Jamf Protect Add-on
Overview
Details
The Jamf Protect Add-on for Splunk supports the following:
- Jamf Protect (Alerts and Telemetry)
- Jamf Protect Offline Mode (Telemetry Only)
- Jamf Security Cloud
- Threat Events Stream
- Network Traffic Stream
Important
The base event type must be updated before enabling this Add On.
Data Inputs
See Splunk Integration with Jamf Protect to learn more how to configure Jamf Protect to send events to Splunk.
Due to differences in the json schema of Jamf Protect Alerts and Jamf Protect Telemetry, two HTTP Event Collectors (HECs) must be created. The Jamf Protect Add-on expects initial source types of:
- Jamf Protect Alerts & Unified Logs:
jamf:protect:alerts - Jamf Protect Telemetry:
jamf:protect:telemetry - Jamf Security Cloud:
jamf:protect:web
Existing Data
For compatibility with existing Splunk objects such as source types, field names, and similar you may need to make a search time rename for the Jamf Splunk object. To do this, follow these steps:
Splunk Cloud
Jamf Protect Alerts
- Click Settings → Source types
- Find your current conflicting source type
- Click Edit
- Click Advanced
- Click New setting
- Name: rename
- Value:
jamf:protect:alerts
Jamf Protect Telemetry
- Click Settings → Source types
- Find your current conflicting source type
- Click Edit
- Click Advanced
- Click New setting
- Name: rename
- Value:
jamf:protect:telemetry
Jamf Security Cloud
- Click Settings → Source types
- Find your current conflicting source type
- Click Edit
- Click Advanced
- Click New setting
- Name: rename
- Value:
jamf:protect:web
Splunk Enterprise
Copy the top line from the text chunk in [ ] you want to modify from default/props.conf to local/props.conf and set the appropriate original source type.
Example:
###
[EXISTING-SOURCETYPE]
rename = jamf:protect:alerts
This will not change your data, it will only allow you to use the search time extractions from this app with your existing source type. Please make sure that your new data is using the source types of jamf:protect:alerts or jamf:protect:telemetry, depending on your Jamf Protect deployment, for best compatibility with the add-on.
Event Type Modification
For jamf_protect and jamf_protect_web, the base event types must be updated, so the correct index value is set. This is not necessary for the Telemetry event types. Follow these steps:
Splunk Cloud
- Click Settings → Event types
- App → Jamf Protect (TA-JamfProtect)
- Click jamf_protect
- Search String:
index="CORRECTINDEX" sourcetype="jamf:protect:alerts" - Click Save
- Search String:
- Click jamf_protect_web
- Search String:
index="CORRECTINDEX" sourcetype="jamf:protect:web" - Click Save
- Search String:
- Click jamf_protect
Splunk Enterprise
Copy the setting below from default/eventtypes.conf to local/eventtypes.conf. Replace index=* with the index your jamf:protect data is in.
Example:
[jamf_protect]
search = index=CORRECTINDEX sourcetype="jamf:protect:alerts"
[jamf_protect_web]
search = index=CORRECTINDEX sourcetype="jamf:protect:web"
Important
The indexes must also be updated within the Telemetry Lookup Workflow Action before it can be used.
Release Notes
Version 1.0.1
- Bug Fixes
Version 1.0.0
- Added Jamf Security Cloud data streams
- Threat Events Stream
- Network Traffic Stream
- Added Intrusion Detection mapping for Jamf Protect Alerts
- Bug Fixes
Version 0.9.0
0.9.0 - Initial Beta Release