Using a Custom Prevent List - Jamf Protect Evaluation Guide

Jamf Protect Evaluation Guide
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
Requirements

Download and install the sample application available from the open source GitHub repository from Jamf:

https://github.com/jamf/jamfprotect/blob/main/helper_tools/sample_app_for_testing/SampleApp.pkg?raw=true

The sample application is a basic application developed to test custom prevent lists.

The sample application contains the following signing information:
  • CDHash —c4d76d39a8f6b8eff9bc23100b8163ae25818360
  • Identifier —com.sample.app
  • TeamIdentifier —CLQKFNPCCP
  1. In Jamf Protect, click Threat Prevention.
  2. Click the Custom Prevention Lists tab.
  3. Click Create Prevent List.
  4. Give your new custom prevent list a name.
  5. For prevent lists that use signing information, perform the following:
    1. Under Prevent Type, select Signing Information.
    2. Select Signing ID.
    3. Open Terminal.
    4. Obtain the code signature of the sample application (Sample App.app in /Applications) by executing the following command:
      codesign -dv /Applications/Sample\ App.app
    5. Copy the Identifier value.
    6. Navigate back to Jamf Protect and paste the value into the plain text field.
    7. Click Save.
    8. Open the test application and note that you receive a block message stating that a custom prevent list prevented the application from being opened.
  6. For prevent lists that use file hashes, perform the following:
    1. Select File Hash.
    2. Open Terminal.
    3. Obtain the code signature of the sample application (Sample App.app in /Applications) by executing the following command:
      codesign -dvvv /Applications/Sample\ App.app
    4. Copy the SHA256 value.
    5. Navigate back to Jamf Protect and paste the value into the plain text field.
    6. Click Save.
    7. Open the test application and note that you receive a block message stating that a custom prevent list prevented the application from being opened.
To view the prevented application alert in Jamf Protect, navigate to Alerts and confirm that a PreventedExecution process has denied an application execution.