Jamf Protect - Unified Logs

Back


Id	9eb2f758-003b-4303-83c6-97aed4c03e41
Rulename	Jamf Protect - Unified Logs
Description	Creates an informational incident based on Jamf Protect Unified Log data in Microsoft Sentinel
Severity	Informational
Required data connectors	JamfProtect
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml
Version	1.0.3
Arm template	9eb2f758-003b-4303-83c6-97aed4c03e41.json

KQL

JamfProtectUnifiedLogs
| where isnotempty(EventSeverity)
| extend Host_IPs = tostring(parse_json(DvcIpAddr)[0])

YAML

alertDetailsOverride:
  alertSeverityColumnName: EventSeverity
  alertDescriptionFormat: '{{EventDescription}} has been captured in the unified logs'
  alertDisplayNameFormat: '{{EventDescription}} on {{DvcHostname}}'
  alertDynamicProperties:
  - value: EventVendor
    alertProperty: ProviderName
  - value: EventProduct
    alertProperty: ProductName
customDetails:
  Protect_Event_Type: EventType
  Event_Process: TargetProcessName
  Tags: Match_tags
  Unified_Log: EventDescription
query: |
  JamfProtectUnifiedLogs
  | where isnotempty(EventSeverity)
  | extend Host_IPs = tostring(parse_json(DvcIpAddr)[0])  
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DvcHostname
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: Host_IPs
status: Available
version: 1.0.3
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
requiredDataConnectors:
- dataTypes:
  - jamfprotect_CL
  connectorId: JamfProtect
relevantTechniques: 
suppressionDuration: PT5H
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectUnifiedLogs.yaml
kind: NRT
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionEnabled: false
description: |
    'Creates an informational incident based on Jamf Protect Unified Log data in Microsoft Sentinel'
severity: Informational
tactics: 
name: Jamf Protect - Unified Logs
id: 9eb2f758-003b-4303-83c6-97aed4c03e41

ARM