Lesson 10: macOS Security Portal Data Management - Jamf 170 Course

Jamf 170 Course
Solution
Application
Content Type
Training Content
Utilities & Services
ft:locale
en-US

Goal

Explore the different data collection and management options in the macOS Security portal.

Video

Key points

  • Computers with Jamf Protect can be configured to report varying levels of security data for storage and compliance.

  • By default, only alert data is logged and sent to the Jamf Protect Cloud.

  • Data forwarding can be configured to send additional data from Jamf Protect Cloud on to a third-party storage solution, including:

    • Amazon S3

    • Microsoft Sentinel

    • Google Security Operations (SecOps)

  • Alert data collection can be customized in an action configuration.

    • By default, only high, medium, and low severity alert data are sent to the Jamf Protect Cloud.

  • Data forwarding must be configured to collect telemetry or unified logs.

  • The unified logging system in macOS provides a central location to store all log data on a Mac.

  • Unified log data can be filtered using programming expressions called "predicates" to extract specific event data.

  • Event data from unified log filters can be then sent to a data forwarding location configured in the macOS Security portal.

  • Telemetry data from computers enrolled in Jamf Protect can be sent to third-party security information and event management (SIEM) solutions.

  • Telemetry event collection can be configured to include one or more of the following categories:

    • Applications and processes

    • Access and authentication

    • Users and groups

    • Persistence

    • Hardware and volumes

    • Apple security

    • System

  • Telemetry configurations can include diagnostic and crash reports as well as performance metrics.

  • Telemetry configurations can collect specific logs from enrolled computers by providing a file path in the Simple log file collection field.

    • For example, to collect the Jamf policy log, enter /var/log/jamf.log.

  • Telemetry configurations can be added to a plan in the macOS Security portal in order to deploy them to computers.

Review

To view answers, click arrow next to each question.

  1. What feature must be enabled in the macOS Security portal to send data to a third-party storage solution like Amazon S3 or Microsoft Sentinel?
    Data forwarding must be enabled in order for data to pass from the Jamf Protect Cloud to a third-party storage solution.
  2. How is a unified log filtered to show data from a specific event?
    Unified logs are filtered using programming expressions called predicates in order to show data from specific events.
  3. After creating a telemetry configuration, how would one deploy it to enrolled computers to start gathering data?
    In order to deploy a telemetry configuration, it must first be added to a plan in the macOS Security portal, and will then start gathering log data from all enrolled computers assigned to that plan.

Practice

  1. Create a new action configuration in the macOS Security portal.

    1. Click Actions in the sidebar.

    2. Click Create Action.

    3. Provide a name and description.

    4. Under Collect Alerts, select the Informational checkbox.

    5. Under Alert Data Collection Options, select Minimal.

    6. Click Save.

  2. Create a unified log filter to detect when an MDM profile is manually removed.

    1. Click Unified Logging in the sidebar.

    2. Click Create.

    3. In the Name field, enter MDM Profile Manual Removal.

    4. In the Description field, enter a description of your choosing.

    5. In the Filter field, input subsystem == "com.apple.ManagedClient" AND eventMessage CONTAINS "Removed configuration profile: MDM Profile" AND eventMessage CONTAINS "Source: Manual".

    6. In the Tags field, add visibility.

    7. Click Save.

Resources

Jamf Protect Documentation

Jamf