security-digest

Security Digest

Setup Check

Before generating a digest, verify the primary server is reachable:

• UNIFI_PROTECT_HOST must be set — this is the required variable for the Protect MCP server.
• Confirm connectivity by calling protect_tool_index to verify the Protect server is available.

For full cross-product correlation (CORR-01 through CORR-05), the unifi-network and unifi-access plugins must also be configured. Check availability by calling unifi_tool_index and access_tool_index. Correlation rules that span missing servers are automatically skipped — the digest degrades gracefully to single-source output.

Generating a Digest

Determine the Time Range

Default ranges if the user does not specify:

• overnight — last 12 hours (6 pm to 6 am)
• today — since midnight
• recent — last 4 hours

Gather Events (parallel batch calls per server)

Use each server's batch tool to gather events in parallel within that server. Do not call these tools one at a time.

From Protect (required):

Use protect_list_smart_detections as the primary source — these are the highest-signal events (person, vehicle, package, animal). Only add protect_list_events with event_type=motion if you need raw motion data beyond smart detections. Skip protect_recent_events for digests — it only contains the last few minutes of buffered events and adds little value for historical ranges.

protect_batch([
  { "tool": "protect_list_smart_detections", "args": { "start": "...", "limit": 50, "compact": true } },
  { "tool": "protect_list_events", "args": { "start": "...", "event_type": "ring", "limit": 20, "compact": true } }
])

Use compact=true on all event queries for digests — it strips thumbnail_id, category, sub_category, and is_favorite fields, reducing response size by ~40%.

Events now include camera_name alongside camera_id — no need to call protect_list_cameras separately to resolve names.

From Access (if available):

access_batch([
  { "tool": "access_list_events", "args": { ... time range ... } },
  { "tool": "access_recent_events" },
  { "tool": "access_get_activity_summary" }
])