Jamf Protect connector for Microsoft Sentinel
The Jamf Protect connector provides the capability to read raw event data from Jamf Protect in Microsoft Sentinel.
This is autogenerated content. For changes, contact the solution provider.
Connector attributes
Connector attribute | Description |
---|---|
Log Analytics table(s) | jamfprotect_CL |
Data collection rules support | Not currently supported |
Supported by | Jamf Software, LLC |
Query samples
Jamf Protect - All events.
jamfprotect_CL
| sort by TimeGenerated desc
Jamf Protect - All active endpoints.
jamfprotect_CL
| where notempty(input_host_hostname_s)
| summarize Event = count() by input_host_hostname_s
| project-rename HostName = input_host_hostname_s
| sort by Event desc
Jamf Protect - Top 10 endpoints with Alerts
jamfprotect_CL
| where topicType_s == 'alert' and notempty(input_eventType_s) and notempty(input_host_hostname_s)
| summarize Event = count() by input_host_hostname_s
| project-rename HostName = input_host_hostname_s
| top 10 by Event
Vendor installation instructions
This connector reads data from the jamfprotect_CL table created by Jamf Protect in a Microsoft Analytics Workspace, if the data forwarding option is enabled in Jamf Protect then raw event data is sent to the Microsoft Sentinel Ingestion API.
Next steps
For more information, go to the related solution in the Azure Marketplace.
Phản hồi
https://aka.ms/ContentUserFeedback.
Sắp ra mắt: Trong năm 2024, chúng tôi sẽ dần gỡ bỏ Sự cố với GitHub dưới dạng cơ chế phản hồi cho nội dung và thay thế bằng hệ thống phản hồi mới. Để biết thêm thông tin, hãy xem:Gửi và xem ý kiến phản hồi dành cho