---
name: security-digest
description: Generate a security digest summarizing events across UniFi Protect cameras, Access door events, and Network firewall activity. Use when asked about what happened overnight, security summary, event digest, recent activity, or reviewing camera and access events.
---

# Security Digest

## Setup Check

Before generating a digest, verify the primary server is reachable:

- `UNIFI_PROTECT_HOST` must be set — this is the required variable for the Protect MCP server.
- Confirm connectivity by calling `protect_tool_index` to verify the Protect server is available.

For full cross-product correlation (CORR-01 through CORR-05), the unifi-network and unifi-access plugins must also be configured. Check availability by calling `unifi_tool_index` and `access_tool_index`. Correlation rules that span missing servers are automatically skipped — the digest degrades gracefully to single-source output.

## Generating a Digest

### Determine the Time Range

Default ranges if the user does not specify:
- **overnight** — last 12 hours (6 pm to 6 am)
- **today** — since midnight
- **recent** — last 4 hours

### Gather Events (parallel batch calls per server)

Use each server's batch tool to gather events in parallel within that server. Do not call these tools one at a time.

**From Protect** (required):

Use `protect_list_smart_detections` as the primary source — these are the highest-signal events (person, vehicle, package, animal). Only add `protect_list_events` with `event_type=motion` if you need raw motion data beyond smart detections. Skip `protect_recent_events` for digests — it only contains the last few minutes of buffered events and adds little value for historical ranges.

```
protect_batch([
  { "tool": "protect_list_smart_detections", "args": { "start": "...", "limit": 50, "compact": true } },
  { "tool": "protect_list_events", "args": { "start": "...", "event_type": "ring", "limit": 20, "compact": true } }
])
```

Use `compact=true` on all event queries for digests — it strips thumbnail_id, category, sub_category, and is_favorite fields, reducing response size by ~40%.

Events now include `camera_name` alongside `camera_id` — no need to call `protect_list_cameras` separately to resolve names.

**From Access** (if available):

```
access_batch([
  { "tool": "access_list_events", "args": { ... time range ... } },
  { "tool": "access_recent_events" },
  { "tool": "access_get_activity_summary" }
])
```

**From Network** (if available):

```
unifi_batch([
  { "tool": "unifi_list_alarms" },
  { "tool": "unifi_list_events", "args": { ... time range ... } }
])
```

The three batch calls (Protect, Access, Network) can be issued concurrently — they target independent servers.

## Analyzing Events

Use these reference documents to classify and correlate the gathered events:

- `references/event-types.md` — catalog of all event type codes from Protect, Access, and Network, with key fields and digest relevance. Consult before labeling any event type.
- `references/correlation-rules.md` — the five deterministic cross-product correlation rules (CORR-01 through CORR-05) with their logic, time windows, and recommended responses. Apply these when data from multiple servers is available.
- `references/severity-model.md` — how base severity is computed and modified by time of day, location, and event frequency. Includes the full classification matrix. Apply this before assigning High/Medium/Low labels.

Smart detection events (person, vehicle, package) are the highest-signal items — prioritize these when reviewing Protect data.

**Status classification:**
- `clear` — no notable events; nothing requires attention. Lead with "nothing to worry about."
- `notable` — medium-severity events present; worth reviewing.
- `alert` — one or more high-severity events or fired correlations; prompt review warranted.

Do not invent concerns for quiet periods.

## Cross-Product Correlation

When events from multiple servers are available, apply the five deterministic rules from `references/correlation-rules.md`:

| Rule | Sources | Window | Severity | Pattern |
|------|---------|--------|----------|---------|
| CORR-01 | Protect + Access | 2 min | High | Motion at an entry camera with no corresponding badge-in |
| CORR-02 | Network + Protect | 5 min | Medium | New/unknown device on the network near a person detection |
| CORR-03 | Access + Protect | 3 min | High | Access denied at a door followed by continued motion |
| CORR-04 | Network + Protect | 5 min | High | Network device offline coinciding with camera disconnections |
| CORR-05 | Access + Protect | 5 min | Low | After-hours badge-in with no approach motion before it (audit trail) |

When multiple rules fire on the same events, the highest severity wins and the rules are listed together in a single merged incident. See `references/correlation-rules.md` for full logic and pseudocode.

## Report Format

```
## Security Digest — [date/time range]

### Summary
[1-2 sentence overview]

### Notable Events
[Chronological; only events worth human attention]

**[Time] — [Event description]**
- Source: [Protect/Access/Network]
- Severity: [High/Medium/Low]
- [Correlation rule if applicable]

### Activity Counts
| Source | Events | Notable |
|--------|--------|---------|
| Protect | [count] | person=[n] vehicle=[n] package=[n] |
| Access | [count] | denied=[n] |
| Network | [count] | alarms=[n] |

### Recommendations
[Only if action is warranted]
```

## Tips

- Use each server's batch tool for parallel data gathering within that server. The three server batches (Protect, Access, Network) can run concurrently.
- Smart detections (person, vehicle, package) are the highest-signal events — surface these first when summarizing.
- If only one MCP server is available, produce a single-source digest. Do not apologize for missing data — work with what is connected.
- Use `protect_get_event_thumbnail` to offer visual evidence for notable person or vehicle detections when the user wants to see what triggered an alert.
- The most security value comes from overnight and 24h ranges where time-of-day severity modifiers (from `references/severity-model.md`) elevate routine events to notable ones.
- If status is `clear`, lead with that — do not manufacture concerns for quiet periods.