Jamf ProtectBeispiele für Suchvorgänge und Visualisierungen in

Dieser Abschnitt enthält Beispiele für Paare von Suchvorgängen und Visualisierungen, die Sie als Grundlage für die Anzeige Ihrer Daten auf einem Dashboard verwenden können.

Die folgenden Beispiele beziehen sich auf Suchvorgänge anhand von Daten, die über Jamf Protect for Splunk erfasst wurden.

Weitere Informationen zu Splunk Dashboards finden Sie unter Dashboards and Visualizations (Dashboards und Visualisierungen) in der Splunk.

Protokolle und Alarme nach Ereignistyp

Suchen Visualisierung

Suchen	Visualisierung
eventtype="jamf_protect" input.host.hostname="*" severity_id>0 \| dedup id \| stats count by event_name \| rename event_name AS "Event", count AS "Count" \| replace "GPDownloadEvent" with "Download Event", "GPFSEvent" with "File System Event", "GPGatekeeperEvent" with "Gatekeeper Event", "GPPreventedExecutionEvent" with "Custom Prevention", "GPProcessEvent" with "Process Event", "GPThreatMatchExecEvent" with "Threat Prevention", "auth-mount" with "Device Controls" , "GPClickEvent" with "Synthetic Click Event", "GPUSBEvent" with "USB Event" in Event

eventtype="jamf_protect" input.host.hostname="*" severity_id>0
| dedup id
| stats count by event_name
| rename
    event_name AS "Event",
    count AS "Count"
| replace 
    "GPDownloadEvent" with "Download Event", 
    "GPFSEvent" with "File System Event", 
    "GPGatekeeperEvent" with "Gatekeeper Event", 
    "GPPreventedExecutionEvent" with "Custom Prevention", 
    "GPProcessEvent" with "Process Event", 
    "GPThreatMatchExecEvent" with "Threat Prevention", 
    "auth-mount" with "Device Controls" , 
    "GPClickEvent" with "Synthetic Click Event",
    "GPUSBEvent" with "USB Event"
    in Event

Anzahl erkannter Ereignisse mit Analyse


Suchen	Visualisierung
`source = "http:Jamf Protect" \| stats count by input.eventType, input.match.facts{}.name \| rename input.eventType AS "Event Type", input.match.facts{}.name AS "Event", count AS "Count" \| sort Count desc \| head 10`

Aufschlüsselung nach den 10 wichtigsten Ereignistypen

Suchen Visualisierung

Suchen	Visualisierung
`eventtype=jamf_protect_alerts input.host.hostname="*" event_name!="GPUnifiedLogEvent" \| dedup id \| stats count by event_name, detection_name \| rename event_name AS "Event Type", detection_name AS "Event", count AS "Count" \| sort Count desc \| head 10`

 eventtype=jamf_protect_alerts input.host.hostname="*" event_name!="GPUnifiedLogEvent"
| dedup id
| stats count by event_name, detection_name
| rename
    event_name AS "Event Type",
    detection_name AS "Event",
    count AS "Count" 
| sort Count desc 
| head 10

Von Gatekeeper blockierte ausführbare Dateien


Suchen	Visualisierung
`source = "http:Jamf Protect" input.eventType="GPGatekeeperEvent" \| stats count by input.match.facts{}.name, input.match.event.path \| rename input.match.facts{}.name AS "Block Type", input.match.event.path AS "Executable" \| head 10`