To remove a remediated computer from Jamf Pro smart groups used for Jamf Protect analytics, you can remove the extension attribute values (the Identifier values defined by the Add to Jamf Pro Smart Group analytic action setting) written by Jamf Protect.
Commands must be executed using a Jamf Pro policy or locally from the root user (sudo -i). These commands assume that you are executing locally from the root user. If you are executing from a Jamf Pro policy, remove the sudo -i command.
To remove all extension attribute values written by Jamf Protect analytics from a computer locally from the root user, execute the following commands:
sudo -i
/bin/rm /Library/Application\ Support/JamfProtect/groups/*To remove a single extension attribute value written by Jamf Protect from a computer locally from the root user, execute the following command that specifies the Identifier value:
sudo /bin/rm /Library/Application\ Support/JamfProtect/groups/valueThe extension attribute values written by analytics are removed, and the computer is also removed from any smart groups using the Jamf Protect extension attribute as criteria the next time inventory is submitted to Jamf Pro.
To immediately submit inventory, execute /usr/local/bin/jamf recon.