When a tamper attempt occurs on the Jamf Protect application, a message appears, notifying that a tamper event was prevented. The type of messaging received depends on the severity of the tamper event. Less severe tamper events generate only macOS notifications and do not alert the administrator.
For example, attempting to drag-and-drop Jamf Protect into the Trash results in a native macOS notification stating that you are prevented from doing so.
Attempting to tamper with programmatic or command-line interface workflows also results in a native macOS notification.
More severe tamper events generate a notification and send an alert to the administrator. Alerts can be viewed in the Alerts page, through data-forwarding services, or by streaming directly to a SIEM.