nox-openclaw-hunter 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (211) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +140 -0
  3. package/bin/nox.js +2 -0
  4. package/dist/branding.d.ts +39 -0
  5. package/dist/branding.d.ts.map +1 -0
  6. package/dist/branding.js +66 -0
  7. package/dist/branding.js.map +1 -0
  8. package/dist/cli.d.ts +15 -0
  9. package/dist/cli.d.ts.map +1 -0
  10. package/dist/cli.js +94 -0
  11. package/dist/cli.js.map +1 -0
  12. package/dist/commands/export.d.ts +21 -0
  13. package/dist/commands/export.d.ts.map +1 -0
  14. package/dist/commands/export.js +616 -0
  15. package/dist/commands/export.js.map +1 -0
  16. package/dist/commands/index.d.ts +8 -0
  17. package/dist/commands/index.d.ts.map +1 -0
  18. package/dist/commands/index.js +8 -0
  19. package/dist/commands/index.js.map +1 -0
  20. package/dist/commands/isolate.d.ts +30 -0
  21. package/dist/commands/isolate.d.ts.map +1 -0
  22. package/dist/commands/isolate.js +547 -0
  23. package/dist/commands/isolate.js.map +1 -0
  24. package/dist/commands/purge.d.ts +22 -0
  25. package/dist/commands/purge.d.ts.map +1 -0
  26. package/dist/commands/purge.js +295 -0
  27. package/dist/commands/purge.js.map +1 -0
  28. package/dist/commands/scan.d.ts +23 -0
  29. package/dist/commands/scan.d.ts.map +1 -0
  30. package/dist/commands/scan.js +155 -0
  31. package/dist/commands/scan.js.map +1 -0
  32. package/dist/detector/app-bundle.d.ts +13 -0
  33. package/dist/detector/app-bundle.d.ts.map +1 -0
  34. package/dist/detector/app-bundle.js +27 -0
  35. package/dist/detector/app-bundle.js.map +1 -0
  36. package/dist/detector/cli-binary.d.ts +12 -0
  37. package/dist/detector/cli-binary.d.ts.map +1 -0
  38. package/dist/detector/cli-binary.js +66 -0
  39. package/dist/detector/cli-binary.js.map +1 -0
  40. package/dist/detector/config.d.ts +21 -0
  41. package/dist/detector/config.d.ts.map +1 -0
  42. package/dist/detector/config.js +337 -0
  43. package/dist/detector/config.js.map +1 -0
  44. package/dist/detector/detection-config.d.ts +24 -0
  45. package/dist/detector/detection-config.d.ts.map +1 -0
  46. package/dist/detector/detection-config.js +242 -0
  47. package/dist/detector/detection-config.js.map +1 -0
  48. package/dist/detector/docker.d.ts +10 -0
  49. package/dist/detector/docker.d.ts.map +1 -0
  50. package/dist/detector/docker.js +94 -0
  51. package/dist/detector/docker.js.map +1 -0
  52. package/dist/detector/index.d.ts +50 -0
  53. package/dist/detector/index.d.ts.map +1 -0
  54. package/dist/detector/index.js +155 -0
  55. package/dist/detector/index.js.map +1 -0
  56. package/dist/detector/network.d.ts +34 -0
  57. package/dist/detector/network.d.ts.map +1 -0
  58. package/dist/detector/network.js +205 -0
  59. package/dist/detector/network.js.map +1 -0
  60. package/dist/detector/process.d.ts +16 -0
  61. package/dist/detector/process.d.ts.map +1 -0
  62. package/dist/detector/process.js +47 -0
  63. package/dist/detector/process.js.map +1 -0
  64. package/dist/detector/service.d.ts +17 -0
  65. package/dist/detector/service.d.ts.map +1 -0
  66. package/dist/detector/service.js +51 -0
  67. package/dist/detector/service.js.map +1 -0
  68. package/dist/enforcer/docker-cleaner.d.ts +30 -0
  69. package/dist/enforcer/docker-cleaner.d.ts.map +1 -0
  70. package/dist/enforcer/docker-cleaner.js +163 -0
  71. package/dist/enforcer/docker-cleaner.js.map +1 -0
  72. package/dist/enforcer/file-remover.d.ts +34 -0
  73. package/dist/enforcer/file-remover.d.ts.map +1 -0
  74. package/dist/enforcer/file-remover.js +137 -0
  75. package/dist/enforcer/file-remover.js.map +1 -0
  76. package/dist/enforcer/index.d.ts +33 -0
  77. package/dist/enforcer/index.d.ts.map +1 -0
  78. package/dist/enforcer/index.js +142 -0
  79. package/dist/enforcer/index.js.map +1 -0
  80. package/dist/enforcer/process-killer.d.ts +18 -0
  81. package/dist/enforcer/process-killer.d.ts.map +1 -0
  82. package/dist/enforcer/process-killer.js +80 -0
  83. package/dist/enforcer/process-killer.js.map +1 -0
  84. package/dist/enforcer/service-stopper.d.ts +23 -0
  85. package/dist/enforcer/service-stopper.d.ts.map +1 -0
  86. package/dist/enforcer/service-stopper.js +95 -0
  87. package/dist/enforcer/service-stopper.js.map +1 -0
  88. package/dist/index.d.ts +6 -0
  89. package/dist/index.d.ts.map +1 -0
  90. package/dist/index.js +10 -0
  91. package/dist/index.js.map +1 -0
  92. package/dist/isolator/firewall.d.ts +25 -0
  93. package/dist/isolator/firewall.d.ts.map +1 -0
  94. package/dist/isolator/firewall.js +114 -0
  95. package/dist/isolator/firewall.js.map +1 -0
  96. package/dist/isolator/index.d.ts +63 -0
  97. package/dist/isolator/index.d.ts.map +1 -0
  98. package/dist/isolator/index.js +201 -0
  99. package/dist/isolator/index.js.map +1 -0
  100. package/dist/isolator/lockdown.d.ts +22 -0
  101. package/dist/isolator/lockdown.d.ts.map +1 -0
  102. package/dist/isolator/lockdown.js +401 -0
  103. package/dist/isolator/lockdown.js.map +1 -0
  104. package/dist/isolator/quarantine.d.ts +39 -0
  105. package/dist/isolator/quarantine.d.ts.map +1 -0
  106. package/dist/isolator/quarantine.js +364 -0
  107. package/dist/isolator/quarantine.js.map +1 -0
  108. package/dist/mdm/index.d.ts +93 -0
  109. package/dist/mdm/index.d.ts.map +1 -0
  110. package/dist/mdm/index.js +414 -0
  111. package/dist/mdm/index.js.map +1 -0
  112. package/dist/mdm/intune.d.ts +69 -0
  113. package/dist/mdm/intune.d.ts.map +1 -0
  114. package/dist/mdm/intune.js +409 -0
  115. package/dist/mdm/intune.js.map +1 -0
  116. package/dist/mdm/jamf.d.ts +58 -0
  117. package/dist/mdm/jamf.d.ts.map +1 -0
  118. package/dist/mdm/jamf.js +441 -0
  119. package/dist/mdm/jamf.js.map +1 -0
  120. package/dist/mdm/jumpcloud.d.ts +73 -0
  121. package/dist/mdm/jumpcloud.d.ts.map +1 -0
  122. package/dist/mdm/jumpcloud.js +470 -0
  123. package/dist/mdm/jumpcloud.js.map +1 -0
  124. package/dist/mdm/templates/detect.ps1.d.ts +30 -0
  125. package/dist/mdm/templates/detect.ps1.d.ts.map +1 -0
  126. package/dist/mdm/templates/detect.ps1.js +463 -0
  127. package/dist/mdm/templates/detect.ps1.js.map +1 -0
  128. package/dist/mdm/templates/detect.sh.d.ts +30 -0
  129. package/dist/mdm/templates/detect.sh.d.ts.map +1 -0
  130. package/dist/mdm/templates/detect.sh.js +474 -0
  131. package/dist/mdm/templates/detect.sh.js.map +1 -0
  132. package/dist/mdm/templates/enforce.ps1.d.ts +33 -0
  133. package/dist/mdm/templates/enforce.ps1.d.ts.map +1 -0
  134. package/dist/mdm/templates/enforce.ps1.js +681 -0
  135. package/dist/mdm/templates/enforce.ps1.js.map +1 -0
  136. package/dist/mdm/templates/enforce.sh.d.ts +33 -0
  137. package/dist/mdm/templates/enforce.sh.d.ts.map +1 -0
  138. package/dist/mdm/templates/enforce.sh.js +591 -0
  139. package/dist/mdm/templates/enforce.sh.js.map +1 -0
  140. package/dist/platform/darwin.d.ts +6 -0
  141. package/dist/platform/darwin.d.ts.map +1 -0
  142. package/dist/platform/darwin.js +192 -0
  143. package/dist/platform/darwin.js.map +1 -0
  144. package/dist/platform/index.d.ts +43 -0
  145. package/dist/platform/index.d.ts.map +1 -0
  146. package/dist/platform/index.js +27 -0
  147. package/dist/platform/index.js.map +1 -0
  148. package/dist/platform/linux.d.ts +6 -0
  149. package/dist/platform/linux.d.ts.map +1 -0
  150. package/dist/platform/linux.js +134 -0
  151. package/dist/platform/linux.js.map +1 -0
  152. package/dist/platform/windows.d.ts +6 -0
  153. package/dist/platform/windows.d.ts.map +1 -0
  154. package/dist/platform/windows.js +134 -0
  155. package/dist/platform/windows.js.map +1 -0
  156. package/dist/reporter/console.d.ts +27 -0
  157. package/dist/reporter/console.d.ts.map +1 -0
  158. package/dist/reporter/console.js +431 -0
  159. package/dist/reporter/console.js.map +1 -0
  160. package/dist/reporter/index.d.ts +11 -0
  161. package/dist/reporter/index.d.ts.map +1 -0
  162. package/dist/reporter/index.js +13 -0
  163. package/dist/reporter/index.js.map +1 -0
  164. package/dist/reporter/json.d.ts +61 -0
  165. package/dist/reporter/json.d.ts.map +1 -0
  166. package/dist/reporter/json.js +75 -0
  167. package/dist/reporter/json.js.map +1 -0
  168. package/dist/reporter/webhook.d.ts +57 -0
  169. package/dist/reporter/webhook.d.ts.map +1 -0
  170. package/dist/reporter/webhook.js +230 -0
  171. package/dist/reporter/webhook.js.map +1 -0
  172. package/dist/types/config.d.ts +116 -0
  173. package/dist/types/config.d.ts.map +1 -0
  174. package/dist/types/config.js +6 -0
  175. package/dist/types/config.js.map +1 -0
  176. package/dist/types/detection.d.ts +85 -0
  177. package/dist/types/detection.d.ts.map +1 -0
  178. package/dist/types/detection.js +5 -0
  179. package/dist/types/detection.js.map +1 -0
  180. package/dist/types/enforcement.d.ts +33 -0
  181. package/dist/types/enforcement.d.ts.map +1 -0
  182. package/dist/types/enforcement.js +5 -0
  183. package/dist/types/enforcement.js.map +1 -0
  184. package/dist/types/index.d.ts +8 -0
  185. package/dist/types/index.d.ts.map +1 -0
  186. package/dist/types/index.js +8 -0
  187. package/dist/types/index.js.map +1 -0
  188. package/dist/types/isolation.d.ts +55 -0
  189. package/dist/types/isolation.d.ts.map +1 -0
  190. package/dist/types/isolation.js +5 -0
  191. package/dist/types/isolation.js.map +1 -0
  192. package/dist/utils/exec.d.ts +48 -0
  193. package/dist/utils/exec.d.ts.map +1 -0
  194. package/dist/utils/exec.js +103 -0
  195. package/dist/utils/exec.js.map +1 -0
  196. package/dist/utils/fs.d.ts +34 -0
  197. package/dist/utils/fs.d.ts.map +1 -0
  198. package/dist/utils/fs.js +111 -0
  199. package/dist/utils/fs.js.map +1 -0
  200. package/dist/utils/index.d.ts +7 -0
  201. package/dist/utils/index.d.ts.map +1 -0
  202. package/dist/utils/index.js +7 -0
  203. package/dist/utils/index.js.map +1 -0
  204. package/dist/utils/logger.d.ts +14 -0
  205. package/dist/utils/logger.d.ts.map +1 -0
  206. package/dist/utils/logger.js +48 -0
  207. package/dist/utils/logger.js.map +1 -0
  208. package/docs/intune.md +390 -0
  209. package/docs/jamf.md +400 -0
  210. package/docs/jumpcloud.md +510 -0
  211. package/package.json +65 -0
@@ -0,0 +1,470 @@
1
+ /**
2
+ * JumpCloud MDM integration module.
3
+ * Generates JumpCloud-specific deployment scripts and documentation.
4
+ */
5
+ import { VERSION, COMPANY } from '../branding.js';
6
+ import { generateDetectShellScript, } from './templates/detect.sh.js';
7
+ import { generateDetectPowerShellScript, } from './templates/detect.ps1.js';
8
+ import { generateEnforceShellScript, } from './templates/enforce.sh.js';
9
+ import { generateEnforcePowerShellScript, } from './templates/enforce.ps1.js';
10
+ /**
11
+ * Generate JumpCloud-formatted macOS/Linux detection command.
12
+ */
13
+ export function generateJumpCloudUnixDetectCommand(options = {}, platform = 'mac') {
14
+ const scriptOptions = {
15
+ webhookUrl: options.webhookUrl,
16
+ webhookToken: options.webhookToken,
17
+ gatewayPort: options.gatewayPort,
18
+ verbose: options.verbose,
19
+ };
20
+ const script = generateDetectShellScript(scriptOptions);
21
+ return {
22
+ name: `Nox OpenClaw Detection (${platform === 'mac' ? 'macOS' : 'Linux'})`,
23
+ command: script,
24
+ commandType: platform,
25
+ shell: '/bin/bash',
26
+ user: 'root',
27
+ sudo: true,
28
+ timeout: 120,
29
+ launchType: 'trigger',
30
+ trigger: 'nox-openclaw-detect',
31
+ scheduleRepeatType: 'day',
32
+ };
33
+ }
34
+ /**
35
+ * Generate JumpCloud-formatted macOS/Linux enforcement command.
36
+ */
37
+ export function generateJumpCloudUnixEnforceCommand(options = {}, platform = 'mac') {
38
+ const scriptOptions = {
39
+ webhookUrl: options.webhookUrl,
40
+ webhookToken: options.webhookToken,
41
+ gatewayPort: options.gatewayPort,
42
+ verbose: options.verbose,
43
+ quarantine: options.quarantine,
44
+ };
45
+ const script = generateEnforceShellScript(scriptOptions);
46
+ return {
47
+ name: `Nox OpenClaw Enforcement (${platform === 'mac' ? 'macOS' : 'Linux'})`,
48
+ command: script,
49
+ commandType: platform,
50
+ shell: '/bin/bash',
51
+ user: 'root',
52
+ sudo: true,
53
+ timeout: 300,
54
+ launchType: 'manual',
55
+ };
56
+ }
57
+ /**
58
+ * Generate JumpCloud-formatted Windows detection command.
59
+ */
60
+ export function generateJumpCloudWindowsDetectCommand(options = {}) {
61
+ const scriptOptions = {
62
+ webhookUrl: options.webhookUrl,
63
+ webhookToken: options.webhookToken,
64
+ gatewayPort: options.gatewayPort,
65
+ verbose: options.verbose,
66
+ };
67
+ const script = generateDetectPowerShellScript(scriptOptions);
68
+ return {
69
+ name: 'Nox OpenClaw Detection (Windows)',
70
+ command: script,
71
+ commandType: 'windows',
72
+ shell: 'powershell',
73
+ user: 'root', // JumpCloud uses 'root' to mean SYSTEM on Windows
74
+ sudo: true,
75
+ timeout: 120,
76
+ launchType: 'trigger',
77
+ trigger: 'nox-openclaw-detect',
78
+ scheduleRepeatType: 'day',
79
+ };
80
+ }
81
+ /**
82
+ * Generate JumpCloud-formatted Windows enforcement command.
83
+ */
84
+ export function generateJumpCloudWindowsEnforceCommand(options = {}) {
85
+ const scriptOptions = {
86
+ webhookUrl: options.webhookUrl,
87
+ webhookToken: options.webhookToken,
88
+ gatewayPort: options.gatewayPort,
89
+ verbose: options.verbose,
90
+ quarantine: options.quarantine,
91
+ };
92
+ const script = generateEnforcePowerShellScript(scriptOptions);
93
+ return {
94
+ name: 'Nox OpenClaw Enforcement (Windows)',
95
+ command: script,
96
+ commandType: 'windows',
97
+ shell: 'powershell',
98
+ user: 'root',
99
+ sudo: true,
100
+ timeout: 300,
101
+ launchType: 'manual',
102
+ };
103
+ }
104
+ /**
105
+ * Generate JumpCloud API payload for command creation.
106
+ */
107
+ export function generateJumpCloudApiPayload(command) {
108
+ return {
109
+ name: command.name,
110
+ command: command.command,
111
+ commandType: command.commandType,
112
+ shell: command.shell,
113
+ user: command.user,
114
+ sudo: command.sudo,
115
+ timeout: `${command.timeout}`,
116
+ launchType: command.launchType,
117
+ trigger: command.trigger,
118
+ scheduleRepeatType: command.scheduleRepeatType,
119
+ // Additional JumpCloud-specific fields
120
+ files: command.files || [],
121
+ commandRunners: [],
122
+ systems: [],
123
+ systemGroups: [],
124
+ };
125
+ }
126
+ /**
127
+ * Generate JumpCloud System Insights custom fact script.
128
+ */
129
+ export function generateJumpCloudSystemInsightsFact() {
130
+ return `#!/bin/bash
131
+ # ==============================================================================
132
+ # Nox OpenClaw Detection - JumpCloud System Insights Custom Fact
133
+ # ==============================================================================
134
+ # Generated by nox-openclaw-detector v${VERSION}
135
+ # ${COMPANY} - https://nox.security
136
+ #
137
+ # This script creates a custom fact for JumpCloud System Insights
138
+ # to report OpenClaw installation status.
139
+ #
140
+ # Fact Name: nox_openclaw_status
141
+ # Values: not_installed, installed, running
142
+ # ==============================================================================
143
+
144
+ # Determine status
145
+ STATUS="not_installed"
146
+
147
+ # Check CLI binary
148
+ if command -v openclaw &>/dev/null; then
149
+ STATUS="installed"
150
+ fi
151
+
152
+ # Check common paths
153
+ for path in /usr/local/bin/openclaw /opt/homebrew/bin/openclaw /usr/bin/openclaw; do
154
+ if [[ -f "$path" ]]; then
155
+ STATUS="installed"
156
+ break
157
+ fi
158
+ done
159
+
160
+ # Check app bundle (macOS)
161
+ if [[ -d "/Applications/OpenClaw.app" ]]; then
162
+ STATUS="installed"
163
+ fi
164
+
165
+ # Check config directory
166
+ if [[ -d "$HOME/.openclaw" ]] || [[ -d "/Users/"*"/.openclaw" ]] || [[ -d "/home/"*"/.openclaw" ]]; then
167
+ STATUS="installed"
168
+ fi
169
+
170
+ # Check if running
171
+ if pgrep -f "openclaw" > /dev/null 2>&1; then
172
+ STATUS="running"
173
+ fi
174
+
175
+ # Check gateway port
176
+ if command -v nc &>/dev/null && nc -z localhost 18789 2>/dev/null; then
177
+ STATUS="running"
178
+ fi
179
+
180
+ # Output for JumpCloud System Insights
181
+ echo "$STATUS"
182
+ `;
183
+ }
184
+ /**
185
+ * Generate JumpCloud deployment documentation.
186
+ */
187
+ export function generateJumpCloudDocumentation() {
188
+ return `# JumpCloud Integration Guide
189
+
190
+ ## Overview
191
+
192
+ This guide explains how to deploy Nox OpenClaw detection and enforcement scripts via JumpCloud for fleet-wide management of Windows, macOS, and Linux devices.
193
+
194
+ Generated by nox-openclaw-detector v${VERSION}
195
+ ${COMPANY} - https://nox.security
196
+
197
+ ## Prerequisites
198
+
199
+ - JumpCloud account with Device Management
200
+ - JumpCloud agent installed on managed devices
201
+ - Admin access to JumpCloud console
202
+ - Devices enrolled in JumpCloud
203
+
204
+ ## Quick Start
205
+
206
+ 1. Create commands in JumpCloud
207
+ 2. Assign to device groups
208
+ 3. Set up triggers or schedules
209
+ 4. Monitor results via Commands Results
210
+
211
+ ## Command Setup
212
+
213
+ ### Step 1: Add Detection Command (macOS/Linux)
214
+
215
+ 1. Navigate to **Device Management > Commands**
216
+ 2. Click **+** (Add Command)
217
+ 3. Configure:
218
+ - **Name:** Nox OpenClaw Detection (macOS)
219
+ - **Command:** Paste shell script content
220
+ - **Command Type:** Mac (or Linux)
221
+ - **Run As:** Root
222
+ - **Timeout:** 120 seconds
223
+ 4. Under **Launch Options:**
224
+ - **Launch Type:** Trigger
225
+ - **Trigger Name:** nox-openclaw-detect
226
+ - **Schedule:** Repeat Daily (optional)
227
+ 5. Click **Save**
228
+
229
+ ### Step 2: Add Detection Command (Windows)
230
+
231
+ 1. Navigate to **Device Management > Commands**
232
+ 2. Click **+** (Add Command)
233
+ 3. Configure:
234
+ - **Name:** Nox OpenClaw Detection (Windows)
235
+ - **Command:** Paste PowerShell script content
236
+ - **Command Type:** Windows
237
+ - **Shell:** PowerShell
238
+ - **Run As:** Administrator
239
+ - **Timeout:** 120 seconds
240
+ 4. Under **Launch Options:**
241
+ - **Launch Type:** Trigger
242
+ - **Trigger Name:** nox-openclaw-detect
243
+ - **Schedule:** Repeat Daily (optional)
244
+ 5. Click **Save**
245
+
246
+ ### Step 3: Add Enforcement Commands
247
+
248
+ Repeat the above steps for enforcement scripts:
249
+ - Use longer timeout (300 seconds)
250
+ - Set Launch Type to Manual (for on-demand remediation)
251
+ - Or set up triggers for automated remediation
252
+
253
+ ### Step 4: Assign to Device Groups
254
+
255
+ 1. Open the command
256
+ 2. Click **Device Groups** tab
257
+ 3. Select target groups
258
+ 4. Click **Save**
259
+
260
+ Or assign to individual systems:
261
+ 1. Click **Systems** tab
262
+ 2. Select target systems
263
+ 3. Click **Save**
264
+
265
+ ## Automated Workflows
266
+
267
+ ### Scheduled Detection
268
+
269
+ Run detection daily across your fleet:
270
+
271
+ 1. Set command Launch Type to **Trigger + Repeat**
272
+ 2. Configure Schedule:
273
+ - Repeat Type: Day
274
+ - Repeat Interval: 1
275
+ - Scheduled Time: 02:00 (off-hours recommended)
276
+
277
+ ### Event-Based Remediation
278
+
279
+ Use JumpCloud's API to trigger remediation when detection finds OpenClaw:
280
+
281
+ \`\`\`bash
282
+ # Trigger remediation via API
283
+ curl -X POST "https://console.jumpcloud.com/api/command/trigger/nox-openclaw-enforce" \\
284
+ -H "x-api-key: YOUR_API_KEY" \\
285
+ -H "Content-Type: application/json" \\
286
+ -d '{"systemIds": ["system_id_here"]}'
287
+ \`\`\`
288
+
289
+ ### Webhook Integration
290
+
291
+ The scripts can send results to your SIEM. Configure webhook URL and token in the script before uploading:
292
+
293
+ 1. Edit script content
294
+ 2. Set WEBHOOK_URL and WEBHOOK_TOKEN variables
295
+ 3. Save and deploy
296
+
297
+ ## System Insights Integration
298
+
299
+ ### Add Custom Fact
300
+
301
+ Use System Insights to track OpenClaw status across your fleet:
302
+
303
+ 1. Navigate to **Device Management > Commands**
304
+ 2. Create a new command with the System Insights fact script
305
+ 3. Configure:
306
+ - **Name:** Nox OpenClaw Status Fact
307
+ - **Run As:** Root
308
+ - **Schedule:** Repeat Daily
309
+ 4. Assign to all devices
310
+
311
+ ### Query via System Insights
312
+
313
+ Once the fact is populated, query via JumpCloud console or API:
314
+
315
+ \`\`\`bash
316
+ # Query systems with OpenClaw installed
317
+ curl -X POST "https://console.jumpcloud.com/api/v2/systeminsights/query" \\
318
+ -H "x-api-key: YOUR_API_KEY" \\
319
+ -H "Content-Type: application/json" \\
320
+ -d '{
321
+ "query": "SELECT * FROM system_info WHERE nox_openclaw_status = \"installed\""
322
+ }'
323
+ \`\`\`
324
+
325
+ ## Monitoring Results
326
+
327
+ ### Command Results
328
+
329
+ 1. Navigate to **Device Management > Commands**
330
+ 2. Click on a command
331
+ 3. Select **Results** tab
332
+ 4. Filter by:
333
+ - Exit Code
334
+ - Date Range
335
+ - System
336
+
337
+ ### Exit Codes
338
+
339
+ | Code | Detection Meaning | Enforcement Meaning |
340
+ |------|------------------|---------------------|
341
+ | 0 | Not detected | Enforcement successful |
342
+ | 1 | Detected | Enforcement partially failed |
343
+ | 2 | Script error | Script error |
344
+ | 3 | N/A | Nothing to enforce |
345
+
346
+ ### Create Alerts
347
+
348
+ Set up webhook notifications for command failures:
349
+
350
+ 1. Navigate to **Settings > Webhooks**
351
+ 2. Add webhook URL
352
+ 3. Select events:
353
+ - Command results
354
+ - Specific exit codes
355
+
356
+ ## API Integration
357
+
358
+ ### Create Command via API
359
+
360
+ \`\`\`bash
361
+ curl -X POST "https://console.jumpcloud.com/api/commands" \\
362
+ -H "x-api-key: YOUR_API_KEY" \\
363
+ -H "Content-Type: application/json" \\
364
+ -d '{
365
+ "name": "Nox OpenClaw Detection",
366
+ "command": "#!/bin/bash\\n# Script content here...",
367
+ "commandType": "mac",
368
+ "shell": "/bin/bash",
369
+ "user": "root",
370
+ "sudo": true,
371
+ "timeout": "120",
372
+ "launchType": "trigger",
373
+ "trigger": "nox-openclaw-detect"
374
+ }'
375
+ \`\`\`
376
+
377
+ ### Run Command on Demand
378
+
379
+ \`\`\`bash
380
+ # Run on specific systems
381
+ curl -X POST "https://console.jumpcloud.com/api/commands/{command_id}/run" \\
382
+ -H "x-api-key: YOUR_API_KEY" \\
383
+ -H "Content-Type: application/json" \\
384
+ -d '{"systems": ["system_id_1", "system_id_2"]}'
385
+ \`\`\`
386
+
387
+ ### Get Command Results
388
+
389
+ \`\`\`bash
390
+ curl -X GET "https://console.jumpcloud.com/api/commands/{command_id}/results" \\
391
+ -H "x-api-key: YOUR_API_KEY" \\
392
+ -H "Content-Type: application/json"
393
+ \`\`\`
394
+
395
+ ## Device Groups for Targeting
396
+
397
+ Create device groups for OpenClaw management:
398
+
399
+ ### All Managed Devices
400
+ - Include all systems for detection
401
+
402
+ ### OpenClaw Detected
403
+ - Dynamic group based on command exit codes
404
+ - Use for targeted remediation
405
+
406
+ ### High-Risk Devices
407
+ - Combine with other security criteria
408
+ - Priority for immediate enforcement
409
+
410
+ ## Best Practices
411
+
412
+ 1. **Start with detection only** - understand scope before enforcement
413
+ 2. **Use device groups** - organize targeting by OS and risk level
414
+ 3. **Schedule off-hours** - minimize user impact
415
+ 4. **Monitor results** - review exit codes and outputs
416
+ 5. **Test in pilot group** - validate before fleet-wide deployment
417
+ 6. **Enable webhooks** - integrate with SIEM for alerting
418
+
419
+ ## Troubleshooting
420
+
421
+ ### Command Not Running
422
+
423
+ 1. Verify JumpCloud agent is running on device
424
+ 2. Check device group assignment
425
+ 3. Verify trigger name if using triggers
426
+ 4. Check agent logs:
427
+ - macOS/Linux: \`/var/log/jcagent.log\`
428
+ - Windows: \`C:\\Windows\\Temp\\jcagent.log\`
429
+
430
+ ### Permission Errors
431
+
432
+ 1. Verify command runs as root/Administrator
433
+ 2. Check sudo is enabled
434
+ 3. Verify script has correct permissions
435
+
436
+ ### Timeout Issues
437
+
438
+ 1. Increase timeout value (default 120s may be insufficient)
439
+ 2. Check for hung processes
440
+ 3. Simplify script if possible
441
+
442
+ ## Support
443
+
444
+ For issues or questions:
445
+ - Email: support@nox.security
446
+ - Documentation: https://docs.nox.security/jumpcloud
447
+ `;
448
+ }
449
+ /**
450
+ * Get all JumpCloud exports.
451
+ */
452
+ export function getJumpCloudExports(options = {}) {
453
+ return {
454
+ macDetectCommand: generateJumpCloudUnixDetectCommand(options, 'mac'),
455
+ macEnforceCommand: generateJumpCloudUnixEnforceCommand(options, 'mac'),
456
+ linuxDetectCommand: generateJumpCloudUnixDetectCommand(options, 'linux'),
457
+ linuxEnforceCommand: generateJumpCloudUnixEnforceCommand(options, 'linux'),
458
+ windowsDetectCommand: generateJumpCloudWindowsDetectCommand(options),
459
+ windowsEnforceCommand: generateJumpCloudWindowsEnforceCommand(options),
460
+ systemInsightsFact: generateJumpCloudSystemInsightsFact(),
461
+ documentation: generateJumpCloudDocumentation(),
462
+ metadata: {
463
+ platform: 'jumpcloud',
464
+ displayName: 'JumpCloud',
465
+ supportedOS: ['Windows', 'macOS', 'Linux'],
466
+ version: VERSION,
467
+ },
468
+ };
469
+ }
470
+ //# sourceMappingURL=jumpcloud.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"jumpcloud.js","sourceRoot":"","sources":["../../src/mdm/jumpcloud.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,yBAAyB,GAG1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,8BAA8B,GAG/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,GAG3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,+BAA+B,GAGhC,MAAM,4BAA4B,CAAC;AAyBpC;;GAEG;AACH,MAAM,UAAU,kCAAkC,CAChD,UAAkC,EAAE,EACpC,WAA4B,KAAK;IAEjC,MAAM,aAAa,GAAuB;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,MAAM,MAAM,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAExD,OAAO;QACL,IAAI,EAAE,2BAA2B,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG;QAC1E,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC,CACjD,UAAkC,EAAE,EACpC,WAA4B,KAAK;IAEjC,MAAM,aAAa,GAAwB;QACzC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAG,0BAA0B,CAAC,aAAa,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI,EAAE,6BAA6B,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG;QAC5E,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAAkC,EAAE;IAEpC,MAAM,aAAa,GAA4B;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,MAAM,MAAM,GAAG,8BAA8B,CAAC,aAAa,CAAC,CAAC;IAE7D,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,SAAS;QACtB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,MAAM,EAAE,kDAAkD;QAChE,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAAE,KAAK;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sCAAsC,CACpD,UAAkC,EAAE;IAEpC,MAAM,aAAa,GAA6B;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,MAAM,MAAM,GAAG,+BAA+B,CAAC,aAAa,CAAC,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,SAAS;QACtB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAyB;IACnE,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,uCAAuC;QACvC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,cAAc,EAAE,EAAE;QAClB,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC;IACjD,OAAO;;;;wCAI+B,OAAO;IAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CV,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO;;;;;;sCAM6B,OAAO;EAC3C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4PR,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkC,EAAE;IACtE,OAAO;QACL,gBAAgB,EAAE,kCAAkC,CAAC,OAAO,EAAE,KAAK,CAAC;QACpE,iBAAiB,EAAE,mCAAmC,CAAC,OAAO,EAAE,KAAK,CAAC;QACtE,kBAAkB,EAAE,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC;QACxE,mBAAmB,EAAE,mCAAmC,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1E,oBAAoB,EAAE,qCAAqC,CAAC,OAAO,CAAC;QACpE,qBAAqB,EAAE,sCAAsC,CAAC,OAAO,CAAC;QACtE,kBAAkB,EAAE,mCAAmC,EAAE;QACzD,aAAa,EAAE,8BAA8B,EAAE;QAC/C,QAAQ,EAAE;YACR,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;YAC1C,OAAO,EAAE,OAAO;SACjB;KACF,CAAC;AACJ,CAAC"}
@@ -0,0 +1,30 @@
1
+ /**
2
+ * PowerShell detection script template for MDM deployment.
3
+ * Targets Windows systems.
4
+ */
5
+ export interface DetectPowerShellOptions {
6
+ webhookUrl?: string;
7
+ webhookToken?: string;
8
+ gatewayPort?: number;
9
+ verbose?: boolean;
10
+ }
11
+ /**
12
+ * Generate detection PowerShell script.
13
+ */
14
+ export declare function generateDetectPowerShellScript(options?: DetectPowerShellOptions): string;
15
+ /**
16
+ * Get script metadata for documentation.
17
+ */
18
+ export declare function getDetectPowerShellMetadata(): {
19
+ filename: string;
20
+ extension: string;
21
+ platform: string;
22
+ description: string;
23
+ requirements: string[];
24
+ exitCodes: {
25
+ 0: string;
26
+ 1: string;
27
+ 2: string;
28
+ };
29
+ };
30
+ //# sourceMappingURL=detect.ps1.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"detect.ps1.d.ts","sourceRoot":"","sources":["../../../src/mdm/templates/detect.ps1.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiCD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,GAAE,uBAA4B,GAAG,MAAM,CA2Z5F;AAED;;GAEG;AACH,wBAAgB,2BAA2B;;;;;;;;;;;EAa1C"}