken: options.webhookToken,
|
|
17
|
+
gatewayPort: options.gatewayPort,
|
|
18
|
+
verbose: options.verbose,
|
|
19
|
+
};
|
|
20
|
+
const script = generateDetectShellScript(scriptOptions);
|
|
21
|
+
return {
|
|
22
|
+
name: `Nox OpenClaw Detection (${platform === 'mac' ? 'macOS' : 'Linux'})`,
|
|
23
|
+
command: script,
|
|
24
|
+
commandType: platform,
|
|
25
|
+
shell: '/bin/bash',
|
|
26
|
+
user: 'root',
|
|
27
|
+
sudo: true,
|
|
28
|
+
timeout: 120,
|
|
29
|
+
launchType: 'trigger',
|
|
30
|
+
trigger: 'nox-openclaw-detect',
|
|
31
|
+
scheduleRepeatType: 'day',
|
|
32
|
+
};
|
|
33
|
+
}
|
|
34
|
+
/**
|
|
35
|
+
* Generate JumpCloud-formatted macOS/Linux enforcement command.
|
|
36
|
+
*/
|
|
37
|
+
export function generateJumpCloudUnixEnforceCommand(options = {}, platform = 'mac') {
|
|
38
|
+
const scriptOptions = {
|
|
39
|
+
webhookUrl: options.webhookUrl,
|
|
40
|
+
webhookToken: options.webhookToken,
|
|
41
|
+
gatewayPort: options.gatewayPort,
|
|
42
|
+
verbose: options.verbose,
|
|
43
|
+
quarantine: options.quarantine,
|
|
44
|
+
};
|
|
45
|
+
const script = generateEnforceShellScript(scriptOptions);
|
|
46
|
+
return {
|
|
47
|
+
name: `Nox OpenClaw Enforcement (${platform === 'mac' ? 'macOS' : 'Linux'})`,
|
|
48
|
+
command: script,
|
|
49
|
+
commandType: platform,
|
|
50
|
+
shell: '/bin/bash',
|
|
51
|
+
user: 'root',
|
|
52
|
+
sudo: true,
|
|
53
|
+
timeout: 300,
|
|
54
|
+
launchType: 'manual',
|
|
55
|
+
};
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* Generate JumpCloud-formatted Windows detection command.
|
|
59
|
+
*/
|
|
60
|
+
export function generateJumpCloudWindowsDetectCommand(options = {}) {
|
|
61
|
+
const scriptOptions = {
|
|
62
|
+
webhookUrl: options.webhookUrl,
|
|
63
|
+
webhookToken: options.webhookToken,
|
|
64
|
+
gatewayPort: options.gatewayPort,
|
|
65
|
+
verbose: options.verbose,
|
|
66
|
+
};
|
|
67
|
+
const script = generateDetectPowerShellScript(scriptOptions);
|
|
68
|
+
return {
|
|
69
|
+
name: 'Nox OpenClaw Detection (Windows)',
|
|
70
|
+
command: script,
|
|
71
|
+
commandType: 'windows',
|
|
72
|
+
shell: 'powershell',
|
|
73
|
+
user: 'root', // JumpCloud uses 'root' to mean SYSTEM on Windows
|
|
74
|
+
sudo: true,
|
|
75
|
+
timeout: 120,
|
|
76
|
+
launchType: 'trigger',
|
|
77
|
+
trigger: 'nox-openclaw-detect',
|
|
78
|
+
scheduleRepeatType: 'day',
|
|
79
|
+
};
|
|
80
|
+
}
|
|
81
|
+
/**
|
|
82
|
+
* Generate JumpCloud-formatted Windows enforcement command.
|
|
83
|
+
*/
|
|
84
|
+
export function generateJumpCloudWindowsEnforceCommand(options = {}) {
|
|
85
|
+
const scriptOptions = {
|
|
86
|
+
webhookUrl: options.webhookUrl,
|
|
87
|
+
webhookToken: options.webhookToken,
|
|
88
|
+
gatewayPort: options.gatewayPort,
|
|
89
|
+
verbose: options.verbose,
|
|
90
|
+
quarantine: options.quarantine,
|
|
91
|
+
};
|
|
92
|
+
const script = generateEnforcePowerShellScript(scriptOptions);
|
|
93
|
+
return {
|
|
94
|
+
name: 'Nox OpenClaw Enforcement (Windows)',
|
|
95
|
+
command: script,
|
|
96
|
+
commandType: 'windows',
|
|
97
|
+
shell: 'powershell',
|
|
98
|
+
user: 'root',
|
|
99
|
+
sudo: true,
|
|
100
|
+
timeout: 300,
|
|
101
|
+
launchType: 'manual',
|
|
102
|
+
};
|
|
103
|
+
}
|
|
104
|
+
/**
|
|
105
|
+
* Generate JumpCloud API payload for command creation.
|
|
106
|
+
*/
|
|
107
|
+
export function generateJumpCloudApiPayload(command) {
|
|
108
|
+
return {
|
|
109
|
+
name: command.name,
|
|
110
|
+
command: command.command,
|
|
111
|
+
commandType: command.commandType,
|
|
112
|
+
shell: command.shell,
|
|
113
|
+
user: command.user,
|
|
114
|
+
sudo: command.sudo,
|
|
115
|
+
timeout: `${command.timeout}`,
|
|
116
|
+
launchType: command.launchType,
|
|
117
|
+
trigger: command.trigger,
|
|
118
|
+
scheduleRepeatType: command.scheduleRepeatType,
|
|
119
|
+
// Additional JumpCloud-specific fields
|
|
120
|
+
files: command.files || [],
|
|
121
|
+
commandRunners: [],
|
|
122
|
+
systems: [],
|
|
123
|
+
systemGroups: [],
|
|
124
|
+
};
|
|
125
|
+
}
|
|
126
|
+
/**
|
|
127
|
+
* Generate JumpCloud System Insights custom fact script.
|
|
128
|
+
*/
|
|
129
|
+
export function generateJumpCloudSystemInsightsFact() {
|
|
130
|
+
return `#!/bin/bash
|
|
131
|
+
# ==============================================================================
|
|
132
|
+
# Nox OpenClaw Detection - JumpCloud System Insights Custom Fact
|
|
133
|
+
# ==============================================================================
|
|
134
|
+
# Generated by nox-openclaw-detector v${VERSION}
|
|
135
|
+
# ${COMPANY} - https://nox.security
|
|
136
|
+
#
|
|
137
|
+
# This script creates a custom fact for JumpCloud System Insights
|
|
138
|
+
# to report OpenClaw installation status.
|
|
139
|
+
#
|
|
140
|
+
# Fact Name: nox_openclaw_status
|
|
141
|
+
# Values: not_installed, installed, running
|
|
142
|
+
# ==============================================================================
|
|
143
|
+
|
|
144
|
+
# Determine status
|
|
145
|
+
STATUS="not_installed"
|
|
146
|
+
|
|
147
|
+
# Check CLI binary
|
|
148
|
+
if command -v openclaw &>/dev/null; then
|
|
149
|
+
STATUS="installed"
|
|
150
|
+
fi
|
|
151
|
+
|
|
152
|
+
# Check common paths
|
|
153
|
+
for path in /usr/local/bin/openclaw /opt/homebrew/bin/openclaw /usr/bin/openclaw; do
|
|
154
|
+
if [[ -f "$path" ]]; then
|
|
155
|
+
STATUS="installed"
|
|
156
|
+
break
|
|
157
|
+
fi
|
|
158
|
+
done
|
|
159
|
+
|
|
160
|
+
# Check app bundle (macOS)
|
|
161
|
+
if [[ -d "/Applications/OpenClaw.app" ]]; then
|
|
162
|
+
STATUS="installed"
|
|
163
|
+
fi
|
|
164
|
+
|
|
165
|
+
# Check config directory
|
|
166
|
+
if [[ -d "$HOME/.openclaw" ]] || [[ -d "/Users/"*"/.openclaw" ]] || [[ -d "/home/"*"/.openclaw" ]]; then
|
|
167
|
+
STATUS="installed"
|
|
168
|
+
fi
|
|
169
|
+
|
|
170
|
+
# Check if running
|
|
171
|
+
if pgrep -f "openclaw" > /dev/null 2>&1; then
|
|
172
|
+
STATUS="running"
|
|
173
|
+
fi
|
|
174
|
+
|
|
175
|
+
# Check gateway port
|
|
176
|
+
if command -v nc &>/dev/null && nc -z localhost 18789 2>/dev/null; then
|
|
177
|
+
STATUS="running"
|
|
178
|
+
fi
|
|
179
|
+
|
|
180
|
+
# Output for JumpCloud System Insights
|
|
181
|
+
echo "$STATUS"
|
|
182
|
+
`;
|
|
183
|
+
}
|
|
184
|
+
/**
|
|
185
|
+
* Generate JumpCloud deployment documentation.
|
|
186
|
+
*/
|
|
187
|
+
export function generateJumpCloudDocumentation() {
|
|
188
|
+
return `# JumpCloud Integration Guide
|
|
189
|
+
|
|
190
|
+
## Overview
|
|
191
|
+
|
|
192
|
+
This guide explains how to deploy Nox OpenClaw detection and enforcement scripts via JumpCloud for fleet-wide management of Windows, macOS, and Linux devices.
|
|
193
|
+
|
|
194
|
+
Generated by nox-openclaw-detector v${VERSION}
|
|
195
|
+
${COMPANY} - https://nox.security
|
|
196
|
+
|
|
197
|
+
## Prerequisites
|
|
198
|
+
|
|
199
|
+
- JumpCloud account with Device Management
|
|
200
|
+
- JumpCloud agent installed on managed devices
|
|
201
|
+
- Admin access to JumpCloud console
|
|
202
|
+
- Devices enrolled in JumpCloud
|
|
203
|
+
|
|
204
|
+
## Quick Start
|
|
205
|
+
|
|
206
|
+
1. Create commands in JumpCloud
|
|
207
|
+
2. Assign to device groups
|
|
208
|
+
3. Set up triggers or schedules
|
|
209
|
+
4. Monitor results via Commands Results
|
|
210
|
+
|
|
211
|
+
## Command Setup
|
|
212
|
+
|
|
213
|
+
### Step 1: Add Detection Command (macOS/Linux)
|
|
214
|
+
|
|
215
|
+
1. Navigate to **Device Management > Commands**
|
|
216
|
+
2. Click **+** (Add Command)
|
|
217
|
+
3. Configure:
|
|
218
|
+
- **Name:** Nox OpenClaw Detection (macOS)
|
|
219
|
+
- **Command:** Paste shell script content
|
|
220
|
+
- **Command Type:** Mac (or Linux)
|
|
221
|
+
- **Run As:** Root
|
|
222
|
+
- **Timeout:** 120 seconds
|
|
223
|
+
4. Under **Launch Options:**
|
|
224
|
+
- **Launch Type:** Trigger
|
|
225
|
+
- **Trigger Name:** nox-openclaw-detect
|
|
226
|
+
- **Schedule:** Repeat Daily (optional)
|
|
227
|
+
5. Click **Save**
|
|
228
|
+
|
|
229
|
+
### Step 2: Add Detection Command (Windows)
|
|
230
|
+
|
|
231
|
+
1. Navigate to **Device Management > Commands**
|
|
232
|
+
2. Click **+** (Add Command)
|
|
233
|
+
3. Configure:
|
|
234
|
+
- **Name:** Nox OpenClaw Detection (Windows)
|
|
235
|
+
- **Command:** Paste PowerShell script content
|
|
236
|
+
- **Command Type:** Windows
|
|
237
|
+
- **Shell:** PowerShell
|
|
238
|
+
- **Run As:** Administrator
|
|
239
|
+
- **Timeout:** 120 seconds
|
|
240
|
+
4. Under **Launch Options:**
|
|
241
|
+
- **Launch Type:** Trigger
|
|
242
|
+
- **Trigger Name:** nox-openclaw-detect
|
|
243
|
+
- **Schedule:** Repeat Daily (optional)
|
|
244
|
+
5. Click **Save**
|
|
245
|
+
|
|
246
|
+
### Step 3: Add Enforcement Commands
|
|
247
|
+
|
|
248
|
+
Repeat the above steps for enforcement scripts:
|
|
249
|
+
- Use longer timeout (300 seconds)
|
|
250
|
+
- Set Launch Type to Manual (for on-demand remediation)
|
|
251
|
+
- Or set up triggers for automated remediation
|
|
252
|
+
|
|
253
|
+
### Step 4: Assign to Device Groups
|
|
254
|
+
|
|
255
|
+
1. Open the command
|
|
256
|
+
2. Click **Device Groups** tab
|
|
257
|
+
3. Select target groups
|
|
258
|
+
4. Click **Save**
|
|
259
|
+
|
|
260
|
+
Or assign to individual systems:
|
|
261
|
+
1. Click **Systems** tab
|
|
262
|
+
2. Select target systems
|
|
263
|
+
3. Click **Save**
|
|
264
|
+
|
|
265
|
+
## Automated Workflows
|
|
266
|
+
|
|
267
|
+
### Scheduled Detection
|
|
268
|
+
|
|
269
|
+
Run detection daily across your fleet:
|
|
270
|
+
|
|
271
|
+
1. Set command Launch Type to **Trigger + Repeat**
|
|
272
|
+
2. Configure Schedule:
|
|
273
|
+
- Repeat Type: Day
|
|
274
|
+
- Repeat Interval: 1
|
|
275
|
+
- Scheduled Time: 02:00 (off-hours recommended)
|
|
276
|
+
|
|
277
|
+
### Event-Based Remediation
|
|
278
|
+
|
|
279
|
+
Use JumpCloud's API to trigger remediation when detection finds OpenClaw:
|
|
280
|
+
|
|
281
|
+
\`\`\`bash
|
|
282
|
+
# Trigger remediation via API
|
|
283
|
+
curl -X POST "https://console.jumpcloud.com/api/command/trigger/nox-openclaw-enforce" \\
|
|
284
|
+
-H "x-api-key: YOUR_API_KEY" \\
|
|
285
|
+
-H "Content-Type: application/json" \\
|
|
286
|
+
-d '{"systemIds": ["system_id_here"]}'
|
|
287
|
+
\`\`\`
|
|
288
|
+
|
|
289
|
+
### Webhook Integration
|
|
290
|
+
|
|
291
|
+
The scripts can send results to your SIEM. Configure webhook URL and token in the script before uploading:
|
|
292
|
+
|
|
293
|
+
1. Edit script content
|
|
294
|
+
2. Set WEBHOOK_URL and WEBHOOK_TOKEN variables
|
|
295
|
+
3. Save and deploy
|
|
296
|
+
|
|
297
|
+
## System Insights Integration
|
|
298
|
+
|
|
299
|
+
### Add Custom Fact
|
|
300
|
+
|
|
301
|
+
Use System Insights to track OpenClaw status across your fleet:
|
|
302
|
+
|
|
303
|
+
1. Navigate to **Device Management > Commands**
|
|
304
|
+
2. Create a new command with the System Insights fact script
|
|
305
|
+
3. Configure:
|
|
306
|
+
- **Name:** Nox OpenClaw Status Fact
|
|
307
|
+
- **Run As:** Root
|
|
308
|
+
- **Schedule:** Repeat Daily
|
|
309
|
+
4. Assign to all devices
|
|
310
|
+
|
|
311
|
+
### Query via System Insights
|
|
312
|
+
|
|
313
|
+
Once the fact is populated, query via JumpCloud console or API:
|
|
314
|
+
|
|
315
|
+
\`\`\`bash
|
|
316
|
+
# Query systems with OpenClaw installed
|
|
317
|
+
curl -X POST "https://console.jumpcloud.com/api/v2/systeminsights/query" \\
|
|
318
|
+
-H "x-api-key: YOUR_API_KEY" \\
|
|
319
|
+
-H "Content-Type: application/json" \\
|
|
320
|
+
-d '{
|
|
321
|
+
"query": "SELECT * FROM system_info WHERE nox_openclaw_status = \"installed\""
|
|
322
|
+
}'
|
|
323
|
+
\`\`\`
|
|
324
|
+
|
|
325
|
+
## Monitoring Results
|
|
326
|
+
|
|
327
|
+
### Command Results
|
|
328
|
+
|
|
329
|
+
1. Navigate to **Device Management > Commands**
|
|
330
|
+
2. Click on a command
|
|
331
|
+
3. Select **Results** tab
|
|
332
|
+
4. Filter by:
|
|
333
|
+
- Exit Code
|
|
334
|
+
- Date Range
|
|
335
|
+
- System
|
|
336
|
+
|
|
337
|
+
### Exit Codes
|
|
338
|
+
|
|
339
|
+
| Code | Detection Meaning | Enforcement Meaning |
|
|
340
|
+
|------|------------------|---------------------|
|
|
341
|
+
| 0 | Not detected | Enforcement successful |
|
|
342
|
+
| 1 | Detected | Enforcement partially failed |
|
|
343
|
+
| 2 | Script error | Script error |
|
|
344
|
+
| 3 | N/A | Nothing to enforce |
|
|
345
|
+
|
|
346
|
+
### Create Alerts
|
|
347
|
+
|
|
348
|
+
Set up webhook notifications for command failures:
|
|
349
|
+
|
|
350
|
+
1. Navigate to **Settings > Webhooks**
|
|
351
|
+
2. Add webhook URL
|
|
352
|
+
3. Select events:
|
|
353
|
+
- Command results
|
|
354
|
+
- Specific exit codes
|
|
355
|
+
|
|
356
|
+
## API Integration
|
|
357
|
+
|
|
358
|
+
### Create Command via API
|
|
359
|
+
|
|
360
|
+
\`\`\`bash
|
|
361
|
+
curl -X POST "https://console.jumpcloud.com/api/commands" \\
|
|
362
|
+
-H "x-api-key: YOUR_API_KEY" \\
|
|
363
|
+
-H "Content-Type: application/json" \\
|
|
364
|
+
-d '{
|
|
365
|
+
"name": "Nox OpenClaw Detection",
|
|
366
|
+
"command": "#!/bin/bash\\n# Script content here...",
|
|
367
|
+
"commandType": "mac",
|
|
368
|
+
"shell": "/bin/bash",
|
|
369
|
+
"user": "root",
|
|
370
|
+
"sudo": true,
|
|
371
|
+
"timeout": "120",
|
|
372
|
+
"launchType": "trigger",
|
|
373
|
+
"trigger": "nox-openclaw-detect"
|
|
374
|
+
}'
|
|
375
|
+
\`\`\`
|
|
376
|
+
|
|
377
|
+
### Run Command on Demand
|
|
378
|
+
|
|
379
|
+
\`\`\`bash
|
|
380
|
+
# Run on specific systems
|
|
381
|
+
curl -X POST "https://console.jumpcloud.com/api/commands/{command_id}/run" \\
|
|
382
|
+
-H "x-api-key: YOUR_API_KEY" \\
|
|
383
|
+
-H "Content-Type: application/json" \\
|
|
384
|
+
-d '{"systems": ["system_id_1", "system_id_2"]}'
|
|
385
|
+
\`\`\`
|
|
386
|
+
|
|
387
|
+
### Get Command Results
|
|
388
|
+
|
|
389
|
+
\`\`\`bash
|
|
390
|
+
curl -X GET "https://console.jumpcloud.com/api/commands/{command_id}/results" \\
|
|
391
|
+
-H "x-api-key: YOUR_API_KEY" \\
|
|
392
|
+
-H "Content-Type: application/json"
|
|
393
|
+
\`\`\`
|
|
394
|
+
|
|
395
|
+
## Device Groups for Targeting
|
|
396
|
+
|
|
397
|
+
Create device groups for OpenClaw management:
|
|
398
|
+
|
|
399
|
+
### All Managed Devices
|
|
400
|
+
- Include all systems for detection
|
|
401
|
+
|
|
402
|
+
### OpenClaw Detected
|
|
403
|
+
- Dynamic group based on command exit codes
|
|
404
|
+
- Use for targeted remediation
|
|
405
|
+
|
|
406
|
+
### High-Risk Devices
|
|
407
|
+
- Combine with other security criteria
|
|
408
|
+
- Priority for immediate enforcement
|
|
409
|
+
|
|
410
|
+
## Best Practices
|
|
411
|
+
|
|
412
|
+
1. **Start with detection only** - understand scope before enforcement
|
|
413
|
+
2. **Use device groups** - organize targeting by OS and risk level
|
|
414
|
+
3. **Schedule off-hours** - minimize user impact
|
|
415
|
+
4. **Monitor results** - review exit codes and outputs
|
|
416
|
+
5. **Test in pilot group** - validate before fleet-wide deployment
|
|
417
|
+
6. **Enable webhooks** - integrate with SIEM for alerting
|
|
418
|
+
|
|
419
|
+
## Troubleshooting
|
|
420
|
+
|
|
421
|
+
### Command Not Running
|
|
422
|
+
|
|
423
|
+
1. Verify JumpCloud agent is running on device
|
|
424
|
+
2. Check device group assignment
|
|
425
|
+
3. Verify trigger name if using triggers
|
|
426
|
+
4. Check agent logs:
|
|
427
|
+
- macOS/Linux: \`/var/log/jcagent.log\`
|
|
428
|
+
- Windows: \`C:\\Windows\\Temp\\jcagent.log\`
|
|
429
|
+
|
|
430
|
+
### Permission Errors
|
|
431
|
+
|
|
432
|
+
1. Verify command runs as root/Administrator
|
|
433
|
+
2. Check sudo is enabled
|
|
434
|
+
3. Verify script has correct permissions
|
|
435
|
+
|
|
436
|
+
### Timeout Issues
|
|
437
|
+
|
|
438
|
+
1. Increase timeout value (default 120s may be insufficient)
|
|
439
|
+
2. Check for hung processes
|
|
440
|
+
3. Simplify script if possible
|
|
441
|
+
|
|
442
|
+
## Support
|
|
443
|
+
|
|
444
|
+
For issues or questions:
|
|
445
|
+
- Email: support@nox.security
|
|
446
|
+
- Documentation: https://docs.nox.security/jumpcloud
|
|
447
|
+
`;
|
|
448
|
+
}
|
|
449
|
+
/**
|
|
450
|
+
* Get all JumpCloud exports.
|
|
451
|
+
*/
|
|
452
|
+
export function getJumpCloudExports(options = {}) {
|
|
453
|
+
return {
|
|
454
|
+
macDetectCommand: generateJumpCloudUnixDetectCommand(options, 'mac'),
|
|
455
|
+
macEnforceCommand: generateJumpCloudUnixEnforceCommand(options, 'mac'),
|
|
456
|
+
linuxDetectCommand: generateJumpCloudUnixDetectCommand(options, 'linux'),
|
|
457
|
+
linuxEnforceCommand: generateJumpCloudUnixEnforceCommand(options, 'linux'),
|
|
458
|
+
windowsDetectCommand: generateJumpCloudWindowsDetectCommand(options),
|
|
459
|
+
windowsEnforceCommand: generateJumpCloudWindowsEnforceCommand(options),
|
|
460
|
+
systemInsightsFact: generateJumpCloudSystemInsightsFact(),
|
|
461
|
+
documentation: generateJumpCloudDocumentation(),
|
|
462
|
+
metadata: {
|
|
463
|
+
platform: 'jumpcloud',
|
|
464
|
+
displayName: 'JumpCloud',
|
|
465
|
+
supportedOS: ['Windows', 'macOS', 'Linux'],
|
|
466
|
+
version: VERSION,
|
|
467
|
+
},
|
|
468
|
+
};
|
|
469
|
+
}
|
|
470
|
+
//# sourceMappingURL=jumpcloud.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"jumpcloud.js","sourceRoot":"","sources":["../../src/mdm/jumpcloud.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,yBAAyB,GAG1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,8BAA8B,GAG/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,GAG3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AAyBpC;;GAEG;AACH,MAAM,UAAU,kCAAkC,CAChD,UAAkC,EAAE,EACpC,WAA4B,KAAK;IAEjC,MAAM,aAAa,GAAuB;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAExD,OAAO;QACL,IAAI,EAAE,2BAA2B,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG;QAC1E,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC,CACjD,UAAkC,EAAE,EACpC,WAA4B,KAAK;IAEjC,MAAM,aAAa,GAAwB;QACzC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAG,0BAA0B,CAAC,aAAa,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,EAAE,6BAA6B,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG;QAC5E,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAAkC,EAAE;IAEpC,MAAM,aAAa,GAA4B;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,MAAM,MAAM,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;IAE7D,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,SAAS;QACtB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,MAAM,EAAE,kDAAkD;QAChE,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAAkC,EAAE;IAEpC,MAAM,aAAa,GAA6B;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAG,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,SAAS;QACtB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAyB;IACnE,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,uCAAuC;QACvC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,cAAc,EAAE,EAAE;QAClB,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC;IACjD,OAAO;;;;wCAI+B,OAAO;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CV,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO;;;;;;sCAM6B,OAAO;EAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4PR,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkC,EAAE;IACtE,OAAO;QACL,gBAAgB,EAAE,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC;QACpE,iBAAiB,EAAE,mCAAmC,CAAC,OAAO,EAAE,KAAK,CAAC;QACtE,kBAAkB,EAAE,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC;QACxE,mBAAmB,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,oBAAoB,EAAE,qCAAqC,CAAC,OAAO,CAAC;QACpE,qBAAqB,EAAE,sCAAsC,CAAC,OAAO,CAAC;QACtE,kBAAkB,EAAE,mCAAmC,EAAE;QACzD,aAAa,EAAE,8BAA8B,EAAE;QAC/C,QAAQ,EAAE;YACR,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;YAC1C,OAAO,EAAE,OAAO;SACjB;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* PowerShell detection script template for MDM deployment.
|
|
3
|
+
* Targets Windows systems.
|
|
4
|
+
*/
|
|
5
|
+
export interface DetectPowerShellOptions {
|
|
6
|
+
webhookUrl?: string;
|
|
7
|
+
webhookToken?: string;
|
|
8
|
+
gatewayPort?: number;
|
|
9
|
+
verbose?: boolean;
|
|
10
|
+
}
|
|
11
|
+
/**
|
|
12
|
+
* Generate detection PowerShell script.
|
|
13
|
+
*/
|
|
14
|
+
export declare function generateDetectPowerShellScript(options?: DetectPowerShellOptions): string;
|
|
15
|
+
/**
|
|
16
|
+
* Get script metadata for documentation.
|
|
17
|
+
*/
|
|
18
|
+
export declare function getDetectPowerShellMetadata(): {
|
|
19
|
+
filename: string;
|
|
20
|
+
extension: string;
|
|
21
|
+
platform: string;
|
|
22
|
+
description: string;
|
|
23
|
+
requirements: string[];
|
|
24
|
+
exitCodes: {
|
|
25
|
+
0: string;
|
|
26
|
+
1: string;
|
|
27
|
+
2: string;
|
|
28
|
+
};
|
|
29
|
+
};
|
|
30
|
+
//# sourceMappingURL=detect.ps1.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"detect.ps1.d.ts","sourceRoot":"","sources":["../../../src/mdm/templates/detect.ps1.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiCD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,GAAE,uBAA4B,GAAG,MAAM,CA2Z5F;AAED;;GAEG;AACH,wBAAgB,2BAA2B;;;;;;;;;;;EAa1C"}
|