security-detections-mcp 3.2.1 → 3.3.0

package/dist/db/detections.d.ts

@@ -12,7 +12,7 @@ export interface ValidationResult {
     similar?: string[];
 }
 export interface TechniqueIdFilters {
-    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     tactic?: string;
     severity?: string;
 }
@@ -59,7 +59,7 @@ export interface DetectionSuggestion {
 export interface NavigatorLayerOptions {
     name: string;
     description?: string;
-    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     tactic?: string;
     severity?: string;
     actor_name?: string;
@@ -108,7 +108,7 @@ export declare function listDetections(limit?: number, offset?: number): Detecti
 /**
  * List detections filtered by source type.
  */
-export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', limit?: number, offset?: number): Detection[];
+export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', limit?: number, offset?: number): Detection[];
 /**
  * List detections by MITRE technique ID.
  */
@@ -184,15 +184,15 @@ export declare function getTechniqueIds(filters?: TechniqueIdFilters): string[];
 /**
  * Analyze coverage by tactic and identify strengths/weaknesses.
  */
-export declare function analyzeCoverage(sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): CoverageReport;
+export declare function analyzeCoverage(sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): CoverageReport;
 /**
  * Identify gaps based on a threat profile.
  */
-export declare function identifyGaps(threatProfile: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): GapAnalysis;
+export declare function identifyGaps(threatProfile: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): GapAnalysis;
 /**
  * Suggest detections for a technique.
  */
-export declare function suggestDetections(techniqueId: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): DetectionSuggestion;
+export declare function suggestDetections(techniqueId: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): DetectionSuggestion;
 /**
  * Generate an ATT&CK Navigator layer from detection coverage.
  */
@@ -232,7 +232,7 @@ export declare function searchDetectionList(query: string, limit?: number): Dete
 /**
  * List detections by source with optional name filter, returning lightweight results.
  */
-export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', nameFilter?: string, limit?: number): DetectionListItem[];
+export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', nameFilter?: string, limit?: number): DetectionListItem[];
 /**
  * Compare detections across sources for a topic.
  */
@@ -240,7 +240,7 @@ export declare function compareDetectionsBySource(topic: string, limit?: number)
 /**
  * Get detection names and IDs matching a pattern, grouped by source.
  */
-export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): {
+export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): {
     source: string;
     detections: Array<{
         name: string;

package/dist/db/detections.js

@@ -371,6 +371,8 @@ export function getStats() {
     const elastic = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'elastic'").get().count;
     const kql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'kql'").get().count;
     const sublime = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'sublime'").get().count;
+    const crowdstrikeCql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'crowdstrike_cql'").get().count;
+    const jamfProtect = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'jamf_protect'").get().count;
     // Count by severity
     const severityRows = database.prepare(`
     SELECT severity, COUNT(*) as count FROM detections 
@@ -449,6 +451,8 @@ export function getStats() {
         elastic,
         kql,
         sublime,
+        crowdstrike_cql: crowdstrikeCql,
+        jamf_protect: jamfProtect,
         by_severity,
         by_logsource_product,
         mitre_coverage,
@@ -1264,7 +1268,15 @@ export function countDetectionsBySource(topic) {
     GROUP BY d.source_type
   `);
     const rows = stmt.all(topic);
-    const result = { sigma: 0, splunk_escu: 0, elastic: 0, kql: 0, sublime: 0, crowdstrike_cql: 0 };
+    const result = {
+        sigma: 0,
+        splunk_escu: 0,
+        elastic: 0,
+        kql: 0,
+        sublime: 0,
+        crowdstrike_cql: 0,
+        jamf_protect: 0,
+    };
     for (const row of rows) {
         result[row.source_type] = row.count;
     }

package/dist/db.d.ts

@@ -8,7 +8,7 @@ export declare function insertDetection(detection: Detection): void;
 export declare function searchDetections(query: string, limit?: number): Detection[];
 export declare function getDetectionById(id: string): Detection | null;
 export declare function listDetections(limit?: number, offset?: number): Detection[];
-export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', limit?: number, offset?: number): Detection[];
+export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', limit?: number, offset?: number): Detection[];
 export declare function listByMitre(techniqueId: string, limit?: number, offset?: number): Detection[];
 export declare function listByLogsource(category?: string, product?: string, service?: string, limit?: number, offset?: number): Detection[];
 export declare function listBySeverity(level: string, limit?: number, offset?: number): Detection[];
@@ -118,9 +118,9 @@ export interface SourceComparisonResult {
     };
 }
 export declare function searchDetectionList(query: string, limit?: number): DetectionListItem[];
-export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', nameFilter?: string, limit?: number): DetectionListItem[];
+export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', nameFilter?: string, limit?: number): DetectionListItem[];
 export declare function compareDetectionsBySource(topic: string, limit?: number): SourceComparisonResult;
-export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): {
+export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): {
     source: string;
     detections: Array<{
         name: string;

package/dist/db.js

@@ -430,6 +430,8 @@ export function getStats() {
     const elastic = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'elastic'").get().count;
     const kql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'kql'").get().count;
     const sublime = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'sublime'").get().count;
+    const crowdstrikeCql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'crowdstrike_cql'").get().count;
+    const jamfProtect = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'jamf_protect'").get().count;
     // Count by severity
     const severityRows = database.prepare(`
     SELECT severity, COUNT(*) as count FROM detections 
@@ -508,6 +510,8 @@ export function getStats() {
         elastic,
         kql,
         sublime,
+        crowdstrike_cql: crowdstrikeCql,
+        jamf_protect: jamfProtect,
         by_severity,
         by_logsource_product,
         mitre_coverage,
@@ -1147,7 +1151,15 @@ export function countDetectionsBySource(topic) {
     GROUP BY d.source_type
   `);
     const rows = stmt.all(topic);
-    const result = { sigma: 0, splunk_escu: 0, elastic: 0, kql: 0 };
+    const result = {
+        sigma: 0,
+        splunk_escu: 0,
+        elastic: 0,
+        kql: 0,
+        sublime: 0,
+        crowdstrike_cql: 0,
+        jamf_protect: 0,
+    };
     for (const row of rows) {
         result[row.source_type] = row.count;
     }

package/dist/handlers/resources.js

@@ -1,6 +1,16 @@
 // Resource definitions and handlers
 import { getStats, analyzeCoverage, identifyGaps, listByMitre, } from '../db/detections.js';
 import { openEntity, listDecisions, listLearnings, getKnowledgeStats, } from '../db/knowledge.js';
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
+function countBySource(detections) {
+    const counts = Object.fromEntries(SOURCE_TYPES.map(source => [source, 0]));
+    for (const detection of detections) {
+        if (SOURCE_TYPES.includes(detection.source_type)) {
+            counts[detection.source_type]++;
+        }
+    }
+    return counts;
+}
 // =============================================================================
 // STATIC RESOURCES
 // =============================================================================
@@ -39,7 +49,7 @@ export const resources = [
     {
         uri: 'detection://sources/comparison',
         name: 'Source Comparison',
-        description: 'Quick comparison of detection counts across sources (sigma, splunk, elastic, kql)',
+        description: 'Quick comparison of detection counts across all sources',
         mimeType: 'application/json',
     },
     // Knowledge graph resources
@@ -112,12 +122,7 @@ function getTechniqueResource(techniqueId) {
             severity: d.severity,
             description: d.description?.substring(0, 200) + (d.description && d.description.length > 200 ? '...' : ''),
         })),
-        by_source: {
-            sigma: detections.filter(d => d.source_type === 'sigma').length,
-            splunk_escu: detections.filter(d => d.source_type === 'splunk_escu').length,
-            elastic: detections.filter(d => d.source_type === 'elastic').length,
-            kql: detections.filter(d => d.source_type === 'kql').length,
-        },
+        by_source: countBySource(detections),
     };
 }
 /**
@@ -228,12 +233,7 @@ function getStaticResourceContent(uri) {
             const stats = getStats();
             return {
                 total_detections: stats.total,
-                by_source: {
-                    sigma: stats.sigma,
-                    splunk_escu: stats.splunk_escu,
-                    elastic: stats.elastic,
-                    kql: stats.kql,
-                },
+                by_source: Object.fromEntries(SOURCE_TYPES.map(source => [source, stats[source]])),
                 by_severity: stats.by_severity,
                 mitre_coverage: stats.mitre_coverage,
                 by_mitre_tactic: stats.by_mitre_tactic,

package/dist/index.js

@@ -30,18 +30,19 @@ const STORY_PATHS = parsePaths(process.env.STORY_PATHS);
 const KQL_PATHS = parsePaths(process.env.KQL_PATHS);
 const SUBLIME_PATHS = parsePaths(process.env.SUBLIME_PATHS);
 const CQL_HUB_PATHS = parsePaths(process.env.CQL_HUB_PATHS);
+const JAMF_PROTECT_PATHS = parsePaths(process.env.JAMF_PROTECT_PATHS);
 const ATTACK_STIX_PATH = process.env.ATTACK_STIX_PATH;
 // Auto-index on startup if paths are configured and DB is empty
 function autoIndex() {
-    if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0 && SUBLIME_PATHS.length === 0 && CQL_HUB_PATHS.length === 0) {
+    if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0 && SUBLIME_PATHS.length === 0 && CQL_HUB_PATHS.length === 0 && JAMF_PROTECT_PATHS.length === 0) {
         return;
     }
     initDb();
     if (needsIndexing()) {
         console.error('[security-detections-mcp] Auto-indexing detections...');
-        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS);
+        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS, JAMF_PROTECT_PATHS);
         let msg = `[security-detections-mcp] Indexed ${result.total} detections`;
-        msg += ` (${result.sigma_indexed} Sigma, ${result.splunk_indexed} Splunk, ${result.elastic_indexed} Elastic, ${result.kql_indexed} KQL, ${result.sublime_indexed} Sublime, ${result.cql_hub_indexed} CrowdStrike CQL)`;
+        msg += ` (${result.sigma_indexed} Sigma, ${result.splunk_indexed} Splunk, ${result.elastic_indexed} Elastic, ${result.kql_indexed} KQL, ${result.sublime_indexed} Sublime, ${result.cql_hub_indexed} CrowdStrike CQL, ${result.jamf_protect_indexed} Jamf Protect)`;
         if (result.stories_indexed > 0) {
             msg += `, ${result.stories_indexed} stories`;
         }

package/dist/indexer.d.ts

@@ -11,9 +11,11 @@ export interface IndexResult {
     sublime_failed: number;
     cql_hub_indexed: number;
     cql_hub_failed: number;
+    jamf_protect_indexed: number;
+    jamf_protect_failed: number;
     stories_indexed: number;
     stories_failed: number;
     total: number;
 }
-export declare function indexDetections(sigmaPaths: string[], splunkPaths: string[], storyPaths?: string[], elasticPaths?: string[], kqlPaths?: string[], sublimePaths?: string[], cqlHubPaths?: string[]): IndexResult;
+export declare function indexDetections(sigmaPaths: string[], splunkPaths: string[], storyPaths?: string[], elasticPaths?: string[], kqlPaths?: string[], sublimePaths?: string[], cqlHubPaths?: string[], jamfProtectPaths?: string[]): IndexResult;
 export declare function needsIndexing(): boolean;

package/dist/indexer.js

@@ -7,6 +7,7 @@ import { parseElasticFile } from './parsers/elastic.js';
 import { parseKqlFile, parseRawKqlFile } from './parsers/kql.js';
 import { parseSublimeFile } from './parsers/sublime.js';
 import { parseCqlHubFile } from './parsers/crowdstrike_cql.js';
+import { parseJamfProtectFile } from './parsers/jamf_protect.js';
 import { recreateDb, insertDetection, insertStory, getDetectionCount, initDb } from './db.js';
 // Recursively find all YAML files in a directory
 function findYamlFiles(dir) {
@@ -110,7 +111,7 @@ function findKqlFiles(dir) {
     }
     return files;
 }
-export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasticPaths = [], kqlPaths = [], sublimePaths = [], cqlHubPaths = []) {
+export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasticPaths = [], kqlPaths = [], sublimePaths = [], cqlHubPaths = [], jamfProtectPaths = []) {
     // Recreate DB to ensure schema is up to date
     recreateDb();
     initDb();
@@ -126,6 +127,8 @@ export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasti
     let sublime_failed = 0;
     let cql_hub_indexed = 0;
     let cql_hub_failed = 0;
+    let jamf_protect_indexed = 0;
+    let jamf_protect_failed = 0;
     let stories_indexed = 0;
     let stories_failed = 0;
     // Index Sigma rules
@@ -224,6 +227,20 @@ export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasti
             }
         }
     }
+    // Index Jamf Protect custom analytic detections (YAML with NSPredicate filter)
+    for (const basePath of jamfProtectPaths) {
+        const files = findYamlFiles(basePath);
+        for (const file of files) {
+            const detection = parseJamfProtectFile(file);
+            if (detection) {
+                insertDetection(detection);
+                jamf_protect_indexed++;
+            }
+            else {
+                jamf_protect_failed++;
+            }
+        }
+    }
     // Index Splunk Analytic Stories (optional)
     for (const basePath of storyPaths) {
         const files = findYamlFiles(basePath);
@@ -251,9 +268,11 @@ export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasti
         sublime_failed,
         cql_hub_indexed,
         cql_hub_failed,
+        jamf_protect_indexed,
+        jamf_protect_failed,
         stories_indexed,
         stories_failed,
-        total: sigma_indexed + splunk_indexed + elastic_indexed + kql_indexed + sublime_indexed + cql_hub_indexed,
+        total: sigma_indexed + splunk_indexed + elastic_indexed + kql_indexed + sublime_indexed + cql_hub_indexed + jamf_protect_indexed,
     };
 }
 export function needsIndexing() {

package/dist/parsers/jamf_protect.d.ts

@@ -0,0 +1,2 @@
+import type { Detection } from '../types.js';
+export declare function parseJamfProtectFile(filePath: string): Detection | null;

package/dist/parsers/jamf_protect.js

@@ -0,0 +1,220 @@
+import { readFileSync } from 'fs';
+import { parse as parseYaml } from 'yaml';
+import { createHash } from 'crypto';
+// MITRE tactic normalization: Jamf's `MitreCategories` mixes CamelCase (`CredentialAccess`),
+// spaced (`Credential Access`), and Jamf-specific labels (`LivingOffTheLand`). Normalize the
+// input by lowercasing and stripping whitespace, then map to MITRE tactic kebab-case.
+const TACTIC_MAP = {
+    reconnaissance: 'reconnaissance',
+    resourcedevelopment: 'resource-development',
+    initialaccess: 'initial-access',
+    execution: 'execution',
+    persistence: 'persistence',
+    privilegeescalation: 'privilege-escalation',
+    defenseevasion: 'defense-evasion',
+    credentialaccess: 'credential-access',
+    discovery: 'discovery',
+    lateralmovement: 'lateral-movement',
+    collection: 'collection',
+    commandandcontrol: 'command-and-control',
+    exfiltration: 'exfiltration',
+    impact: 'impact',
+};
+// Best-effort mapping for Jamf-specific labels → MITRE techniques + tactics.
+// Claims are approximate and lossy but give the coverage-analysis tooling something to work with.
+const JAMF_LABEL_MAP = {
+    livingofftheland: {
+        techniques: ['T1059', 'T1218'],
+        tactics: ['execution', 'defense-evasion'],
+    },
+    knownmalware: {
+        techniques: ['T1204.002'],
+        tactics: ['execution'],
+    },
+    knownmaliciousfile: {
+        techniques: ['T1204.002'],
+        tactics: ['execution'],
+    },
+    adversaryinthemiddle: {
+        techniques: ['T1557'],
+        tactics: ['credential-access'],
+    },
+    credentialharvesting: {
+        techniques: ['T1555'],
+        tactics: ['credential-access'],
+    },
+    exploitation: {
+        techniques: ['T1203', 'T1068'],
+        tactics: ['execution', 'privilege-escalation'],
+    },
+    systemtampering: {
+        techniques: ['T1565'],
+        tactics: ['impact'],
+    },
+    visibility: {
+        techniques: [],
+        tactics: ['discovery'],
+    },
+    systemvisibility: {
+        techniques: [],
+        tactics: ['discovery'],
+    },
+};
+const TECHNIQUE_ID_RE = /^t(\d{4}(?:\.\d{3})?)$/;
+function extractMitre(raw) {
+    const ids = new Set();
+    const tactics = new Set();
+    const rawLabels = [];
+    if (!raw)
+        return { ids: [], tactics: [], rawLabels: [] };
+    for (const entry of raw) {
+        if (typeof entry !== 'string')
+            continue;
+        rawLabels.push(entry);
+        const normalized = entry.toLowerCase().replace(/[\s_-]/g, '');
+        const techMatch = normalized.match(TECHNIQUE_ID_RE);
+        if (techMatch) {
+            ids.add(`T${techMatch[1].toUpperCase()}`);
+            continue;
+        }
+        if (TACTIC_MAP[normalized]) {
+            tactics.add(TACTIC_MAP[normalized]);
+            continue;
+        }
+        const labelMapping = JAMF_LABEL_MAP[normalized];
+        if (labelMapping) {
+            labelMapping.techniques.forEach(t => ids.add(t));
+            labelMapping.tactics.forEach(t => tactics.add(t));
+        }
+    }
+    return { ids: [...ids], tactics: [...tactics], rawLabels };
+}
+function extractDataSources(inputType) {
+    const base = 'macOS Endpoint Security';
+    switch (inputType) {
+        case 'GPProcessEvent':
+            return ['Process Events', base];
+        case 'GPFSEvent':
+            return ['File System Events', base];
+        case 'GPKeylogRegisterEvent':
+            return ['Keylog Register Events', base];
+        case 'GPUSBEvent':
+            return ['USB Events', base];
+        default:
+            return inputType ? [inputType, base] : [base];
+    }
+}
+// Pull process names from NSPredicate filter text.
+// Jamf filters reference processes via `path.lastPathComponent == "<name>"` or
+// `signingInfo.appid == "com.apple.<name>"`.
+function extractProcessNames(filter) {
+    const names = new Set();
+    const lastComponentRe = /lastPathComponent\s*==\s*"([^"]+)"/gi;
+    let m;
+    while ((m = lastComponentRe.exec(filter)) !== null) {
+        if (m[1])
+            names.add(m[1]);
+    }
+    const appidRe = /signingInfo\.appid\s*==\s*"com\.apple\.([A-Za-z0-9_.-]+)"/gi;
+    while ((m = appidRe.exec(filter)) !== null) {
+        if (m[1])
+            names.add(m[1]);
+    }
+    return [...names];
+}
+// Pull quoted absolute-path references from NSPredicate filter text.
+function extractFilePaths(filter) {
+    const paths = new Set();
+    const re = /"(\/[^"\s]+)"/g;
+    let m;
+    while ((m = re.exec(filter)) !== null) {
+        const candidate = m[1];
+        if (candidate.length < 3)
+            continue;
+        // Skip bundle identifiers and uri-ish schemes.
+        if (!candidate.startsWith('/'))
+            continue;
+        paths.add(candidate);
+    }
+    return [...paths];
+}
+function normalizeSeverity(severity) {
+    if (!severity)
+        return null;
+    return severity.toLowerCase();
+}
+function generateId(filePath, name, uuid) {
+    // Upstream Jamf content occasionally reuses the same uuid across different files
+    // (e.g. openclaw_directory_created vs openclaw_onboard both declare the same uuid).
+    // Incorporate the filename into the hash so each file produces a unique id; keep
+    // the uuid as a prefix when available so it's still recognizable.
+    const basename = filePath.split('/').pop() || filePath;
+    const hash = createHash('sha256').update(`${filePath}:${name}`).digest('hex').substring(0, 12);
+    if (uuid) {
+        return `jamf-${uuid}-${hash}`;
+    }
+    return `jamf-${createHash('sha256').update(`${basename}:${name}`).digest('hex').substring(0, 32)}`;
+}
+export function parseJamfProtectFile(filePath) {
+    try {
+        const content = readFileSync(filePath, 'utf-8');
+        const rule = parseYaml(content);
+        if (!rule || typeof rule !== 'object')
+            return null;
+        if (!rule.name || !rule.filter)
+            return null;
+        const mitre = extractMitre(rule.MitreCategories ?? null);
+        const baseTags = Array.isArray(rule.tags)
+            ? rule.tags.filter((t) => typeof t === 'string')
+            : [];
+        const categoryTags = Array.isArray(rule.categories)
+            ? rule.categories.filter((t) => typeof t === 'string')
+            : [];
+        // Preserve the raw Jamf MITRE labels so their original semantics stay searchable.
+        const tags = [...new Set([...baseTags, ...categoryTags, ...mitre.rawLabels])];
+        const description = rule.longDescription || rule.shortDescription || '';
+        const id = generateId(filePath, rule.name, rule.uuid);
+        const detection = {
+            id,
+            name: rule.label || rule.name,
+            description,
+            query: rule.filter,
+            source_type: 'jamf_protect',
+            mitre_ids: mitre.ids,
+            logsource_category: rule.inputType || null,
+            logsource_product: 'macos',
+            logsource_service: 'jamf_protect',
+            severity: normalizeSeverity(rule.severity),
+            status: null,
+            author: 'Jamf',
+            date_created: null,
+            date_modified: null,
+            references: [],
+            falsepositives: [],
+            tags,
+            file_path: filePath,
+            raw_yaml: content,
+            cves: [],
+            analytic_stories: [],
+            data_sources: extractDataSources(rule.inputType),
+            detection_type: 'TTP',
+            asset_type: 'Endpoint',
+            security_domain: 'endpoint',
+            process_names: extractProcessNames(rule.filter),
+            file_paths: extractFilePaths(rule.filter),
+            registry_paths: [],
+            mitre_tactics: mitre.tactics,
+            platforms: ['macos'],
+            kql_category: null,
+            kql_tags: [],
+            kql_keywords: [],
+            sublime_attack_types: [],
+            sublime_detection_methods: [],
+            sublime_tactics: [],
+        };
+        return detection;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/resources/index.js

@@ -9,6 +9,16 @@
  */
 import { getStats, analyzeCoverage, identifyGaps, listByMitre, listByMitreTactic, listBySource, generateNavigatorLayer, isStixLoaded, getActorByName, getActorCoverage, getActorTechniques, getSoftwareForActor, } from '../db/index.js';
 import { openEntity, listDecisions, listLearnings, getKnowledgeStats, } from '../db/knowledge.js';
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
+function countBySource(detections) {
+    const counts = Object.fromEntries(SOURCE_TYPES.map((source) => [source, 0]));
+    for (const detection of detections) {
+        if (SOURCE_TYPES.includes(detection.source_type)) {
+            counts[detection.source_type]++;
+        }
+    }
+    return counts;
+}
 // =============================================================================
 // STATIC RESOURCES
 // =============================================================================
@@ -47,7 +57,7 @@ export const resources = [
     {
         uri: 'detection://sources/comparison',
         name: 'Source Comparison',
-        description: 'Quick comparison of detection counts across sources (sigma, splunk, elastic, kql)',
+        description: 'Quick comparison of detection counts across all sources',
         mimeType: 'application/json',
     },
     // Navigator layer
@@ -96,7 +106,7 @@ export const resourceTemplates = [
     {
         uriTemplate: 'detection://source/{sourceType}',
         name: 'Source Statistics',
-        description: 'Get statistics and detections for a specific source type (sigma, splunk_escu, elastic, kql)',
+        description: 'Get statistics and detections for a specific source type',
         mimeType: 'application/json',
     },
     {
@@ -114,7 +124,7 @@ export const resourceTemplates = [
     {
         uriTemplate: 'detection://navigator/layer/{sourceType}',
         name: 'Source-Filtered Navigator Layer',
-        description: 'ATT&CK Navigator layer filtered by detection source (sigma, splunk_escu, elastic, kql, sublime, crowdstrike_cql)',
+        description: 'ATT&CK Navigator layer filtered by detection source',
         mimeType: 'application/json',
     },
     {
@@ -152,12 +162,7 @@ function getTechniqueResource(techniqueId) {
             description: d.description?.substring(0, 200) +
                 (d.description && d.description.length > 200 ? '...' : ''),
         })),
-        by_source: {
-            sigma: detections.filter((d) => d.source_type === 'sigma').length,
-            splunk_escu: detections.filter((d) => d.source_type === 'splunk_escu').length,
-            elastic: detections.filter((d) => d.source_type === 'elastic').length,
-            kql: detections.filter((d) => d.source_type === 'kql').length,
-        },
+        by_source: countBySource(detections),
     };
 }
 /**
@@ -189,19 +194,14 @@ function getTacticResource(tactic) {
             severity: d.severity,
             mitre_ids: d.mitre_ids,
         })),
-        by_source: {
-            sigma: detections.filter((d) => d.source_type === 'sigma').length,
-            splunk_escu: detections.filter((d) => d.source_type === 'splunk_escu').length,
-            elastic: detections.filter((d) => d.source_type === 'elastic').length,
-            kql: detections.filter((d) => d.source_type === 'kql').length,
-        },
+        by_source: countBySource(detections),
     };
 }
 /**
  * Get statistics and sample detections for a source type
  */
 function getSourceResource(sourceType) {
-    const validSources = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'];
+    const validSources = [...SOURCE_TYPES];
     const normalizedSource = sourceType.toLowerCase();
     if (!validSources.includes(normalizedSource)) {
         return {
@@ -388,12 +388,7 @@ function getStaticResourceContent(uri) {
             const stats = getStats();
             return {
                 total_detections: stats.total,
-                by_source: {
-                    sigma: stats.sigma,
-                    splunk_escu: stats.splunk_escu,
-                    elastic: stats.elastic,
-                    kql: stats.kql,
-                },
+                by_source: Object.fromEntries(SOURCE_TYPES.map((source) => [source, stats[source]])),
                 by_severity: stats.by_severity,
                 mitre_coverage: stats.mitre_coverage,
                 by_mitre_tactic: stats.by_mitre_tactic,

package/dist/server.js

@@ -133,7 +133,7 @@ export function createServer() {
                 break;
             case 'source_type':
             case 'source':
-                values = ['sigma', 'splunk_escu', 'elastic', 'kql'].filter(s => s.toLowerCase().startsWith(prefix.toLowerCase()));
+                values = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'].filter(s => s.toLowerCase().startsWith(prefix.toLowerCase()));
                 break;
             case 'threat_profile':
             case 'profile':

package/dist/tools/autonomous/index.js

@@ -23,6 +23,7 @@ import { requestAnalysis, getSamplingStatus } from '../../handlers/sampling.js';
 // ============================================================================
 // Helper Functions
 // ============================================================================
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
 /**
  * Format current timestamp for storage
  */
@@ -221,7 +222,7 @@ Use this for executive-level reporting on detection posture.`,
             // Compare detections across sources for high-priority techniques
             const highPriorityTechniques = ['T1059.001', 'T1003.001', 'T1547.001', 'T1486', 'T1078'];
             const sourceStats = {};
-            for (const source of ['sigma', 'splunk_escu', 'elastic', 'kql']) {
+            for (const source of SOURCE_TYPES) {
                 const detections = listBySource(source, 9999);
                 sourceStats[source] = detections.length;
             }
@@ -368,7 +369,7 @@ Use this to understand the strengths/weaknesses of different detection sources a
         const includeQualityAnalysis = args.include_quality_analysis !== false;
         const sessionId = args.session_id;
         ensureDynamicSchema();
-        const sources = ['sigma', 'splunk_escu', 'elastic', 'kql'];
+        const sources = SOURCE_TYPES;
         // Get overall stats by source
         const sourceStats = {};
         for (const source of sources) {