Jamf Protect Event Collector

Details

ID	`Jamf Protect Event Collector`
Provider	Jamf
Category	Analytics & SIEM
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Use this integration to fetch audit logs events, alerts events and computers assets from Jamf Protect to Cortex XSIAM.

Configure Jamf Protect Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g., https://example.protect.jamfcloud.com)	REST API Endpoint of Jamf Protect server.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
Client ID	The unique identifier for the client application, provided by Jamf when the application is registered. This is used to authenticate the client with the Jamf Protect server.	True
Password	The password for the client application. This is used to authenticate the client with the Jamf Protect server.	True
Max alert events per fetch	Maximum number of alert events to fetch at a time. Default is 1000	False
Max audit events per fetch	Maximum number of audit events to fetch at a time. Default is 20,000	False
Fetch Computer Assets Interval	The fetch interval. It is recommended to set it to 12 hours. The minimum interval is 1 hour.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

jamf-protect-get-events

Gets events from Jamf Protect.

Base Command

jamf-protect-get-events

Input

Argument Name	Description	Required
limit	The number of events to return. Default is 10.	Optional
start_date	The start date from which to filter events.	Optional
end_date	The end date to which to filter events.	Optional
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Optional

Context Output

There is no context output for this command.

jamf-protect-get-computer-assets

Gets computer assets from Jamf Protect.

Base Command

jamf-protect-get-computer-assets

Input

Argument Name	Description	Required
limit	The number of computer assets to return. Default is 10.	Optional

Context Output

There is no context output for this command.

Configuration parameters

base_url — Server URL (e.g., https://example.protect.jamfcloud.com) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
client — Client ID (required)
max_fetch_alerts — Max alert events per fetch
max_fetch_audits — Max audit events per fetch
assetsFetchInterval — Fetch Computer Assets Interval
isFetchEvents — Fetch Events
isFetchAssets — Fetch Assets

Commands (2)

jamf-protect-get-computer-assets
Gets computer assets from Jamf Protect.
jamf-protect-get-events
Gets events from Jamf Protect.

Source

JamfProtectEventCollector.py JamfProtectEventCollector_test.py JamfProtectEventCollector.yml JamfProtectEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Jamf
sectionorder:
- Connect
- Collect
commonfields:
  id: Jamf Protect Event Collector
  version: -1
configuration:
- name: base_url
  display: Server URL (e.g., https://example.protect.jamfcloud.com)
  required: true
  defaultvalue:
  type: 0
  additionalinfo: REST API Endpoint of Jamf Protect server.
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- additionalinfo: The password for the client application. This is used to authenticate the client with the Jamf Protect server.
  displaypassword: Password
  name: client
  display: Client ID
  required: true
  type: 9
  section: Connect
- additionalinfo: Maximum number of alert events to fetch at a time.
  defaultvalue: '1000'
  display: Max alert events per fetch
  name: max_fetch_alerts
  required: false
  type: 0
  advanced: true
  section: Collect
- additionalinfo: Maximum number of audit events to fetch at a time.
  defaultvalue: '20000'
  display: Max audit events per fetch
  name: max_fetch_audits
  required: false
  type: 0
  advanced: true
  section: Collect
- additionalinfo: The fetch interval. It is recommended to set it to 12 hours. The minimum interval is 1 hour.
  defaultvalue: 720
  display: Fetch Computer Assets Interval
  name: assetsFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Fetch Events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
- display: Fetch Assets
  name: isFetchAssets
  type: 8
  required: false
  section: Collect
description: Use this integration to fetch audit logs events, alerts events and computer assets from Jamf Protect to Cortex XSIAM.
display: Jamf Protect Event Collector
name: Jamf Protect Event Collector
script:
  commands:
  - arguments:
    - description: The number of events to return.
      name: limit
      defaultValue: 10
    - description: The start date from which to filter events.
      name: start_date
    - description: The end date to which to filter events.
      name: end_date
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Gets events from Jamf Protect.
    name: jamf-protect-get-events
  - arguments:
    - description: The number of computer assets to return.
      name: limit
      defaultValue: 10
    description: Gets computer assets from Jamf Protect.
    name: jamf-protect-get-computer-assets
  runonce: false
  script: "-"
  type: python
  subtype: python3
  isfetchevents: true
  isfetchassets: true
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 6.9.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam