DOCSEARCHbyAlgolia
Submit Docs

Jamf Protect Open Source Resources

repository·main·Indexed 42 days ago

https://github.com/jamf/jamfprotect

A collection of open-source resources, scripts, and configurations for Jamf Protect on macOS. Includes building blocks for Custom Analytic Detections (predicate expressions, sensor event types), device control profiles to restrict iOS/iPadOS syncing via Finder, and helper tools for automating protectctl diagnostics uploads to AWS S3, Azure Files, and Google Cloud Storage. Also features the jp_event_analysis.py tool for optimizing monitoring and building exception rules.

Tokens
11K
Snippets
18
Records
57
Agent score
52%

What's inside Jamf Protect

  1. Overview of Jamf Protect Open-Source Resources

    main

    This repository provides a collection of open-source resources designed to extend and enhance the capabilities of Jamf Protect. It includes tools for behavioral detection, device control, data streaming, automation, and integration with third-party security ecosystems.

    Key resource categories available in this repository include:

    • Custom Analytics (Behavioural Detection): Predicates to extend Jamf Protect's behavioral detection capabilities.
    • Device Controls: Examples of using MDM to impose restrictions on removable storage media alongside Jamf Protect.
    • JSON Samples and Schemas: Event schemas and examples for streaming Jamf Protect data to third-party storage solutions.
    • Unified Log Filters: Predicates to streamline system, user, application, and network activity data for SIEM or third-party storage.
    • Jamf Protect API Scripts: Scripts utilizing the Jamf Protect GraphQL API for endpoint management, compliance reporting, and tenant management.
    • SOAR Playbooks: Automation workflows leveraging the integration between Jamf Protect and Jamf Pro for security incident remediation.
    • Jamf Pro Extension Attributes: Custom data collection for Jamf Pro to enable advanced remediation and conditional access workflows.
    • Telemetry Examples: Best practices and advanced configurations for Jamf Protect Telemetry.
    • Helper Tools: Scripts and resources to assist in implementing Jamf Protect.
    • Third Party Integrations: Examples and workflows for integrating Jamf Protect with various third-party solutions.

  2. Overview of Jamf Protect Device Controls resources

    main

    This repository contains community-provided resources, examples, and scripts related to Jamf Protect Device Controls. These resources are intended to assist with implementing or managing device restrictions and controls within the Jamf Protect ecosystem.

    Note: All resources in this repository are provided as-is and are not officially supported by Jamf Support. For official documentation on built-in Device Controls, refer to the Jamf Protect Documentation.

  5. Use Telemetry in Jamf Protect

    main

    Jamf Protect Telemetry provides guidance and examples for implementing data collection and detection logic. This repository contains specific implementations for:

    • Simple Log File Collection: Guidance on collecting specific log files.
    • macOS Detection Rules: Detection rules written in the Sigma open standard.

    Because the detection rules use the Sigma standard, you can convert them to various SIEM data model formats using tools like sigconverter.io.

  7. How Simple Log File Collection works in Jamf Protect Telemetry

    main

    Jamf Protect Telemetry includes an optional feature to monitor and collect entries from specific simple log files. Once activated, Jamf Protect performs the following lifecycle:

    1. Initial Gathering: It gathers all existing content from the specified log files.
    2. Continuous Streaming: It continuously streams any new entries to your Security Information and Event Monitoring (SIEM) solution.
    3. Frequency: New entries are streamed every minute.

    Requirement: Configured log files must adhere to a format where entries are separated by a new line.

  8. How SOAR Playbooks work with Jamf Protect and Jamf Pro

    main

    SOAR playbooks are workflows designed to execute on an endpoint via Jamf Pro in response to an analytic detection from Jamf Protect. This automation relies on the remediation integration between Jamf Protect and Jamf Pro.

    Prerequisites:

    • The endpoint must be enrolled in Jamf Protect.
    • The endpoint must be enrolled in a Jamf Pro environment.

    Operational Workflow:

    1. Detection: A security event occurs on an endpoint and is detected by Jamf Protect's analytic feature.
    2. Tagging: The Jamf Protect agent executes an action that places the endpoint into a specific Smart Computer Group in Jamf Pro.
    3. Scoping: Once in the Smart Computer Group, the endpoint becomes eligible for management objects (such as Policies or Configuration Profiles) scoped to that group.
    4. Remediation: The Jamf Pro management framework proactively checks for and executes these pending management actions to remediate the threat.

  9. What are Custom Analytic Detections in Jamf Protect?

    main

    Jamf Protect's Analytics feature allows for the detection of sensitive, suspicious, or malicious behavior on macOS endpoints by performing logical analysis of system-wide events.

    While Jamf provides managed detections, users can deploy Custom Analytics to meet specific environment needs for threat hunting and audit trails. The resources in this repository provide the building blocks for these custom detections, specifically:

    • Predicate expression: The logical query used to identify specific event patterns.
    • Sensor Event Type: The specific category of event the analytic must monitor.
    • Analytic Level: The recommended setting for the depth of analysis.
    • Severity: The recommended impact level for the detection.