The content in this section applies to the legacy threat prevention strategy in macOS Security. The legacy strategy will be deprecated in a future version of macOS Security. For information and instructions on configuring threat prevention strategies, see Threat Prevention (Beta).
Endpoint threat prevention monitors process execution to prevent known malware and threats on macOS. Endpoint threat prevention uses the Jamf Protect threat database to monitor computers for processes that match entries. When matches occur, Jamf Protect automatically blocks the matching process and quarantines the associated file.
The threat database is continuously updated by Jamf Threat Labs. For more information about updates, see the Jamf Protect Threat Prevention Changelog.