The XProtectDetection analytic detects when XProtect detects and blocks identified malware.
XProtect is a fundamental element of the native macOS security architecture and is a built-in anti-virus technology on macOS. XProtect scans binaries that attempt to launch and will block identified malware or adware from executing on the system. XProtect uses YARA (https://yara.readthedocs.io/) for signature based detection of malware variants. These signatures are automatically updated and maintained by Apple.
End users are alerted via a pop-up window, but Jamf Protect also logs XProtect activity for visibility outside of the endpoint for Information Security teams. This detection looks for changes made to the XProtect diagnostics files. This is an indication that XProtect detected a malicious application was opened.
For more information on XProtect, see Protecting against malware in macOS in the Apple Platform Security user guide.