security-digest

You can summarize overnight UniFi Protect camera events and door access logs by correlating detections, access signals, and network alarms into a single prioritized digest report. The security summary applies deterministic correlation rules to merge cross-source incidents for fast review.

Cross-source event correlation for security incident triage is the process of merging UniFi Protect camera detections, UniFi Access door events, and UniFi Network alarms using deterministic rules. This identifies related activities across systems and escalates them into merged, prioritized incidents.

To generate a daily security review, the system applies a severity model driven by time of day, location, frequency, and correlation escalations. It labels events as Low, Medium, High, or Critical and produces an overview with chronological notable events and activity counts.

Yes, you can run an incident triage digest when some UniFi Access or UniFi Network sources are unavailable. The system uses graceful degradation to process connected MCP servers and summarize available camera, door, and network alarm events without failing the entire report.

The security digest requires connected MCP servers to retrieve UniFi Protect, UniFi Access, and UniFi Network data for correlation. It also requires YAML-frontmatter inputs for discovery and applies deterministic correlation rules to generate the prioritized report.

The best way to investigate recent UniFi Protect activity is to generate a custom range security digest that correlates camera events with door access and network alarms. This produces a chronological list of notable events, activity counts per source, and actionable recommendations.