Splunk

Jamf Protect Documentation

Solution
Application
Content Type: Technical Documentation
Utilities & Services
ft:locale: en-US

Jamf Protect Documentation
About Jamf Protect
Capabilities Reference
System Requirements
MDM Requirements with Jamf Protect
SIEM Requirements for Data Collection
Network Communication used by the macOS Security Portal
Network Communication by Region
Security Standards in the macOS Security Portal
Data Collection
Center for Internet Security (CIS) Benchmarks
Authentication
Communication
System Integrity Protection
Keychain
Complying with GDPR Requests in macOS Security
GDPR Compliance Reference for macOS Security
macOS Security Portal
Setting Up Your Portal
Creating Users in the macOS Security Portal
Single Sign-On (SSO) in Jamf Account
User Roles and Groups in macOS Security
Role Permissions
Creating a Custom Role
Creating a Group
Adding an Identity Provider Mapping
Email Notifications for macOS Security
Email Security and Operation
Enabling Email Notifications for Users
Agent Overview
Jamf Protect System Extension
Jamf Protect Launch Daemon
Files Installed by Jamf Protect macOS Security
Dashboards
Detections
Apple Security
Computers
Deployment
Deploying Jamf Protect
Downloading the Jamf Protect Package and Plans for Deployment
Confirming Installation of the Jamf Protect Agent.
Jamf Protect Updates
Enabling Automatic Jamf Protect Agent Updates
Manually Deploying Jamf Protect Agent Updates
Uninstalling Jamf Protect
protectctl Command-Line Tool
Data Integrations
macOS Security Data Types
macOS Security Data Endpoint Types
Data Stream Integrations by Vendor
Amazon S3
Datadog
Installing the Jamf Protect Integration for Datadog
Creating a Jamf Protect Action Configuration for Datadog
Testing your Datadog Integration
Elastic
Installing and Enabling the Jamf Protect Integration for Elastic
Creating a Jamf Protect Action Configuration for Elastic
Setting up Data Forwarding with Elastic Using Amazon S3
Collecting Data From Amazon SQS
Google Security Operations
Creating an Ingestion Feed in Google SecOps Using a Webhook
Configuring an Action Configuration for a Google Security Operations Webhook
Creating an Ingestion Feed in Google Security Operations Using Amazon S3
Using Amazon SQS with Google Security Operations
Adding a Notification Configuration to your Bucket
Microsoft Sentinel
Migrating from Deprecated Microsoft Sentinel Data Forwarding
Splunk
macOS Security and Splunk Integration Requirements
Installing the Jamf Protect Add-on for Splunk
Creating HTTP Event Collectors and Tokens in Splunk
Creating an Event Collector for Alerts and Unified Logs
Modifying Alert Event Types
Creating an Event Collector for Telemetry Data
Testing Your Splunk Event Collector Token
Creating an Jamf Protect Action Configuration for Splunk
Searching macOS Security Data in Splunk
Jamf Protect Search and Visualization Examples
Sumo Logic
Installing the Jamf Protect App for Sumo Logic
Creating an HTTP Event Source for macOS Security Data in Sumo Logic
Creating a Jamf Protect Action Configuration for Sumo Logic
Jamf Protect API
Jamf Protect API
Jamf Protect API Endpoint
Creating an API Client in Jamf Protect
Authorization
Setting Up an API Environment in Altair GraphQL Client
GraphQL Schema and Documentation
Documentation in Altair
Introspection
Queries and Mutations
Queries
Query Examples
Mutations
Mutation Examples
API Scripts
Compliance Baseline for macOS
Compliance Workflow Example
Enabling Compliance Baseline Reporting in a Jamf Protect Plan
Enabling Baseline Rules in Jamf Protect
Compliance Baseline Enforcement
Compliance Baseline Restrictions
Compliance Baseline Summary
Baseline Rule Management
Baseline Rule Compliance Status
Baseline Rule Categories
CIS Benchmark Levels
Jamf Baseline Rules
Computer Management
Computer Dashboards
Changing the Plan on a Computer
Adding Labels and Tags to Computers
Computer Connection Status Indicators
Requesting Check-ins for Connected Devices
Alerts for macOS Security
Alert Widgets
Alert Severity
Alert Actions
Changing Alert Statuses
Comparing Alerts
macOS Security Alerts and Logs Dictionary Reference
Analytics
Jamf-Managed Analytics
Editing Jamf-Managed Analytics
Cloning Jamf-Managed Analytics
Creating Custom Analytics
Creating Analytic Sets
Adding Analytic Sets to a Plan
Analytic Chains
Analytic Settings
Analytic Severity
Sensor Types
Predicates
Analytic Actions
Tags
Analytic Context Items
Snapshot Files
Setting Up Analytic Remediation With Jamf Pro
Configuring Analytic Action Settings in Jamf Protect
Creating an Extension Attribute
Creating a Smart Group in Jamf Pro
Creating an End User Alert Dialog with Jamf Helper
Creating a Policy to Run the Script
Resetting Analytic Detections on Computers
Plans
Jamf Protect Plans in Jamf Pro
Jamf Protect Plan Configuration Profile Payloads
Creating a Jamf Protect Plan
Downloading a Custom Plan to Install on Unmanaged Computers
Switching from Manually Uploaded Jamf Protect Plans to Synced Plans in Jamf Pro
Actions
Creating an Action Configuration in the macOS Security Portal
macOS Security Data Batching for HTTP Endpoints
macOS Security Action Configuration Settings Reference
Threat Prevention (Beta)
Threat Prevention for macOS Security Public Beta
Threat Prevention Public Beta Requirements and Limitations
Threat Prevention for macOS Strategies
Threat Prevention for macOS Engines
Configuring a Custom Threat Prevention Strategy
Making Jamf Protect a Non-Removable System Extension
Threat Prevention Detections and Alerts
Custom Prevent Lists with Jamf Protect
Blocking macOS Apps and Processes Using a Custom Prevent List
Web Protection
General Requirements
Deploying an Activation Profile to Enable Web Protection
Preventing Web-Based Threats on macOS Using Your Threat Prevention Policy
Blocking Risky and Restricted Websites using Your Content Filtering Policy
Web Protection Deployment Testing and Validation
Validating Your Web Protection Deployment on a Computer
Validating UEM Connect Syncing and Policy Reporting in Jamf Security Cloud
Advanced Split-DNS Settings
Modifying On Demand DNS Settings
Disabling Web Protection on Devices
Bypassing Specific Domains
Bypassing Specific SSIDs
Using Multiple Bypass Rules
Known Limitations
Threat Prevention (Legacy)
Advanced Threat Controls
Enabling Advanced Threat Controls
Advanced Threat Controls Status
Advanced Threat Controls Alerts and Notifications
Tamper Prevention
Enabling Tamper Prevention with Jamf Protect
Tamper Prevention Statuses
Tamper Prevention Notifications and Alerts
Disabling Tamper Prevention
Administrator Considerations When Using Tamper Prevention with Jamf Protect
Endpoint Threat Prevention
Threat Database Match and Prevention Process
Endpoint Threat Prevention Options
Known Limitations of Endpoint Threat Prevention
Exceptions
Creating an Exception Set
Configuring Analytic Exceptions
Jamf Managed Default Exceptions
Adding Exception Sets to a Plan
Device Controls
Removable Storage Controls Support and Limitations
Removable Storage Control Sets
Creating a Removable Storage Control Set
Adding Override Rules to Removable Storage Controls
Adding a Removable Storage Control Set to Plans
Unified Logging for macOS
Creating a Unified Log Filter
Adding Unified Log Filters to Jamf Protect
Telemetry for macOS
Getting Started with Telemetry in Jamf Protect
Migrating from Jamf Protect's Deprecated Telemetry
Telemetry Event Categories
Creating a Telemetry Configuration
Telemetry Exception Rules
Telemetry Optimization
Summarization for Telemetry Events
Simple Log File Collection
(Deprecated) Creating a Telemetry Configuration
(Deprecated) Collecting Performance Metrics
(Deprecated) Telemetry Log Levels
(Deprecated) Optimizing Log Volume
Telemetry Diagnostic and Crash File Collection
(Deprecated) Telemetry Log Field Descriptions
(Deprecated) Telemetry Log Data Examples
AUE_add_to_group
AUE_AUDITCTL
AUE_AUDITON_SPOLICY
AUE_auth_user
AUE_BIND
AUE_BIOS_FIRMWARE_VERSIONS
AUE_CHROOT
AUE_CONNECT
AUE_create_group
AUE_create_user
AUE_delete_user
AUE_EXECVE
AUE_FORK
AUE_GETAUID
AUE_LISTEN
AUE_logout
AUE_lw_login
AUE_MAC_SET_PROC
AUE_modify_group
AUE_modify_password
AUE_modify_user
AUE_mount
AUE_openssh
AUE_POSIX_SPAWN
AUE_PTRACE
AUE_remove_from_group
AUE_SESSION_CLOSE
AUE_SESSION_END
AUE_SESSION_START
AUE_SESSION_UPDATE
AUE_SETTIMEOFDAY
AUE_SHUTDOWN
AUE_ssauthint
AUE_ssauthmech
AUE_ssauthorize
AUE_UNMOUNT
Administrative Settings
Change Management
Enabling Change Freeze
Exceptions to Enabling Change Freeze
Jamf Protect Agent Updates During a Change Freeze
Disabling Change Freeze
Data Retention
Database Backups
Configuring Data Retention Settings
Audit Logs
Exporting Audit Logs
Jamf Security Cloud Portal
Deploying Content Controls and Network Security Capabilities
Creating an Activation Profile for Content Controls and Network Security
Distribution Methods for the Jamf Trust App
Data Streams for Jamf Security Cloud
Jamf Security Cloud Data Stream Types and Targets
Configuring Root Level Integration to Export Logs for Data Streams
Data Stream Configuration by Target
Generic HTTP
Generic Syslog
Microsoft Sentinel
Customer-Owned AWS S3
Data Stream Configuration Errors
Data Stream Integrations by Vendor
Elastic
Configuring the Threat Events Data Stream for Elastic
Configuring the Network Traffic Data Stream for Elastic
Datadog
IBM QRadar via AWS S3
Uploading the Jamf Security Cloud CEF Log File Extension for IBM QRadar
Configuring the Jamf Security Cloud Log Source for IBM QRadar
Microsoft Cloud App Security
Splunk
Configuring the Threat Events Stream for Splunk via Syslog
Configuring the Threat Events Stream for Splunk via HTTP Event Collector
Configuring the Threat Events Stream for Splunk via AWS S3
Configuring the Splunk Add-On for AWS
Importing Jamf Security Cloud Events into Splunk
Sumo Logic
Workspace ONE Intelligence
Data Stream Dictionary References
Network Traffic Stream Dictionary
Threat Events Stream Dictionary
Threat Events Stream Event Types
Device Data Stream Dictionary
App Insights Stream Dictionary
Vulnerability Data Stream Dictionary
Internet Content Filtering and Usage Controls
Requirements
Content Filtering Policy
Content Filtering Policy Controls
Content Filtering Policy Schedules
Creating New Schedules
Editing schedules
Configuring Your Content Filtering Policy
Configuring Search Rules
Adding Custom Rules
Configuring your Content Filtering Policy for Agentless Devices
Common Content Filtering Policy Rules
Blocking Access for All Users at the Root Level
Blocking Several Custom Domains at a Specific Leaf Level
Overriding a Root-Level Policy Rule at Leaf Level
Removing an Override Rule
Limiting Access to Content from Specific Countries
Content Filtering Policy Categories
Block Rules
Data Usage Policy
Data Usage Policy Settings
Policy Settings
Allow List
UEM Signaling
UEM Tags
Configuring UEM Signaling to Control Tethering via Jamf Pro
Creating the Extension Attributes in Jamf Pro
Configuring the Jamf Pro Smart Mobile Device Group
Creating a Jamf Pro Configuration Profile
Assigning a UEM Tag in Jamf Security Cloud
Configuring UEM Signaling to Control Tethering via Microsoft Intune
General Requirements
Creating an Azure AD Group
Creating the Configuration Profile
Assigning a UEM Tag in Jamf Security Cloud
Configuring UEM Signaling to Control Tethering via Workspace ONE
Creating a New Tag in Workspace ONE
Configuring a Smart Group in Workspace ONE
Creating the Configuration Profile in Workspace ONE
Assigning a UEM Tag in Jamf Security Cloud
Configuring UEM Signaling to Control Tethering via Ivanti Neurons for MDM
Adding a Custom Attribute in Ivanti Neurons for MDM
Creating a Device Group in Ivanti Neurons for MDM
Creating a Custom Configuration in Ivanti Neurons for MDM
Assigning a UEM Tag in Jamf Security Cloud
Data Counting
Contextual Policy
Creating a Contextual Policy Assignment
Contextual Policy Criteria
Notifications
Recommended Settings
Restricting Mobile Hotspot Devices to Only Associated Windows Devices
Configure MAC Address Filtering on the Mi-Fi Device
Limit Wi-Fi Connectivity to Specific Windows Devices
Exporting a Report for All Devices or Selected Devices
Internet Reports
Usage Report
Sites and Apps
Blocks Report
Categories Report
Roaming Report
Tethering Report
Caps Report
Configuring the Business/Personal Report Filter
Exporting a Group Device Report
Endpoint and Network Security
Requirements
Threat Prevention Policy
Configuring your Threat Prevention Policy
Overriding Root Level Configurations
Setting Group Security Policy
Ignoring and Archiving Threats
Configuring Signal UEM Using Jamf Security Cloud
Configuring Conditional Access for Microsoft Intune
Responding to a Vulnerable App Notification
Setting Notifications for an Out-of-Date OS
Threat Severity and Risk Scores
Automating Security Responses with Your Threat Prevention Policy
Threat Prevention Categories Reference
Threat Prevention Policy Threat Categories
App Inactivity Threat Category
Out-of-Date Operating System Threat Category
Adversary-in-the-Middle SSL Strip
Vulnerable Apps Threat Category
Custom Threat Intelligence
Adding Custom Threat Intelligence to Your Security Policy
Custom Threat Intelligence Data Validation
App Watchlist
Adding App Categories to the App Watchlist
Adding an App to the App Watchlist
Removing an App from the App Watchlist
App Blocking
Security Reports
Vulnerability Management Report
Vulnerability Remediation with Jamf Security Cloud
App Insights Report
App Insight Elements and Filters
App Risk Score
App Risk Score Summary View
App Risk Score Detail View
Copyright and Trademarks

Related content

Jamf Protect Add-on for Splunk

Back to home page