The GatekeeperBlockedRevoked analytic will detect when Gatekeeper blocks a program from running that is code-signed by a developer certificate specifically revoked by Apple.
One of the most important native security features on macOS is a technology called Gatekeeper. By default, Gatekeeper prevents untrusted software from running on an end user Mac. Any time a user runs a new app, plug-in or installer package that did not come from that App Store, Gatekeeper will ensure that the software does not contain known malicious content, is signed by a trusted developer and has not been tampered with.
End users are alerted via a pop-up window, but Jamf Protect also logs Gatekeeper activity for visibility outside of the endpoint for Information Security teams.
More information on Gatekeeper is available in the Apple Platform Security Guide.
Jamf Protect offers three distinct Gatekeeper event analytic alerts that represent different types of Gatekeeper events.
- GatekeeperBlockedUnsignedOrUnknown
- Gatekeeper prevented an unsigned, invalid, or unknown application from running. A user attempted to run a program that macOS Gatekeeper specifically identified as unsigned, invalid, or unknown.
- GatekeeperBlockedSigned
- Gatekeeper prevented a signed application from running. This usually occurs when a user is prompted by Gatekeeper for permission or confirmation to run an application, and the user clicks "Don't Allow" or "Cancel".
- GatekeeperBlockedRevoked
- Gatekeeper prevented an application that was signed with a developer ID that was explicitly revoked by Apple. In other words, an application with a known bad signature was prevented from running.