Auditing Jamf Protect Alert Data for Reported and Blocked Malware

Jamf Trusted Access Solution Guide for Business
Solution
Application
Content Type
Technical Documentation
Solution Guide
Utilities & Services
ft:locale
en-US

Alerts notify you of events that indicate specific behaviors—potentially suspicious or risky—happening on enrolled computers and can be generated from a single event, or from multiple events. You can review the criteria that generated the alert by clicking the link in the Description column of the alert table to view the Alert Details page.

  1. In Jamf Protect, click Alerts.
  2. Click the Filter By field, underneath the Alerts heading. A list of predefined search criteria appears.
  3. Select the desired search category.
  4. After the colon, enter the desired criteria. Click the search icon or press Enter.

    To add multiple filters, enter the additional filter criteria in the Filter By field, and press Enter.

    Example:

    In the Filter By field, select actions: and enter Prevented then press Enter. Enter this second set of criteria in the Filter By field, status:Resolved, and press Enter. All events that were prevented and resolved manually by Jamf Protect are displayed.