In addition to the analytics provided and managed by the Jamf Threat Labs team, Jamf Protect you can create and deploy custom analytics to meet the auditing and threat protection needs specific to your environment. Custom analytics are created with the same capabilities as those managed by Jamf, with documentation available in-product. An open-source repository of custom analytics is available on the Jamf Protect GitHub site (https://github.com/jamf/jamfprotect).
Creating an analytic requires an understanding of the following advanced topics and processes:
An understanding of filtering and sorting logic, such as the
NSPredicateandNSExpressionclasses, to evaluate events and processes on macOS. For more information, see NSPredicate from the Apple Developer website.An understanding of the event and process you want to monitor on computers.
When creating a custom analytic from this guide it is helpful to use the Filter Text View option inside the analytic Filter builder to paste in the predicate expression, rather than build it using the Filter Query Builder View.