Security Digest

Setup Check

Before generating a digest, verify the primary server is reachable:

• UNIFI_PROTECT_HOST must be set — this is the required variable for the Protect MCP server.
• Confirm connectivity by calling protect_tool_index to verify the Protect server is available.

For full cross-product correlation (CORR-01 through CORR-05), the unifi-network and unifi-access plugins must also be configured. Check availability by calling unifi_tool_index and access_tool_index. Correlation rules that span missing servers are automatically skipped — the digest degrades gracefully to single-source output.

Generating a Digest

Determine the Time Range

Default ranges if the user does not specify:

• overnight — last 12 hours (6 pm to 6 am)
• today — since midnight
• recent — last 4 hours