Testing and Analyzing Jamf Protect Analytics: PeriodicScriptAdded

Jamf Trusted Access Solution Guide for Business
Solution
Application
Content Type
Technical Documentation
Solution Guide
Utilities & Services
ft:locale
en-US

Requirements

If using a virtual machine, take a snapshot to revert back to at the end of this simulation.

  1. Open Terminal and run these commands in the provided order.
    # Create a testing script to execute
echo "Hello World" >> ~/Desktop/jptest.sh

# Move the testing script to the periodic utility scheduled directory
sudo mv ~/Desktop/jptest.sh /etc/periodic/daily
    After completing the testing steps, a new alert titled PeriodicScriptAdded is available within Jamf Protect Cloud.
  2. Open and review the PeriodicScriptAdded alert. The most interesting data points when analyzing this Alert are:

    • Summary > File System Event Details > Path: The file path and name of the shell script created for scheduled execution.

    • Processes > Process Tree: Find the initial cause. (Example: Was this added by a user? Was this file added as part of a package installation?)

    In a real world scenario, investigation of this alert would begin with examining the contents and purpose of this new shell script as well as the method of it's creation.

  3. If a virtual machine snapshot was taken prior to completing this test scenario the easiest cleanup method is to revert to the snapshot. Otherwise run these commands in Terminal to remove the test files created.
    # Remove the testing script
sudo rm /etc/periodic/daily/jptest.sh