security-detections-mcp 3.0.0 → 3.1.0

package/dist/types/detection.d.ts

@@ -1,16 +1,16 @@
 /**
  * Detection Types
- * Core detection interfaces for Sigma, Splunk ESCU, Elastic, and KQL rules
+ * Core detection interfaces for Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL rules
  */
 /**
- * Unified detection schema - normalized from Sigma, Splunk ESCU, Elastic, and KQL sources
+ * Unified detection schema - normalized from Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL sources
  */
 export interface Detection {
     id: string;
     name: string;
     description: string;
     query: string;
-    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql';
+    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
     mitre_ids: string[];
     logsource_category: string | null;
     logsource_product: string | null;
@@ -39,6 +39,9 @@ export interface Detection {
     kql_category: string | null;
     kql_tags: string[];
     kql_keywords: string[];
+    sublime_attack_types: string[];
+    sublime_detection_methods: string[];
+    sublime_tactics: string[];
 }
 /**
  * Lightweight detection summary - for fast retrieval without full query/yaml bloat
@@ -46,11 +49,35 @@ export interface Detection {
 export interface DetectionSummary {
     id: string;
     name: string;
-    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql';
+    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
     mitre_ids: string[];
     severity: string | null;
     mitre_tactics: string[];
 }
+/**
+ * Sublime Security rule structure (YAML format with MQL source)
+ * @see https://github.com/sublime-security/sublime-rules
+ */
+export interface SublimeRule {
+    name: string;
+    description: string;
+    type: 'rule' | 'exclusion';
+    source: string;
+    id?: string;
+    severity?: 'low' | 'medium' | 'high' | 'critical';
+    references?: string[];
+    tags?: string[];
+    authors?: Array<{
+        name?: string;
+        twitter?: string;
+        github?: string;
+        email?: string;
+    }>;
+    attack_types?: string[];
+    tactics_and_techniques?: string[];
+    detection_methods?: string[];
+    false_positives?: string[];
+}
 /**
  * Sigma rule structure based on official Sigma specification
  * @see https://github.com/SigmaHQ/sigma-specification
@@ -163,3 +190,18 @@ export interface ElasticTechnique {
     reference?: string;
     subtechnique?: ElasticTechnique[];
 }
+/**
+ * CQL Hub rule structure (CrowdStrike Query Language)
+ * @see https://github.com/ByteRay-Labs/Query-Hub
+ */
+export interface CqlHubRule {
+    name: string;
+    cql: string;
+    mitre_ids?: string[];
+    description?: string;
+    author?: string;
+    log_sources?: string[];
+    tags?: string[];
+    cs_required_modules?: string[];
+    explanation?: string;
+}

package/dist/types/detection.js

@@ -1,5 +1,5 @@
 /**
  * Detection Types
- * Core detection interfaces for Sigma, Splunk ESCU, Elastic, and KQL rules
+ * Core detection interfaces for Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL rules
  */
 export {};

package/dist/types/index.d.ts

@@ -4,14 +4,14 @@
  * This module exports all type definitions used throughout the MCP server.
  * Types are organized into logical modules:
  *
- * - detection: Core detection types (Sigma, Splunk, Elastic, KQL)
+ * - detection: Core detection types (Sigma, Splunk, Elastic, KQL, CrowdStrike CQL)
  * - story: Analytic story and campaign grouping types
  * - stats: Statistics, comparisons, and cached query types
  * - knowledge: Knowledge graph types for agent memory
  * - dynamic: Dynamic table types for runtime schema extension
  * - meta: Meta-tool types for custom tools and workflows
  */
-export type { Detection, DetectionSummary, SigmaRule, SplunkDetection, ElasticRule, ElasticThreat, ElasticTechnique, } from './detection.js';
+export type { Detection, DetectionSummary, SigmaRule, SplunkDetection, ElasticRule, ElasticThreat, ElasticTechnique, SublimeRule, CqlHubRule, } from './detection.js';
 export type { AnalyticStory, SplunkStoryYaml, } from './story.js';
 export type { IndexStats, SourceComparison, SavedQuery, } from './stats.js';
 export type { KnowledgeEntity, KnowledgeRelation, KnowledgeObservation, KnowledgeDecision, KnowledgeLearning, KnowledgeQueryOptions, } from './knowledge.js';

package/dist/types/index.js

@@ -4,7 +4,7 @@
  * This module exports all type definitions used throughout the MCP server.
  * Types are organized into logical modules:
  *
- * - detection: Core detection types (Sigma, Splunk, Elastic, KQL)
+ * - detection: Core detection types (Sigma, Splunk, Elastic, KQL, CrowdStrike CQL)
  * - story: Analytic story and campaign grouping types
  * - stats: Statistics, comparisons, and cached query types
  * - knowledge: Knowledge graph types for agent memory

package/dist/types/stats.d.ts

@@ -11,6 +11,7 @@ export interface IndexStats {
     splunk_escu: number;
     elastic: number;
     kql: number;
+    sublime: number;
     by_severity: Record<string, number>;
     by_logsource_product: Record<string, number>;
     mitre_coverage: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "security-detections-mcp",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Advanced MCP server for security detections with Detection Engineering Intelligence, Knowledge Graph (Tribal Knowledge), Elicitation, and Resource Subscriptions",
   "sigmaSpecVersion": "2.0.0",
   "type": "module",