security-detections-mcp 3.2.1 → 3.3.0

package/dist/tools/cache/index.js

@@ -17,6 +17,9 @@ const SPLUNK_PATHS = parsePaths(process.env.SPLUNK_PATHS);
 const ELASTIC_PATHS = parsePaths(process.env.ELASTIC_PATHS);
 const STORY_PATHS = parsePaths(process.env.STORY_PATHS);
 const KQL_PATHS = parsePaths(process.env.KQL_PATHS);
+const SUBLIME_PATHS = parsePaths(process.env.SUBLIME_PATHS);
+const CQL_HUB_PATHS = parsePaths(process.env.CQL_HUB_PATHS);
+const JAMF_PROTECT_PATHS = parsePaths(process.env.JAMF_PROTECT_PATHS);
 // =============================================================================
 // Saved Query Tools
 // =============================================================================
@@ -154,10 +157,10 @@ const rebuildIndexTool = defineTool({
     handler: async (args) => {
         const confirmArg = args?.confirm;
         const skipElicitation = args?.skip_elicitation;
-        if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0) {
+        if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0 && SUBLIME_PATHS.length === 0 && CQL_HUB_PATHS.length === 0 && JAMF_PROTECT_PATHS.length === 0) {
             return {
                 error: true,
-                message: 'No paths configured. Set SIGMA_PATHS, SPLUNK_PATHS, ELASTIC_PATHS, and/or KQL_PATHS environment variables.',
+                message: 'No paths configured. Set SIGMA_PATHS, SPLUNK_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS, and/or JAMF_PROTECT_PATHS environment variables.',
             };
         }
         const currentStats = getStats();
@@ -225,7 +228,7 @@ const rebuildIndexTool = defineTool({
         console.error('[security-detections-mcp] Rebuilding index...');
         // Recreate DB to apply schema changes
         recreateDb();
-        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS);
+        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS, JAMF_PROTECT_PATHS);
         // Notify subscribers that resources have changed
         try {
             await notifyResourceChange('detection://stats');

package/dist/tools/detections/actor-analysis.js

@@ -6,7 +6,7 @@
  */
 import { defineTool } from '../registry.js';
 import { isStixLoaded, getActorByName, listActors, getActorTechniques, getActorCoverage, getSoftwareForActor, getAttackStats, generateNavigatorLayer, } from '../../db/index.js';
-const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'];
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
 function stixNotLoadedError() {
     return {
         error: true,

package/dist/tools/detections/analysis.js

@@ -24,7 +24,7 @@ export const analysisTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type',
                 },
                 tactic: {
@@ -67,7 +67,7 @@ export const analysisTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional - analyzes all if not specified)',
                 },
             },
@@ -91,7 +91,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional)',
                 },
             },
@@ -125,7 +125,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional)',
                 },
             },
@@ -177,7 +177,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter to specific source type (optional — includes all if omitted)',
                 },
                 tactic: {
@@ -228,7 +228,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter to specific source (optional — analyzes all if omitted)',
                 },
                 include_query_snippets: {
@@ -266,7 +266,7 @@ export const analysisTools = [
                     type: 'array',
                     items: {
                         type: 'string',
-                        enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                        enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     },
                     description: 'Sources to compare (default: all available)',
                 },

package/dist/tools/detections/comparison.js

@@ -15,7 +15,7 @@ export const comparisonTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Optional: filter by source type',
                 },
                 limit: {
@@ -147,7 +147,7 @@ export const comparisonTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Optional: filter to specific source',
                 },
             },
@@ -235,7 +235,7 @@ export const comparisonTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional)',
                 },
             },

package/dist/tools/detections/filters.js

@@ -10,7 +10,7 @@ export const filterTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Source type to filter by',
                 },
                 limit: {

package/dist/tools/detections/search.js

@@ -22,7 +22,7 @@ export const searchTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter results by detection source type',
                 },
             },

package/dist/tools/engineering/index.js

@@ -27,7 +27,7 @@ const getQueryPatternsTool = defineTool({
             },
             source_type: {
                 type: 'string',
-                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                 description: 'Filter patterns by source type (optional)',
             },
         },
@@ -175,7 +175,7 @@ const findSimilarDetectionsTool = defineTool({
             },
             source_type: {
                 type: 'string',
-                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                 description: 'Filter by source type (optional)',
             },
             limit: {

package/dist/types/detection.d.ts

@@ -10,7 +10,7 @@ export interface Detection {
     name: string;
     description: string;
     query: string;
-    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     mitre_ids: string[];
     logsource_category: string | null;
     logsource_product: string | null;
@@ -49,7 +49,7 @@ export interface Detection {
 export interface DetectionSummary {
     id: string;
     name: string;
-    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     mitre_ids: string[];
     severity: string | null;
     mitre_tactics: string[];
@@ -190,6 +190,31 @@ export interface ElasticTechnique {
     reference?: string;
     subtechnique?: ElasticTechnique[];
 }
+/**
+ * Jamf Protect custom analytic detection structure (YAML with NSPredicate filter).
+ * @see https://github.com/jamf/jamfprotect/tree/main/custom_analytic_detections
+ */
+export interface JamfProtectRule {
+    name: string;
+    uuid?: string;
+    label?: string;
+    shortDescription?: string;
+    longDescription?: string;
+    level?: number;
+    inputType?: 'GPProcessEvent' | 'GPFSEvent' | 'GPKeylogRegisterEvent' | 'GPUSBEvent' | string;
+    filter: string;
+    severity?: 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical' | string;
+    categories?: string[];
+    MitreCategories?: string[] | null;
+    tags?: string[] | null;
+    snapshotFiles?: string[] | null;
+    actions?: Array<{
+        name?: string;
+    } | string>;
+    context?: string[] | null;
+    version?: number;
+    remediation?: string | null;
+}
 /**
  * CQL Hub rule structure (CrowdStrike Query Language)
  * @see https://github.com/ByteRay-Labs/Query-Hub

package/dist/types/index.d.ts

@@ -11,7 +11,7 @@
  * - dynamic: Dynamic table types for runtime schema extension
  * - meta: Meta-tool types for custom tools and workflows
  */
-export type { Detection, DetectionSummary, SigmaRule, SplunkDetection, ElasticRule, ElasticThreat, ElasticTechnique, SublimeRule, CqlHubRule, } from './detection.js';
+export type { Detection, DetectionSummary, SigmaRule, SplunkDetection, ElasticRule, ElasticThreat, ElasticTechnique, SublimeRule, CqlHubRule, JamfProtectRule, } from './detection.js';
 export type { AnalyticStory, SplunkStoryYaml, } from './story.js';
 export type { IndexStats, SourceComparison, SavedQuery, } from './stats.js';
 export type { KnowledgeEntity, KnowledgeRelation, KnowledgeObservation, KnowledgeDecision, KnowledgeLearning, KnowledgeQueryOptions, } from './knowledge.js';

package/dist/types/stats.d.ts

@@ -12,6 +12,8 @@ export interface IndexStats {
     elastic: number;
     kql: number;
     sublime: number;
+    crowdstrike_cql: number;
+    jamf_protect: number;
     by_severity: Record<string, number>;
     by_logsource_product: Record<string, number>;
     mitre_coverage: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "security-detections-mcp",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "Advanced MCP server for security detections with Detection Engineering Intelligence, Knowledge Graph (Tribal Knowledge), Elicitation, and Resource Subscriptions",
   "sigmaSpecVersion": "2.0.0",
   "type": "module",
@@ -20,11 +20,12 @@
     "build": "tsc",
     "start": "node dist/index.js",
     "dev": "tsc --watch",
-    "test": "npm run build && node tests/cross-platform-test.js && node tests/integration-test.js && node tests/engineering-tools-test.js",
+    "test": "npm run build && node tests/cross-platform-test.js && node tests/jamf-parser-test.js && node tests/integration-test.js && node tests/engineering-tools-test.js",
     "test:platform": "npm run build && node tests/cross-platform-test.js",
     "test:ci": "npm run build && node tests/ci-integration-test.js",
     "test:integration": "npm run build && node tests/integration-test.js",
     "test:engineering": "npm run build && node tests/engineering-tools-test.js",
+    "test:jamf": "npm run build && node tests/jamf-parser-test.js",
     "lint": "tsc --noEmit --strict",
     "prepublishOnly": "npm run build && npm run lint"
   },
@@ -43,6 +44,8 @@
     "sublime",
     "crowdstrike",
     "cql",
+    "jamf",
+    "macos",
     "siem",
     "mitre",
     "attack"