security-detections-mcp 3.2.2 → 3.3.0

package/README.md

@@ -57,9 +57,7 @@ codex mcp add security-detections -- npx -y security-detections-mcp
 **Claude Code** (CLI one-liner):
 
 ```bash
-claude mcp add --transport http security-detections \
-  https://detect.michaelhaag.org/api/mcp/mcp \
-  --header "Authorization: Bearer sdmcp_YOUR_TOKEN_HERE"
+claude mcp add --transport http security-detections https://detect.michaelhaag.org/api/mcp/mcp --header "Authorization: Bearer sdmcp_YOUR_TOKEN_HERE"
 ```
 
 **Claude Desktop** (via [`mcp-remote`](https://github.com/geelen/mcp-remote) — Desktop doesn't speak remote HTTP natively yet):
@@ -84,14 +82,46 @@ claude mcp add --transport http security-detections \
 **OpenAI Codex** (CLI):
 
 ```bash
-# Set your token as an env var first: export SDMCP_TOKEN="sdmcp_YOUR_TOKEN_HERE"
-codex mcp add security-detections \
-  --url https://detect.michaelhaag.org/api/mcp/mcp \
-  --bearer-token-env-var SDMCP_TOKEN
+export SDMCP_TOKEN="sdmcp_YOUR_TOKEN_HERE" && codex mcp add security-detections --url https://detect.michaelhaag.org/api/mcp/mcp --bearer-token-env-var SDMCP_TOKEN
 ```
 
 See the [Hosted MCP Setup Guide](./docs/HOSTED_MCP.md) for the full table of clients, the complete tool inventory, and troubleshooting tips.
 
+## AI Model Routing (Web App)
+
+The web chat supports Free, Pro/Admin, and BYOK (Bring Your Own Key) routing. You can also see the active model at the top of the chat UI.
+
+### Free Tier (default)
+
+- Default model: `nvidia/nemotron-3-super-120b-a12b:free`
+- Automatic fallback order if the first model is busy:
+  1. `nvidia/nemotron-3-super-120b-a12b:free`
+  2. `nousresearch/hermes-3-llama-3.1-405b:free`
+  3. `meta-llama/llama-3.3-70b-instruct:free`
+  4. `openai/gpt-oss-120b:free`
+
+### Pro/Admin (no BYOK key set)
+
+Uses app-managed OpenRouter routing with your **Preferred Model** setting in `/account`:
+
+| Preferred Model | Routed model |
+|---|---|
+| `auto` | Free model pool (default: `nvidia/nemotron-3-super-120b-a12b:free`) |
+| `claude` | `anthropic/claude-sonnet-4-6` |
+| `claude-opus` | `anthropic/claude-opus-4-6` |
+| `gpt` | `openai/gpt-5.4` |
+| `gpt-codex` | `openai/gpt-5.3-codex` |
+
+### BYOK behavior (takes precedence over tier routing)
+
+If you set your own API key(s), routing priority is:
+
+1. Claude key (`sk-ant-...`) -> `claude-sonnet-4-6-20250514` via Anthropic
+2. OpenAI key (`sk-...`) -> `gpt-5.4` via OpenAI
+3. OpenRouter key (`sk-or-...`) -> uses the same Preferred Model mapping table above
+
+If multiple keys are present, the first match in that order is used.
+
 ## Features
 
 - **8,200+ detections** across 6 formats — Sigma, Splunk ESCU, Elastic, KQL, Sublime, CrowdStrike CQL
@@ -121,6 +151,7 @@ Configure env vars to point at your detection repos:
 | `KQL_PATHS` | KQL hunting query directories |
 | `SUBLIME_PATHS` | Sublime Security rule directories |
 | `CQL_HUB_PATHS` | CQL Hub (CrowdStrike) query directories |
+| `JAMF_PROTECT_PATHS` | Jamf Protect custom analytic detection directories (macOS) |
 | `STORY_PATHS` | Splunk analytic story directories (optional) |
 | `ATTACK_STIX_PATH` | Path to `enterprise-attack.json` for threat actor data (optional) |
 
@@ -150,7 +181,7 @@ git clone --depth 1 https://github.com/ByteRay-Labs/Query-Hub.git cql-hub
 | `search(query, limit)` | Full-text search across all detection fields |
 | `get_by_id(id)` | Get a single detection by ID |
 | `list_all(limit, offset)` | Paginated list of all detections |
-| `list_by_source(source_type)` | Filter by source (`sigma`, `splunk_escu`, `elastic`, `kql`, `sublime`, `crowdstrike_cql`) |
+| `list_by_source(source_type)` | Filter by source (`sigma`, `splunk_escu`, `elastic`, `kql`, `sublime`, `crowdstrike_cql`, `jamf_protect`) |
 | `get_stats()` | Index statistics |
 | `rebuild_index()` | Force re-index from configured paths |
 

package/dist/db/detections.d.ts

@@ -12,7 +12,7 @@ export interface ValidationResult {
     similar?: string[];
 }
 export interface TechniqueIdFilters {
-    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     tactic?: string;
     severity?: string;
 }
@@ -59,7 +59,7 @@ export interface DetectionSuggestion {
 export interface NavigatorLayerOptions {
     name: string;
     description?: string;
-    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     tactic?: string;
     severity?: string;
     actor_name?: string;
@@ -108,7 +108,7 @@ export declare function listDetections(limit?: number, offset?: number): Detecti
 /**
  * List detections filtered by source type.
  */
-export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', limit?: number, offset?: number): Detection[];
+export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', limit?: number, offset?: number): Detection[];
 /**
  * List detections by MITRE technique ID.
  */
@@ -184,15 +184,15 @@ export declare function getTechniqueIds(filters?: TechniqueIdFilters): string[];
 /**
  * Analyze coverage by tactic and identify strengths/weaknesses.
  */
-export declare function analyzeCoverage(sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): CoverageReport;
+export declare function analyzeCoverage(sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): CoverageReport;
 /**
  * Identify gaps based on a threat profile.
  */
-export declare function identifyGaps(threatProfile: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): GapAnalysis;
+export declare function identifyGaps(threatProfile: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): GapAnalysis;
 /**
  * Suggest detections for a technique.
  */
-export declare function suggestDetections(techniqueId: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): DetectionSuggestion;
+export declare function suggestDetections(techniqueId: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): DetectionSuggestion;
 /**
  * Generate an ATT&CK Navigator layer from detection coverage.
  */
@@ -232,7 +232,7 @@ export declare function searchDetectionList(query: string, limit?: number): Dete
 /**
  * List detections by source with optional name filter, returning lightweight results.
  */
-export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', nameFilter?: string, limit?: number): DetectionListItem[];
+export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', nameFilter?: string, limit?: number): DetectionListItem[];
 /**
  * Compare detections across sources for a topic.
  */
@@ -240,7 +240,7 @@ export declare function compareDetectionsBySource(topic: string, limit?: number)
 /**
  * Get detection names and IDs matching a pattern, grouped by source.
  */
-export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): {
+export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): {
     source: string;
     detections: Array<{
         name: string;

package/dist/db/detections.js

@@ -371,6 +371,8 @@ export function getStats() {
     const elastic = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'elastic'").get().count;
     const kql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'kql'").get().count;
     const sublime = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'sublime'").get().count;
+    const crowdstrikeCql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'crowdstrike_cql'").get().count;
+    const jamfProtect = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'jamf_protect'").get().count;
     // Count by severity
     const severityRows = database.prepare(`
     SELECT severity, COUNT(*) as count FROM detections 
@@ -449,6 +451,8 @@ export function getStats() {
         elastic,
         kql,
         sublime,
+        crowdstrike_cql: crowdstrikeCql,
+        jamf_protect: jamfProtect,
         by_severity,
         by_logsource_product,
         mitre_coverage,
@@ -1264,7 +1268,15 @@ export function countDetectionsBySource(topic) {
     GROUP BY d.source_type
   `);
     const rows = stmt.all(topic);
-    const result = { sigma: 0, splunk_escu: 0, elastic: 0, kql: 0, sublime: 0, crowdstrike_cql: 0 };
+    const result = {
+        sigma: 0,
+        splunk_escu: 0,
+        elastic: 0,
+        kql: 0,
+        sublime: 0,
+        crowdstrike_cql: 0,
+        jamf_protect: 0,
+    };
     for (const row of rows) {
         result[row.source_type] = row.count;
     }

package/dist/db.d.ts

@@ -8,7 +8,7 @@ export declare function insertDetection(detection: Detection): void;
 export declare function searchDetections(query: string, limit?: number): Detection[];
 export declare function getDetectionById(id: string): Detection | null;
 export declare function listDetections(limit?: number, offset?: number): Detection[];
-export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', limit?: number, offset?: number): Detection[];
+export declare function listBySource(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', limit?: number, offset?: number): Detection[];
 export declare function listByMitre(techniqueId: string, limit?: number, offset?: number): Detection[];
 export declare function listByLogsource(category?: string, product?: string, service?: string, limit?: number, offset?: number): Detection[];
 export declare function listBySeverity(level: string, limit?: number, offset?: number): Detection[];
@@ -118,9 +118,9 @@ export interface SourceComparisonResult {
     };
 }
 export declare function searchDetectionList(query: string, limit?: number): DetectionListItem[];
-export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql', nameFilter?: string, limit?: number): DetectionListItem[];
+export declare function listDetectionsBySourceLight(sourceType: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect', nameFilter?: string, limit?: number): DetectionListItem[];
 export declare function compareDetectionsBySource(topic: string, limit?: number): SourceComparisonResult;
-export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql'): {
+export declare function getDetectionNamesByPattern(pattern: string, sourceType?: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect'): {
     source: string;
     detections: Array<{
         name: string;

package/dist/db.js

@@ -430,6 +430,8 @@ export function getStats() {
     const elastic = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'elastic'").get().count;
     const kql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'kql'").get().count;
     const sublime = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'sublime'").get().count;
+    const crowdstrikeCql = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'crowdstrike_cql'").get().count;
+    const jamfProtect = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'jamf_protect'").get().count;
     // Count by severity
     const severityRows = database.prepare(`
     SELECT severity, COUNT(*) as count FROM detections 
@@ -508,6 +510,8 @@ export function getStats() {
         elastic,
         kql,
         sublime,
+        crowdstrike_cql: crowdstrikeCql,
+        jamf_protect: jamfProtect,
         by_severity,
         by_logsource_product,
         mitre_coverage,
@@ -1147,7 +1151,15 @@ export function countDetectionsBySource(topic) {
     GROUP BY d.source_type
   `);
     const rows = stmt.all(topic);
-    const result = { sigma: 0, splunk_escu: 0, elastic: 0, kql: 0 };
+    const result = {
+        sigma: 0,
+        splunk_escu: 0,
+        elastic: 0,
+        kql: 0,
+        sublime: 0,
+        crowdstrike_cql: 0,
+        jamf_protect: 0,
+    };
     for (const row of rows) {
         result[row.source_type] = row.count;
     }

package/dist/handlers/resources.js

@@ -1,6 +1,16 @@
 // Resource definitions and handlers
 import { getStats, analyzeCoverage, identifyGaps, listByMitre, } from '../db/detections.js';
 import { openEntity, listDecisions, listLearnings, getKnowledgeStats, } from '../db/knowledge.js';
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
+function countBySource(detections) {
+    const counts = Object.fromEntries(SOURCE_TYPES.map(source => [source, 0]));
+    for (const detection of detections) {
+        if (SOURCE_TYPES.includes(detection.source_type)) {
+            counts[detection.source_type]++;
+        }
+    }
+    return counts;
+}
 // =============================================================================
 // STATIC RESOURCES
 // =============================================================================
@@ -39,7 +49,7 @@ export const resources = [
     {
         uri: 'detection://sources/comparison',
         name: 'Source Comparison',
-        description: 'Quick comparison of detection counts across sources (sigma, splunk, elastic, kql)',
+        description: 'Quick comparison of detection counts across all sources',
         mimeType: 'application/json',
     },
     // Knowledge graph resources
@@ -112,12 +122,7 @@ function getTechniqueResource(techniqueId) {
             severity: d.severity,
             description: d.description?.substring(0, 200) + (d.description && d.description.length > 200 ? '...' : ''),
         })),
-        by_source: {
-            sigma: detections.filter(d => d.source_type === 'sigma').length,
-            splunk_escu: detections.filter(d => d.source_type === 'splunk_escu').length,
-            elastic: detections.filter(d => d.source_type === 'elastic').length,
-            kql: detections.filter(d => d.source_type === 'kql').length,
-        },
+        by_source: countBySource(detections),
     };
 }
 /**
@@ -228,12 +233,7 @@ function getStaticResourceContent(uri) {
             const stats = getStats();
             return {
                 total_detections: stats.total,
-                by_source: {
-                    sigma: stats.sigma,
-                    splunk_escu: stats.splunk_escu,
-                    elastic: stats.elastic,
-                    kql: stats.kql,
-                },
+                by_source: Object.fromEntries(SOURCE_TYPES.map(source => [source, stats[source]])),
                 by_severity: stats.by_severity,
                 mitre_coverage: stats.mitre_coverage,
                 by_mitre_tactic: stats.by_mitre_tactic,

package/dist/index.js

@@ -30,18 +30,19 @@ const STORY_PATHS = parsePaths(process.env.STORY_PATHS);
 const KQL_PATHS = parsePaths(process.env.KQL_PATHS);
 const SUBLIME_PATHS = parsePaths(process.env.SUBLIME_PATHS);
 const CQL_HUB_PATHS = parsePaths(process.env.CQL_HUB_PATHS);
+const JAMF_PROTECT_PATHS = parsePaths(process.env.JAMF_PROTECT_PATHS);
 const ATTACK_STIX_PATH = process.env.ATTACK_STIX_PATH;
 // Auto-index on startup if paths are configured and DB is empty
 function autoIndex() {
-    if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0 && SUBLIME_PATHS.length === 0 && CQL_HUB_PATHS.length === 0) {
+    if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0 && SUBLIME_PATHS.length === 0 && CQL_HUB_PATHS.length === 0 && JAMF_PROTECT_PATHS.length === 0) {
         return;
     }
     initDb();
     if (needsIndexing()) {
         console.error('[security-detections-mcp] Auto-indexing detections...');
-        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS);
+        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS, JAMF_PROTECT_PATHS);
         let msg = `[security-detections-mcp] Indexed ${result.total} detections`;
-        msg += ` (${result.sigma_indexed} Sigma, ${result.splunk_indexed} Splunk, ${result.elastic_indexed} Elastic, ${result.kql_indexed} KQL, ${result.sublime_indexed} Sublime, ${result.cql_hub_indexed} CrowdStrike CQL)`;
+        msg += ` (${result.sigma_indexed} Sigma, ${result.splunk_indexed} Splunk, ${result.elastic_indexed} Elastic, ${result.kql_indexed} KQL, ${result.sublime_indexed} Sublime, ${result.cql_hub_indexed} CrowdStrike CQL, ${result.jamf_protect_indexed} Jamf Protect)`;
         if (result.stories_indexed > 0) {
             msg += `, ${result.stories_indexed} stories`;
         }

package/dist/indexer.d.ts

@@ -11,9 +11,11 @@ export interface IndexResult {
     sublime_failed: number;
     cql_hub_indexed: number;
     cql_hub_failed: number;
+    jamf_protect_indexed: number;
+    jamf_protect_failed: number;
     stories_indexed: number;
     stories_failed: number;
     total: number;
 }
-export declare function indexDetections(sigmaPaths: string[], splunkPaths: string[], storyPaths?: string[], elasticPaths?: string[], kqlPaths?: string[], sublimePaths?: string[], cqlHubPaths?: string[]): IndexResult;
+export declare function indexDetections(sigmaPaths: string[], splunkPaths: string[], storyPaths?: string[], elasticPaths?: string[], kqlPaths?: string[], sublimePaths?: string[], cqlHubPaths?: string[], jamfProtectPaths?: string[]): IndexResult;
 export declare function needsIndexing(): boolean;

package/dist/indexer.js

@@ -7,6 +7,7 @@ import { parseElasticFile } from './parsers/elastic.js';
 import { parseKqlFile, parseRawKqlFile } from './parsers/kql.js';
 import { parseSublimeFile } from './parsers/sublime.js';
 import { parseCqlHubFile } from './parsers/crowdstrike_cql.js';
+import { parseJamfProtectFile } from './parsers/jamf_protect.js';
 import { recreateDb, insertDetection, insertStory, getDetectionCount, initDb } from './db.js';
 // Recursively find all YAML files in a directory
 function findYamlFiles(dir) {
@@ -110,7 +111,7 @@ function findKqlFiles(dir) {
     }
     return files;
 }
-export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasticPaths = [], kqlPaths = [], sublimePaths = [], cqlHubPaths = []) {
+export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasticPaths = [], kqlPaths = [], sublimePaths = [], cqlHubPaths = [], jamfProtectPaths = []) {
     // Recreate DB to ensure schema is up to date
     recreateDb();
     initDb();
@@ -126,6 +127,8 @@ export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasti
     let sublime_failed = 0;
     let cql_hub_indexed = 0;
     let cql_hub_failed = 0;
+    let jamf_protect_indexed = 0;
+    let jamf_protect_failed = 0;
     let stories_indexed = 0;
     let stories_failed = 0;
     // Index Sigma rules
@@ -224,6 +227,20 @@ export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasti
             }
         }
     }
+    // Index Jamf Protect custom analytic detections (YAML with NSPredicate filter)
+    for (const basePath of jamfProtectPaths) {
+        const files = findYamlFiles(basePath);
+        for (const file of files) {
+            const detection = parseJamfProtectFile(file);
+            if (detection) {
+                insertDetection(detection);
+                jamf_protect_indexed++;
+            }
+            else {
+                jamf_protect_failed++;
+            }
+        }
+    }
     // Index Splunk Analytic Stories (optional)
     for (const basePath of storyPaths) {
         const files = findYamlFiles(basePath);
@@ -251,9 +268,11 @@ export function indexDetections(sigmaPaths, splunkPaths, storyPaths = [], elasti
         sublime_failed,
         cql_hub_indexed,
         cql_hub_failed,
+        jamf_protect_indexed,
+        jamf_protect_failed,
         stories_indexed,
         stories_failed,
-        total: sigma_indexed + splunk_indexed + elastic_indexed + kql_indexed + sublime_indexed + cql_hub_indexed,
+        total: sigma_indexed + splunk_indexed + elastic_indexed + kql_indexed + sublime_indexed + cql_hub_indexed + jamf_protect_indexed,
     };
 }
 export function needsIndexing() {

package/dist/parsers/jamf_protect.d.ts

@@ -0,0 +1,2 @@
+import type { Detection } from '../types.js';
+export declare function parseJamfProtectFile(filePath: string): Detection | null;

package/dist/parsers/jamf_protect.js

@@ -0,0 +1,220 @@
+import { readFileSync } from 'fs';
+import { parse as parseYaml } from 'yaml';
+import { createHash } from 'crypto';
+// MITRE tactic normalization: Jamf's `MitreCategories` mixes CamelCase (`CredentialAccess`),
+// spaced (`Credential Access`), and Jamf-specific labels (`LivingOffTheLand`). Normalize the
+// input by lowercasing and stripping whitespace, then map to MITRE tactic kebab-case.
+const TACTIC_MAP = {
+    reconnaissance: 'reconnaissance',
+    resourcedevelopment: 'resource-development',
+    initialaccess: 'initial-access',
+    execution: 'execution',
+    persistence: 'persistence',
+    privilegeescalation: 'privilege-escalation',
+    defenseevasion: 'defense-evasion',
+    credentialaccess: 'credential-access',
+    discovery: 'discovery',
+    lateralmovement: 'lateral-movement',
+    collection: 'collection',
+    commandandcontrol: 'command-and-control',
+    exfiltration: 'exfiltration',
+    impact: 'impact',
+};
+// Best-effort mapping for Jamf-specific labels → MITRE techniques + tactics.
+// Claims are approximate and lossy but give the coverage-analysis tooling something to work with.
+const JAMF_LABEL_MAP = {
+    livingofftheland: {
+        techniques: ['T1059', 'T1218'],
+        tactics: ['execution', 'defense-evasion'],
+    },
+    knownmalware: {
+        techniques: ['T1204.002'],
+        tactics: ['execution'],
+    },
+    knownmaliciousfile: {
+        techniques: ['T1204.002'],
+        tactics: ['execution'],
+    },
+    adversaryinthemiddle: {
+        techniques: ['T1557'],
+        tactics: ['credential-access'],
+    },
+    credentialharvesting: {
+        techniques: ['T1555'],
+        tactics: ['credential-access'],
+    },
+    exploitation: {
+        techniques: ['T1203', 'T1068'],
+        tactics: ['execution', 'privilege-escalation'],
+    },
+    systemtampering: {
+        techniques: ['T1565'],
+        tactics: ['impact'],
+    },
+    visibility: {
+        techniques: [],
+        tactics: ['discovery'],
+    },
+    systemvisibility: {
+        techniques: [],
+        tactics: ['discovery'],
+    },
+};
+const TECHNIQUE_ID_RE = /^t(\d{4}(?:\.\d{3})?)$/;
+function extractMitre(raw) {
+    const ids = new Set();
+    const tactics = new Set();
+    const rawLabels = [];
+    if (!raw)
+        return { ids: [], tactics: [], rawLabels: [] };
+    for (const entry of raw) {
+        if (typeof entry !== 'string')
+            continue;
+        rawLabels.push(entry);
+        const normalized = entry.toLowerCase().replace(/[\s_-]/g, '');
+        const techMatch = normalized.match(TECHNIQUE_ID_RE);
+        if (techMatch) {
+            ids.add(`T${techMatch[1].toUpperCase()}`);
+            continue;
+        }
+        if (TACTIC_MAP[normalized]) {
+            tactics.add(TACTIC_MAP[normalized]);
+            continue;
+        }
+        const labelMapping = JAMF_LABEL_MAP[normalized];
+        if (labelMapping) {
+            labelMapping.techniques.forEach(t => ids.add(t));
+            labelMapping.tactics.forEach(t => tactics.add(t));
+        }
+    }
+    return { ids: [...ids], tactics: [...tactics], rawLabels };
+}
+function extractDataSources(inputType) {
+    const base = 'macOS Endpoint Security';
+    switch (inputType) {
+        case 'GPProcessEvent':
+            return ['Process Events', base];
+        case 'GPFSEvent':
+            return ['File System Events', base];
+        case 'GPKeylogRegisterEvent':
+            return ['Keylog Register Events', base];
+        case 'GPUSBEvent':
+            return ['USB Events', base];
+        default:
+            return inputType ? [inputType, base] : [base];
+    }
+}
+// Pull process names from NSPredicate filter text.
+// Jamf filters reference processes via `path.lastPathComponent == "<name>"` or
+// `signingInfo.appid == "com.apple.<name>"`.
+function extractProcessNames(filter) {
+    const names = new Set();
+    const lastComponentRe = /lastPathComponent\s*==\s*"([^"]+)"/gi;
+    let m;
+    while ((m = lastComponentRe.exec(filter)) !== null) {
+        if (m[1])
+            names.add(m[1]);
+    }
+    const appidRe = /signingInfo\.appid\s*==\s*"com\.apple\.([A-Za-z0-9_.-]+)"/gi;
+    while ((m = appidRe.exec(filter)) !== null) {
+        if (m[1])
+            names.add(m[1]);
+    }
+    return [...names];
+}
+// Pull quoted absolute-path references from NSPredicate filter text.
+function extractFilePaths(filter) {
+    const paths = new Set();
+    const re = /"(\/[^"\s]+)"/g;
+    let m;
+    while ((m = re.exec(filter)) !== null) {
+        const candidate = m[1];
+        if (candidate.length < 3)
+            continue;
+        // Skip bundle identifiers and uri-ish schemes.
+        if (!candidate.startsWith('/'))
+            continue;
+        paths.add(candidate);
+    }
+    return [...paths];
+}
+function normalizeSeverity(severity) {
+    if (!severity)
+        return null;
+    return severity.toLowerCase();
+}
+function generateId(filePath, name, uuid) {
+    // Upstream Jamf content occasionally reuses the same uuid across different files
+    // (e.g. openclaw_directory_created vs openclaw_onboard both declare the same uuid).
+    // Incorporate the filename into the hash so each file produces a unique id; keep
+    // the uuid as a prefix when available so it's still recognizable.
+    const basename = filePath.split('/').pop() || filePath;
+    const hash = createHash('sha256').update(`${filePath}:${name}`).digest('hex').substring(0, 12);
+    if (uuid) {
+        return `jamf-${uuid}-${hash}`;
+    }
+    return `jamf-${createHash('sha256').update(`${basename}:${name}`).digest('hex').substring(0, 32)}`;
+}
+export function parseJamfProtectFile(filePath) {
+    try {
+        const content = readFileSync(filePath, 'utf-8');
+        const rule = parseYaml(content);
+        if (!rule || typeof rule !== 'object')
+            return null;
+        if (!rule.name || !rule.filter)
+            return null;
+        const mitre = extractMitre(rule.MitreCategories ?? null);
+        const baseTags = Array.isArray(rule.tags)
+            ? rule.tags.filter((t) => typeof t === 'string')
+            : [];
+        const categoryTags = Array.isArray(rule.categories)
+            ? rule.categories.filter((t) => typeof t === 'string')
+            : [];
+        // Preserve the raw Jamf MITRE labels so their original semantics stay searchable.
+        const tags = [...new Set([...baseTags, ...categoryTags, ...mitre.rawLabels])];
+        const description = rule.longDescription || rule.shortDescription || '';
+        const id = generateId(filePath, rule.name, rule.uuid);
+        const detection = {
+            id,
+            name: rule.label || rule.name,
+            description,
+            query: rule.filter,
+            source_type: 'jamf_protect',
+            mitre_ids: mitre.ids,
+            logsource_category: rule.inputType || null,
+            logsource_product: 'macos',
+            logsource_service: 'jamf_protect',
+            severity: normalizeSeverity(rule.severity),
+            status: null,
+            author: 'Jamf',
+            date_created: null,
+            date_modified: null,
+            references: [],
+            falsepositives: [],
+            tags,
+            file_path: filePath,
+            raw_yaml: content,
+            cves: [],
+            analytic_stories: [],
+            data_sources: extractDataSources(rule.inputType),
+            detection_type: 'TTP',
+            asset_type: 'Endpoint',
+            security_domain: 'endpoint',
+            process_names: extractProcessNames(rule.filter),
+            file_paths: extractFilePaths(rule.filter),
+            registry_paths: [],
+            mitre_tactics: mitre.tactics,
+            platforms: ['macos'],
+            kql_category: null,
+            kql_tags: [],
+            kql_keywords: [],
+            sublime_attack_types: [],
+            sublime_detection_methods: [],
+            sublime_tactics: [],
+        };
+        return detection;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/resources/index.js

@@ -9,6 +9,16 @@
  */
 import { getStats, analyzeCoverage, identifyGaps, listByMitre, listByMitreTactic, listBySource, generateNavigatorLayer, isStixLoaded, getActorByName, getActorCoverage, getActorTechniques, getSoftwareForActor, } from '../db/index.js';
 import { openEntity, listDecisions, listLearnings, getKnowledgeStats, } from '../db/knowledge.js';
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
+function countBySource(detections) {
+    const counts = Object.fromEntries(SOURCE_TYPES.map((source) => [source, 0]));
+    for (const detection of detections) {
+        if (SOURCE_TYPES.includes(detection.source_type)) {
+            counts[detection.source_type]++;
+        }
+    }
+    return counts;
+}
 // =============================================================================
 // STATIC RESOURCES
 // =============================================================================
@@ -47,7 +57,7 @@ export const resources = [
     {
         uri: 'detection://sources/comparison',
         name: 'Source Comparison',
-        description: 'Quick comparison of detection counts across sources (sigma, splunk, elastic, kql)',
+        description: 'Quick comparison of detection counts across all sources',
         mimeType: 'application/json',
     },
     // Navigator layer
@@ -96,7 +106,7 @@ export const resourceTemplates = [
     {
         uriTemplate: 'detection://source/{sourceType}',
         name: 'Source Statistics',
-        description: 'Get statistics and detections for a specific source type (sigma, splunk_escu, elastic, kql)',
+        description: 'Get statistics and detections for a specific source type',
         mimeType: 'application/json',
     },
     {
@@ -114,7 +124,7 @@ export const resourceTemplates = [
     {
         uriTemplate: 'detection://navigator/layer/{sourceType}',
         name: 'Source-Filtered Navigator Layer',
-        description: 'ATT&CK Navigator layer filtered by detection source (sigma, splunk_escu, elastic, kql, sublime, crowdstrike_cql)',
+        description: 'ATT&CK Navigator layer filtered by detection source',
         mimeType: 'application/json',
     },
     {
@@ -152,12 +162,7 @@ function getTechniqueResource(techniqueId) {
             description: d.description?.substring(0, 200) +
                 (d.description && d.description.length > 200 ? '...' : ''),
         })),
-        by_source: {
-            sigma: detections.filter((d) => d.source_type === 'sigma').length,
-            splunk_escu: detections.filter((d) => d.source_type === 'splunk_escu').length,
-            elastic: detections.filter((d) => d.source_type === 'elastic').length,
-            kql: detections.filter((d) => d.source_type === 'kql').length,
-        },
+        by_source: countBySource(detections),
     };
 }
 /**
@@ -189,19 +194,14 @@ function getTacticResource(tactic) {
             severity: d.severity,
             mitre_ids: d.mitre_ids,
         })),
-        by_source: {
-            sigma: detections.filter((d) => d.source_type === 'sigma').length,
-            splunk_escu: detections.filter((d) => d.source_type === 'splunk_escu').length,
-            elastic: detections.filter((d) => d.source_type === 'elastic').length,
-            kql: detections.filter((d) => d.source_type === 'kql').length,
-        },
+        by_source: countBySource(detections),
     };
 }
 /**
  * Get statistics and sample detections for a source type
  */
 function getSourceResource(sourceType) {
-    const validSources = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'];
+    const validSources = [...SOURCE_TYPES];
     const normalizedSource = sourceType.toLowerCase();
     if (!validSources.includes(normalizedSource)) {
         return {
@@ -388,12 +388,7 @@ function getStaticResourceContent(uri) {
             const stats = getStats();
             return {
                 total_detections: stats.total,
-                by_source: {
-                    sigma: stats.sigma,
-                    splunk_escu: stats.splunk_escu,
-                    elastic: stats.elastic,
-                    kql: stats.kql,
-                },
+                by_source: Object.fromEntries(SOURCE_TYPES.map((source) => [source, stats[source]])),
                 by_severity: stats.by_severity,
                 mitre_coverage: stats.mitre_coverage,
                 by_mitre_tactic: stats.by_mitre_tactic,

package/dist/server.js

@@ -133,7 +133,7 @@ export function createServer() {
                 break;
             case 'source_type':
             case 'source':
-                values = ['sigma', 'splunk_escu', 'elastic', 'kql'].filter(s => s.toLowerCase().startsWith(prefix.toLowerCase()));
+                values = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'].filter(s => s.toLowerCase().startsWith(prefix.toLowerCase()));
                 break;
             case 'threat_profile':
             case 'profile':

package/dist/tools/autonomous/index.js

@@ -23,6 +23,7 @@ import { requestAnalysis, getSamplingStatus } from '../../handlers/sampling.js';
 // ============================================================================
 // Helper Functions
 // ============================================================================
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
 /**
  * Format current timestamp for storage
  */
@@ -221,7 +222,7 @@ Use this for executive-level reporting on detection posture.`,
             // Compare detections across sources for high-priority techniques
             const highPriorityTechniques = ['T1059.001', 'T1003.001', 'T1547.001', 'T1486', 'T1078'];
             const sourceStats = {};
-            for (const source of ['sigma', 'splunk_escu', 'elastic', 'kql']) {
+            for (const source of SOURCE_TYPES) {
                 const detections = listBySource(source, 9999);
                 sourceStats[source] = detections.length;
             }
@@ -368,7 +369,7 @@ Use this to understand the strengths/weaknesses of different detection sources a
         const includeQualityAnalysis = args.include_quality_analysis !== false;
         const sessionId = args.session_id;
         ensureDynamicSchema();
-        const sources = ['sigma', 'splunk_escu', 'elastic', 'kql'];
+        const sources = SOURCE_TYPES;
         // Get overall stats by source
         const sourceStats = {};
         for (const source of sources) {

package/dist/tools/cache/index.js

@@ -17,6 +17,9 @@ const SPLUNK_PATHS = parsePaths(process.env.SPLUNK_PATHS);
 const ELASTIC_PATHS = parsePaths(process.env.ELASTIC_PATHS);
 const STORY_PATHS = parsePaths(process.env.STORY_PATHS);
 const KQL_PATHS = parsePaths(process.env.KQL_PATHS);
+const SUBLIME_PATHS = parsePaths(process.env.SUBLIME_PATHS);
+const CQL_HUB_PATHS = parsePaths(process.env.CQL_HUB_PATHS);
+const JAMF_PROTECT_PATHS = parsePaths(process.env.JAMF_PROTECT_PATHS);
 // =============================================================================
 // Saved Query Tools
 // =============================================================================
@@ -154,10 +157,10 @@ const rebuildIndexTool = defineTool({
     handler: async (args) => {
         const confirmArg = args?.confirm;
         const skipElicitation = args?.skip_elicitation;
-        if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0) {
+        if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0 && ELASTIC_PATHS.length === 0 && KQL_PATHS.length === 0 && SUBLIME_PATHS.length === 0 && CQL_HUB_PATHS.length === 0 && JAMF_PROTECT_PATHS.length === 0) {
             return {
                 error: true,
-                message: 'No paths configured. Set SIGMA_PATHS, SPLUNK_PATHS, ELASTIC_PATHS, and/or KQL_PATHS environment variables.',
+                message: 'No paths configured. Set SIGMA_PATHS, SPLUNK_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS, and/or JAMF_PROTECT_PATHS environment variables.',
             };
         }
         const currentStats = getStats();
@@ -225,7 +228,7 @@ const rebuildIndexTool = defineTool({
         console.error('[security-detections-mcp] Rebuilding index...');
         // Recreate DB to apply schema changes
         recreateDb();
-        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS);
+        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS, STORY_PATHS, ELASTIC_PATHS, KQL_PATHS, SUBLIME_PATHS, CQL_HUB_PATHS, JAMF_PROTECT_PATHS);
         // Notify subscribers that resources have changed
         try {
             await notifyResourceChange('detection://stats');

package/dist/tools/detections/actor-analysis.js

@@ -6,7 +6,7 @@
  */
 import { defineTool } from '../registry.js';
 import { isStixLoaded, getActorByName, listActors, getActorTechniques, getActorCoverage, getSoftwareForActor, getAttackStats, generateNavigatorLayer, } from '../../db/index.js';
-const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'];
+const SOURCE_TYPES = ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'];
 function stixNotLoadedError() {
     return {
         error: true,

package/dist/tools/detections/analysis.js

@@ -24,7 +24,7 @@ export const analysisTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type',
                 },
                 tactic: {
@@ -67,7 +67,7 @@ export const analysisTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional - analyzes all if not specified)',
                 },
             },
@@ -91,7 +91,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional)',
                 },
             },
@@ -125,7 +125,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional)',
                 },
             },
@@ -177,7 +177,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter to specific source type (optional — includes all if omitted)',
                 },
                 tactic: {
@@ -228,7 +228,7 @@ export const analysisTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter to specific source (optional — analyzes all if omitted)',
                 },
                 include_query_snippets: {
@@ -266,7 +266,7 @@ export const analysisTools = [
                     type: 'array',
                     items: {
                         type: 'string',
-                        enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                        enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     },
                     description: 'Sources to compare (default: all available)',
                 },

package/dist/tools/detections/comparison.js

@@ -15,7 +15,7 @@ export const comparisonTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Optional: filter by source type',
                 },
                 limit: {
@@ -147,7 +147,7 @@ export const comparisonTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Optional: filter to specific source',
                 },
             },
@@ -235,7 +235,7 @@ export const comparisonTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter by source type (optional)',
                 },
             },

package/dist/tools/detections/filters.js

@@ -10,7 +10,7 @@ export const filterTools = [
             properties: {
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Source type to filter by',
                 },
                 limit: {

package/dist/tools/detections/search.js

@@ -22,7 +22,7 @@ export const searchTools = [
                 },
                 source_type: {
                     type: 'string',
-                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                    enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                     description: 'Filter results by detection source type',
                 },
             },

package/dist/tools/engineering/index.js

@@ -27,7 +27,7 @@ const getQueryPatternsTool = defineTool({
             },
             source_type: {
                 type: 'string',
-                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                 description: 'Filter patterns by source type (optional)',
             },
         },
@@ -175,7 +175,7 @@ const findSimilarDetectionsTool = defineTool({
             },
             source_type: {
                 type: 'string',
-                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql'],
+                enum: ['sigma', 'splunk_escu', 'elastic', 'kql', 'sublime', 'crowdstrike_cql', 'jamf_protect'],
                 description: 'Filter by source type (optional)',
             },
             limit: {

package/dist/types/detection.d.ts

@@ -10,7 +10,7 @@ export interface Detection {
     name: string;
     description: string;
     query: string;
-    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     mitre_ids: string[];
     logsource_category: string | null;
     logsource_product: string | null;
@@ -49,7 +49,7 @@ export interface Detection {
 export interface DetectionSummary {
     id: string;
     name: string;
-    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql';
+    source_type: 'sigma' | 'splunk_escu' | 'elastic' | 'kql' | 'sublime' | 'crowdstrike_cql' | 'jamf_protect';
     mitre_ids: string[];
     severity: string | null;
     mitre_tactics: string[];
@@ -190,6 +190,31 @@ export interface ElasticTechnique {
     reference?: string;
     subtechnique?: ElasticTechnique[];
 }
+/**
+ * Jamf Protect custom analytic detection structure (YAML with NSPredicate filter).
+ * @see https://github.com/jamf/jamfprotect/tree/main/custom_analytic_detections
+ */
+export interface JamfProtectRule {
+    name: string;
+    uuid?: string;
+    label?: string;
+    shortDescription?: string;
+    longDescription?: string;
+    level?: number;
+    inputType?: 'GPProcessEvent' | 'GPFSEvent' | 'GPKeylogRegisterEvent' | 'GPUSBEvent' | string;
+    filter: string;
+    severity?: 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical' | string;
+    categories?: string[];
+    MitreCategories?: string[] | null;
+    tags?: string[] | null;
+    snapshotFiles?: string[] | null;
+    actions?: Array<{
+        name?: string;
+    } | string>;
+    context?: string[] | null;
+    version?: number;
+    remediation?: string | null;
+}
 /**
  * CQL Hub rule structure (CrowdStrike Query Language)
  * @see https://github.com/ByteRay-Labs/Query-Hub

package/dist/types/index.d.ts

@@ -11,7 +11,7 @@
  * - dynamic: Dynamic table types for runtime schema extension
  * - meta: Meta-tool types for custom tools and workflows
  */
-export type { Detection, DetectionSummary, SigmaRule, SplunkDetection, ElasticRule, ElasticThreat, ElasticTechnique, SublimeRule, CqlHubRule, } from './detection.js';
+export type { Detection, DetectionSummary, SigmaRule, SplunkDetection, ElasticRule, ElasticThreat, ElasticTechnique, SublimeRule, CqlHubRule, JamfProtectRule, } from './detection.js';
 export type { AnalyticStory, SplunkStoryYaml, } from './story.js';
 export type { IndexStats, SourceComparison, SavedQuery, } from './stats.js';
 export type { KnowledgeEntity, KnowledgeRelation, KnowledgeObservation, KnowledgeDecision, KnowledgeLearning, KnowledgeQueryOptions, } from './knowledge.js';

package/dist/types/stats.d.ts

@@ -12,6 +12,8 @@ export interface IndexStats {
     elastic: number;
     kql: number;
     sublime: number;
+    crowdstrike_cql: number;
+    jamf_protect: number;
     by_severity: Record<string, number>;
     by_logsource_product: Record<string, number>;
     mitre_coverage: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "security-detections-mcp",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "description": "Advanced MCP server for security detections with Detection Engineering Intelligence, Knowledge Graph (Tribal Knowledge), Elicitation, and Resource Subscriptions",
   "sigmaSpecVersion": "2.0.0",
   "type": "module",
@@ -20,11 +20,12 @@
     "build": "tsc",
     "start": "node dist/index.js",
     "dev": "tsc --watch",
-    "test": "npm run build && node tests/cross-platform-test.js && node tests/integration-test.js && node tests/engineering-tools-test.js",
+    "test": "npm run build && node tests/cross-platform-test.js && node tests/jamf-parser-test.js && node tests/integration-test.js && node tests/engineering-tools-test.js",
     "test:platform": "npm run build && node tests/cross-platform-test.js",
     "test:ci": "npm run build && node tests/ci-integration-test.js",
     "test:integration": "npm run build && node tests/integration-test.js",
     "test:engineering": "npm run build && node tests/engineering-tools-test.js",
+    "test:jamf": "npm run build && node tests/jamf-parser-test.js",
     "lint": "tsc --noEmit --strict",
     "prepublishOnly": "npm run build && npm run lint"
   },
@@ -43,6 +44,8 @@
     "sublime",
     "crowdstrike",
     "cql",
+    "jamf",
+    "macos",
     "siem",
     "mitre",
     "attack"