From 843acb3656da0a679eb1f2f3aace03d9a3056810 Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Wed, 30 Jul 2025 17:16:04 +0200 Subject: [PATCH 01/11] initial changes for 3.1.0 --- packages/jamf_protect/changelog.yml | 17 + .../data_stream/alerts/sample_event.json | 18 +- ...est-jamf-protect-telemetry-sample-logs.log | 6 +- ...ct-telemetry-sample-logs.log-expected.json | 838 ++++++++++++++---- .../elasticsearch/ingest_pipeline/default.yml | 21 +- .../ingest_pipeline/pipeline_event_mount.yml | 38 +- .../pipeline_event_network_connect.yml | 279 ++++++ .../pipeline_event_pty_close.yml | 23 + .../pipeline_event_pty_grant.yml | 23 + .../pipeline_event_remount.yml | 38 +- .../pipeline_event_tcc_modify.yml | 269 ++++++ .../pipeline_event_unmount.yml | 40 +- .../data_stream/telemetry/fields/ecs.yml | 12 +- .../data_stream/telemetry/fields/fields.yml | 24 + .../data_stream/telemetry/sample_event.json | 20 +- .../telemetry_legacy/sample_event.json | 16 +- .../web_threat_events/sample_event.json | 18 +- .../web_traffic_events/sample_event.json | 18 +- packages/jamf_protect/docs/README.md | 90 +- packages/jamf_protect/manifest.yml | 4 +- 20 files changed, 1557 insertions(+), 255 deletions(-) create mode 100644 packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml create mode 100644 packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml create mode 100644 packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml create mode 100644 packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_tcc_modify.yml diff --git a/packages/jamf_protect/changelog.yml b/packages/jamf_protect/changelog.yml index 8df5ddb4696..edf7536c93e 100644 --- a/packages/jamf_protect/changelog.yml +++ b/packages/jamf_protect/changelog.yml @@ -1,4 +1,21 @@ # newer versions go on top +- version: "3.1.0" + changes: + - description: Adding new Network Connect event for telemetry data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/12871 + - description: Adding new TCC Modify event for telemetry data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/12871 + - description: Adding new PTY Grant event for telemetry data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/12871 + - description: Adding new PTY Close event for telemetry data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/12871 + - description: Enhancments to the mount, remount and unmount events for telemetry data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/12871 - version: "3.0.2" changes: - description: Fix field type from `long` to `keyword` for `process.code_signature.flags`, `process.parent.code_signature.flags` fields to resolve conflicts with ECS. diff --git a/packages/jamf_protect/data_stream/alerts/sample_event.json b/packages/jamf_protect/data_stream/alerts/sample_event.json index fb5190acc87..8abc3388eb5 100644 --- a/packages/jamf_protect/data_stream/alerts/sample_event.json +++ b/packages/jamf_protect/data_stream/alerts/sample_event.json @@ -1,24 +1,24 @@ { - "@timestamp": "2025-05-06T07:04:59.704Z", + "@timestamp": "2025-07-30T13:24:50.442Z", "agent": { - "ephemeral_id": "29dd8752-991c-4f0f-8625-76b7c8cf07a1", - "id": "91381ecc-cd6d-4b82-8918-53fd23b92f71", - "name": "elastic-agent-26611", + "ephemeral_id": "543d6574-b616-440a-9e2f-5d999a7392fd", + "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", + "name": "elastic-agent-66883", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.alerts", - "namespace": "86504", + "namespace": "61044", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "91381ecc-cd6d-4b82-8918-53fd23b92f71", + "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "CustomURLHandlerCreation", @@ -29,7 +29,7 @@ ], "dataset": "jamf_protect.alerts", "id": "6bdb0697-6d07-47bc-a37d-6c3348a5d953", - "ingested": "2025-05-06T07:05:00Z", + "ingested": "2025-07-30T13:24:51Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Application that uses custom url handler created", diff --git a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log index e0cb5db2034..77e71799f4a 100644 --- a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log +++ b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log @@ -26,8 +26,12 @@ {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"btm_launch_item_remove":{"item":{"app_url":"","item_type":3,"item_url":"file:///Library/LaunchAgents/inSyncAgent.plist","legacy":true,"managed":true,"uid":502}}},"event_type":125,"glob_seq_num":1068,"host":{"hostname":"MacBookPro","ips":["192.168.11.251","192.168.11.232","192.168.64.1"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"5.5.0.6","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":30270988724172,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":28267,"pidversion":47589294,"rgid":0,"ruid":0,"uuid":"CB0CAAE3-08B8-56CA-BDCA-BD5F44B17CE4"},"cdhash":"1c01957ea34ce597bbbb6f52245e0a3cb4917cab","codesigning_flags":570522369,"executable":{"path":"/System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Versions/A/Resources/backgroundtaskmanagementd","path_truncated":false,"stat":{"st_atimespec":"2024-03-21T06:13:23.000Z","st_birthtimespec":"2024-03-21T06:13:23.000Z","st_blksize":4096,"st_blocks":448,"st_ctimespec":"2024-03-21T06:13:23.000Z","st_dev":16777231,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312287141,"st_mode":33261,"st_mtimespec":"2024-03-21T06:13:23.000Z","st_nlink":1,"st_rdev":0,"st_size":611840,"st_uid":0}},"group_id":28267,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":551,"rgid":0,"ruid":0,"uuid":"650F695A-E78B-547C-B6B9-34D752DB435F"},"ppid":1,"responsible_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":28267,"pidversion":47589294,"rgid":0,"ruid":0,"uuid":"CB0CAAE3-08B8-56CA-BDCA-BD5F44B17CE4"},"session_id":28267,"signing_id":"com.apple.backgroundtaskmanagementd","start_time":"2024-05-23T03:54:49.001Z"},"seq_num":1,"thread":{"thread_id":96231556,"uuid":"05973043-9E0A-5366-9E3D-B64947F5BF43"},"time":"2024-05-23T05:53:39.686Z","uuid":"BE5A2C6D-75D6-4ECA-BCFE-FB1B676DBE1E","version":7} {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"cs_invalidate":{}},"event_type":94,"glob_seq_num":13820,"host":{"hostname":"MacBookPro","ips":["192.168.1.27"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"5.4.0.1","provisioningUDID":"00006020-000C69E03633C01E","serial":"123ABC456DJ"},"mach_time":1753178733092,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100019,"auid":502,"egid":20,"euid":502,"pid":55767,"pidversion":128858,"rgid":20,"ruid":502,"uuid":"F06AF30C-2C9B-5227-9BCD-48078F09C78C"},"cdhash":"21012241103cd6658464ef81e04cb153d67f53e5","codesigning_flags":587334146,"executable":{"path":"/Users/jappleseed/Downloads/common/sleep","path_truncated":false,"sha1":"774ad8206f412d07161d174b6519d40ef601c02a","sha256":"d4791b942dbd4dd0eee0b31e46424fe673df586e2fdd166b6fe4f303a19767b4","stat":{"st_atimespec":"2024-04-19T15:33:31.392Z","st_birthtimespec":"2024-04-19T15:32:37.060Z","st_blksize":4096,"st_blocks":72,"st_ctimespec":"2024-04-19T15:32:37.060Z","st_dev":16777233,"st_flags":0,"st_gen":0,"st_gid":20,"st_ino":30081940,"st_mode":33261,"st_mtimespec":"2024-04-19T15:32:37.060Z","st_nlink":1,"st_rdev":0,"st_size":33432,"st_uid":502}},"group_id":55767,"is_es_client":false,"is_platform_binary":false,"original_ppid":55484,"parent_audit_token":{"asid":100019,"auid":502,"egid":20,"euid":502,"pid":55484,"pidversion":128242,"rgid":20,"ruid":502,"uuid":"732B7C17-3D83-52FC-B114-08FBE9FC43FA"},"ppid":55484,"responsible_audit_token":{"asid":100019,"auid":502,"egid":20,"euid":502,"pid":712,"pidversion":1695,"rgid":20,"ruid":502,"uuid":"32648F68-FC35-5EAA-A81F-5FEAAB9AA187"},"session_id":55483,"signing_id":"sleep","start_time":"2024-04-19T15:33:31.000Z","tty":{"path":"/dev/ttys003","path_truncated":false,"stat":{"st_atimespec":"2024-04-19T15:33:14.382Z","st_birthtimespec":"1970-01-01T00:00:00.000Z","st_blksize":65536,"st_blocks":0,"st_ctimespec":"2024-04-19T15:33:31.387Z","st_dev":-874482363,"st_flags":0,"st_gen":0,"st_gid":4,"st_ino":723,"st_mode":8592,"st_mtimespec":"2024-04-19T15:33:31.387Z","st_nlink":1,"st_rdev":268435459,"st_size":0,"st_uid":502}}},"seq_num":0,"time":"2024-04-19T15:34:28.834Z","uuid":"415148AF-9371-4C01-8D60-72DBEEEC71F2","version":7} {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"chroot":{"target":{"path":"/private/var/folders/2f/w7qslkks19ncxg48w_559zp80000gn/T","path_truncated":false,"stat":{"st_atimespec":"2024-05-03T13:41:50.517Z","st_birthtimespec":"2024-01-26T13:05:32.470Z","st_blksize":4096,"st_blocks":0,"st_ctimespec":"2024-05-06T06:40:35.185Z","st_dev":16777231,"st_flags":1048576,"st_gen":0,"st_gid":20,"st_ino":26462,"st_mode":16832,"st_mtimespec":"2024-05-06T06:40:35.185Z","st_nlink":4,"st_rdev":0,"st_size":128,"st_uid":501}}}},"event_type":57,"glob_seq_num":4183,"host":{"hostname":"MacBookPro","ips":["192.168.11.251","192.168.11.232","192.168.64.1"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"5.5.0.6","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":29994345187967,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":14802,"pidversion":47557822,"rgid":0,"ruid":0,"uuid":"257005DD-1A0C-5F6F-8563-D790DABEF5B7"},"cdhash":"2680cbf567b9aff559d740365e00603fe93bccdf","codesigning_flags":570522369,"executable":{"path":"/usr/libexec/dirhelper","path_truncated":false,"stat":{"st_atimespec":"2024-03-21T06:13:23.000Z","st_birthtimespec":"2024-03-21T06:13:23.000Z","st_blksize":4096,"st_blocks":72,"st_ctimespec":"2024-03-21T06:13:23.000Z","st_dev":16777231,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312527264,"st_mode":33261,"st_mtimespec":"2024-03-21T06:13:23.000Z","st_nlink":1,"st_rdev":0,"st_size":182288,"st_uid":0}},"group_id":14795,"is_es_client":false,"is_platform_binary":true,"original_ppid":14795,"parent_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":14795,"pidversion":47557809,"rgid":0,"ruid":0,"uuid":"5BA4345F-357E-550B-9236-0BE320B979A9"},"ppid":14795,"responsible_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":14795,"pidversion":47557809,"rgid":0,"ruid":0,"uuid":"5BA4345F-357E-550B-9236-0BE320B979A9"},"session_id":14795,"signing_id":"com.apple.dirhelper","start_time":"2024-05-23T01:35:28.000Z"},"seq_num":2,"thread":{"thread_id":95725389,"uuid":"4D26A299-1C49-5205-94DD-B3676DA161AF"},"time":"2024-05-23T01:35:29.599Z","uuid":"29204089-B6AB-44F9-97B2-A72C09A8B783","version":7} -{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"mount":{"statfs":{"f_bavail":3674,"f_bfree":3674,"f_blocks":14122,"f_bsize":4096,"f_ffree":146960,"f_files":147256,"f_flags":77633049,"f_flags_ext":0,"f_fsid":[16777248,26],"f_fssubtype":0,"f_fstypename":"apfs","f_iosize":1048576,"f_mntfromname":"/dev/disk9s1","f_mntonname":"/Volumes/JamfConnect","f_owner":502,"f_type":26}}},"event_type":22,"glob_seq_num":106336,"host":{"hostname":"MacBookPro-Sjaffy (2)","ips":["192.168.11.251","192.168.64.1","192.168.11.232"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.1.11","provisioningUDID":"00006030-001E301C0228001C","serial":"KJQMQP4XW0"},"is_telemetry":true,"mach_time":15726279369169,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100010,"auid":4294967295,"egid":20,"euid":502,"pid":26932,"pidversion":1379581,"rgid":20,"ruid":502,"uuid":"39AE3A81-23C1-5E15-9871-295A85E0FEA1"},"cdhash":"7804bd9c2e3b5e16cf9fcfba943564485fb6f20f","codesigning_flags":570522369,"executable":{"path":"/System/Library/Filesystems/apfs.fs/Contents/Resources/mount_apfs","path_truncated":false,"stat":{"st_atimespec":"2024-05-07T07:01:44.000Z","st_birthtimespec":"2024-05-07T07:01:44.000Z","st_blksize":4096,"st_blocks":64,"st_ctimespec":"2024-05-07T07:01:44.000Z","st_dev":16777231,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312156599,"st_mode":33261,"st_mtimespec":"2024-05-07T07:01:44.000Z","st_nlink":1,"st_rdev":0,"st_size":139824,"st_uid":0}},"group_id":1148,"is_es_client":false,"is_platform_binary":true,"original_ppid":26930,"parent_audit_token":{"asid":100010,"auid":4294967295,"egid":20,"euid":502,"pid":26930,"pidversion":1379579,"rgid":20,"ruid":502,"uuid":"F7ED3BE5-780C-5F1B-AD74-F5F01CB3DC39"},"ppid":26930,"responsible_audit_token":{"asid":100010,"auid":4294967295,"egid":0,"euid":0,"pid":1148,"pidversion":2434,"rgid":0,"ruid":0,"uuid":"6FC75B65-1B69-5020-A07F-7541488904C3"},"session_id":1148,"signing_id":"com.apple.mount_apfs","start_time":"2024-06-11T11:35:28.000Z","team_id":null,"tty":null},"seq_num":31,"thread":{"thread_id":15379585,"uuid":"83C515F9-CD46-5ECF-AEC2-FB6840024437"},"time":"2024-06-11T11:35:28.142Z","uuid":"0CAC3D00-385F-4F44-872A-B6035375C197","version":7} {"event":{"file_collection":{"contents":"Date/Time: 2024-04-17 18:19:13.962 -0500\nEnd time: 2024-04-17 18:21:05.619 -0500\n","file":{"path":"/Library/Logs/DiagnosticReports/spotlightknowledged_MacBook-Pro.cpu_resource.diag","size":28}}},"event_type":9002,"host":{"hostname":"MacBookPro","ips":["192.168.0.185"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.0.1","provisioningUDID":"00006000-001C58882238801E","serial":"123ABC456DE"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-05-28T05:45:58.729Z","uuid":"06CE8D4D-6848-4562-B947-2D607580283A"} {"event":{"bios_uefi":{"architecture":"arm64","bios":{"firmware-version":"iBoot-10151.101.3","system-firmware-version":"iBoot-10151.101.3"}}},"event_type":9004,"host":{"hostname":"MacBookPro","ips":["192.168.0.185"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"6.0.0.1","provisioningUDID":"00006000-001C58882238801E","serial":"LFQ5YXH377"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-05-22T16:49:22.294Z","uuid":"DDFDF887-D3F1-4F01-A8E1-0506BBCCD2BF"} {"event":{"system_performance":{"metrics":{"hw_model":"MacBookPro18,3","tasks":[{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":202.193,"cputime_ns":1013161791,"cputime_sample_ms_per_s":202.187,"cputime_userland_ratio":0.573927,"diskio_bytesread":380928,"diskio_bytesread_per_s":76020.3,"diskio_byteswritten":0,"diskio_byteswritten_per_s":0,"energy_impact":3140.59,"energy_impact_per_s":626.755,"idle_wakeups":0,"interval_ns":5010874875,"intr_wakeups_per_s":0.199566,"name":"SourceKitService","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":0,"pageins_per_s":0,"pid":36354,"qos_background_ms_per_s":0,"qos_background_ns":0,"qos_default_ms_per_s":202.086,"qos_default_ns":1012626541,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":0.105654,"qos_user_initiated_ns":529416,"qos_user_interactive_ms_per_s":0,"qos_user_interactive_ns":0,"qos_utility_ms_per_s":0,"qos_utility_ns":0,"started_abstime_ns":1968573181764,"timer_wakeups":[{"wakeups":1},{"wakeups":0}]},{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":138.511,"cputime_ns":694060541,"cputime_sample_ms_per_s":138.507,"cputime_userland_ratio":0.879748,"diskio_bytesread":151552,"diskio_bytesread_per_s":30244.6,"diskio_byteswritten":3981312,"diskio_byteswritten_per_s":794534,"energy_impact":1258.85,"energy_impact_per_s":251.224,"idle_wakeups":2,"interval_ns":5010874875,"intr_wakeups_per_s":58.872,"name":"Xcode","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":3,"pageins_per_s":0.598698,"pid":36337,"qos_background_ms_per_s":0.0153998,"qos_background_ns":77166,"qos_default_ms_per_s":11.2632,"qos_default_ns":56438500,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":11.1361,"qos_user_initiated_ns":55801625,"qos_user_interactive_ms_per_s":114.393,"qos_user_interactive_ns":573208208,"qos_utility_ms_per_s":1.7033,"qos_utility_ns":8535041,"started_abstime_ns":1968419476399,"timer_wakeups":[{"wakeups":2},{"wakeups":174}]},{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":83.7332,"cputime_ns":419576500,"cputime_sample_ms_per_s":83.7307,"cputime_userland_ratio":0.981833,"diskio_bytesread":57344,"diskio_bytesread_per_s":11443.9,"diskio_byteswritten":0,"diskio_byteswritten_per_s":0,"energy_impact":1198.09,"energy_impact_per_s":239.099,"idle_wakeups":0,"interval_ns":5010874875,"intr_wakeups_per_s":0.199566,"name":"JamfProtect","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":0,"pageins_per_s":0,"pid":58824,"qos_background_ms_per_s":0,"qos_background_ns":0,"qos_default_ms_per_s":82.6678,"qos_default_ns":414237833,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":1.06542,"qos_user_initiated_ns":5338666,"qos_user_interactive_ms_per_s":0,"qos_user_interactive_ns":0,"qos_utility_ms_per_s":0,"qos_utility_ns":0,"started_abstime_ns":2357421081500,"timer_wakeups":[{"wakeups":0},{"wakeups":0}]}]},"page_info":{"page":1,"total":4}}},"event_type":9001,"host":{"hostname":"MacBookPro","ips":["192.168.100.102"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.1.1","provisioningUDID":"00006000-001C58882238801E","serial":"123ABC456DE"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-06-04T09:41:38.708Z","uuid":"710782C4-489E-4003-945C-316F65C50379"} {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"gatekeeper_user_override":{"file":{"path":"/Applications/ImHex.app","stat":{"st_ino":276410,"st_nlink":3,"st_flags":0,"st_gid":80,"st_ctimespec":"2024-08-13T12:45:32.702896951Z","st_mode":16877,"st_size":96,"st_blksize":4096,"st_dev":16777233,"st_birthtimespec":"2024-07-09T06:14:53.000000000Z","st_mtimespec":"2024-07-09T06:14:53.000000000Z","st_uid":501,"st_atimespec":"2024-08-13T12:44:06.493954409Z","st_blocks":0,"st_gen":0,"st_rdev":0},"path_truncated":false},"signing_info":{"cdhash":"8F5EE5FD68737F31100CFFD5C8C4C0F9F129F61E","team_id":null,"signing_id":"net.WerWolv.ImHex"},"sha256":"NULL","file_type":1}},"event_type":146,"global_seq_num":0,"host":{"hostname":"MacBookPro","ips":["192.168.6.74"],"os":"Version 15.3 (Build 24D5055b)","protectVersion":"6.3.3.4","provisioningUDID":"337a9bb866f898a336b0d3d2176045a3a1347ad8","serial":"ZL2GDYMJDM"},"mach_time":30818180643,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"original_ppid":1,"ppid":1,"session_id":171,"signing_id":"com.apple.syspolicyd","is_platform_binary":true,"parent_audit_token":{"egid":0,"pid":1,"asid":100001,"rgid":0,"ruid":0,"euid":0,"pidversion":7,"auid":4294967295,"uuid":"2B6E1584-0A36-4FC1-9897-A282D6A6F2F0"},"team_id":null,"group_id":171,"tty":null,"is_es_client":false,"executable":{"stat":{"st_nlink":1,"st_gid":0,"st_dev":16777233,"st_mode":33261,"st_birthtimespec":"2024-08-09T12:23:23.000000000Z","st_size":2502224,"st_atimespec":"2024-08-09T12:23:23.000000000Z","st_uid":0,"st_blksize":4096,"st_flags":524320,"st_gen":0,"st_ino":1152921500312492700,"st_rdev":0,"st_ctimespec":"2024-08-09T12:23:23.000000000Z","st_mtimespec":"2024-08-09T12:23:23.000000000Z","st_blocks":2088},"path":"/usr/libexec/syspolicyd","path_truncated":false},"cdhash":"F276F6DF70766BBD0D90BF25CED170468EF306D3","audit_token":{"auid":4294967295,"egid":0,"euid":0,"asid":100001,"rgid":0,"ruid":0,"pidversion":461,"pid":171,"uuid":"94DF5DE7-6851-4E24-9D9A-BFD45DC826FD"},"start_time":"2024-08-13T12:24:14.599716Z","codesigning_flags":570522369,"responsible_audit_token":{"auid":4294967295,"pid":171,"rgid":0,"euid":0,"asid":100001,"pidversion":461,"ruid":0,"egid":0,"uuid":"C7A6D408-273C-4F6E-B5A4-903F641E3BCE"}},"seq_num":0,"thread":{"thread_id":22745,"uuid":"2F21A566-B8E0-4F52-869A-E92445FB794E"},"time":"2024-08-13T12:45:32.706386826Z","uuid":"A8C84E30-C305-4E69-87CD-789ADFEB0FE4","version":8} +{"event":{"network_connect":{"direction":"outbound","instigator":{"audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":29408,"pidversion":3275917,"rgid":20,"ruid":502,"signing_id":"com.apple.ProblemReporter","uuid":"F482DC7B-7A7B-5D76-8180-65700ECC7162"},"cdhash":"53ff5b03cc0351d19fe705d4cdb082d1254e6fb7","codesigning_flags":637623057,"executable":{"path":"\/System\/Library\/CoreServices\/Problem Reporter.app\/Contents\/MacOS\/Problem Reporter","path_truncated":false,"sha1":"718b11e5a4d3e993a1272885e15d6f8476bd45a5","sha256":"270da9528d4b3fb1c3b7d9c4312e46504d3fd5025a1b7bffe9285a6d2bb82cdc","stat":{"st_atimespec":"2025-05-04T05:39:22.000Z","st_birthtimespec":"2025-05-04T05:39:22.000Z","st_blksize":4096,"st_blocks":176,"st_ctimespec":"2025-05-04T05:39:22.000Z","st_dev":16777230,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312083241,"st_mode":33261,"st_mtimespec":"2025-05-04T05:39:22.000Z","st_nlink":1,"st_rdev":0,"st_size":294464,"st_uid":0}},"group_id":29408,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":564,"rgid":0,"ruid":0,"uuid":"B23766A5-BA72-5526-9604-D743646381A6"},"ppid":1,"responsible_audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":29408,"pidversion":3275917,"rgid":20,"ruid":502,"signing_id":"com.apple.ProblemReporter","uuid":"F482DC7B-7A7B-5D76-8180-65700ECC7162"},"session_id":1,"signing_id":"com.apple.ProblemReporter","start_time":"2025-07-29T08:15:22.000Z","team_id":null,"tty":null},"instigator_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":29408,"pidversion":3275917,"rgid":20,"ruid":502,"signing_id":"com.apple.ProblemReporter","uuid":"F482DC7B-7A7B-5D76-8180-65700ECC7162"},"local_endpoint":{"host":"::","host_type":"ipv6","port":61272},"remote_endpoint":{"host":"fddd:dddd::","host_type":"ipv6","port":53},"remote_hostname":"speedtracer.apple.com","socket_family":30,"socket_protocol":17,"socket_type":2,"timestamp":"2025-07-29T08:15:22Z","uuid":"D89B5B5D-793C-4940-EF6D-00005DA93101"}},"event_type":9010,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process_token":{"asid":100015,"auid":4294967295,"egid":65,"euid":65,"pid":443,"pidversion":1030,"rgid":65,"ruid":65,"uuid":"C428EB78-F8A6-566F-93CC-7F07A137C59B"},"time":"2025-07-29T08:15:22.815Z","uuid":"20A751C4-493E-402C-8CEA-771E173C2642"} +{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"pty_grant":{"dev":251658253}},"event_type":83,"global_seq_num":14369,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"mach_time":36711229234880,"process":{"audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":54143,"pidversion":2585097,"rgid":20,"ruid":502,"uuid":"785AAD3C-C87D-5498-90D5-D2A9F0C385D1"},"cdhash":"2021c15444de9c59374b33d9235d392859a1c6ff","codesigning_flags":637631233,"executable":{"path":"\/System\/Applications\/Utilities\/Terminal.app\/Contents\/MacOS\/Terminal","path_truncated":false,"sha1":"572272ffc9997da2d1d3ce727ada066d2947db36","sha256":"f2e2965986674f21934513c353de4669bf9332391d097a056c3f981c5557c1aa","stat":{"st_atimespec":"2025-05-04T05:39:22.000Z","st_birthtimespec":"2025-05-04T05:39:22.000Z","st_blksize":4096,"st_blocks":1872,"st_ctimespec":"2025-05-04T05:39:22.000Z","st_dev":16777230,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500311911766,"st_mode":33261,"st_mtimespec":"2025-05-04T05:39:22.000Z","st_nlink":1,"st_rdev":0,"st_size":2207824,"st_uid":0}},"group_id":54143,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":564,"rgid":0,"ruid":0,"uuid":"B23766A5-BA72-5526-9604-D743646381A6"},"ppid":1,"responsible_audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":54143,"pidversion":2585097,"rgid":20,"ruid":502,"uuid":"785AAD3C-C87D-5498-90D5-D2A9F0C385D1"},"session_id":1,"signing_id":"com.apple.Terminal","start_time":"2025-07-23T16:24:28.001Z","team_id":null,"tty":null},"seq_num":2,"thread":{"thread_id":59491663,"uuid":"ED098736-8793-5939-ACA5-613214C3952D"},"time":"2025-07-30T10:23:47.469Z","uuid":"5CCEB621-7191-44F6-8500-CB3F5B01B959","version":8} +{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"pty_close":{"dev":251658259}},"event_type":84,"global_seq_num":2444,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":36738899244634,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":89970,"pidversion":3418373,"rgid":20,"ruid":502,"signing_id":"a.out","uuid":"F09D3275-F7D6-5F3B-9448-29814244081B"},"cdhash":"c9f4b9ee8039ba1c3854dbb2e4576cf675c2753a","codesigning_flags":570556931,"executable":{"path":"\/usr\/local\/bin\/elastic-package","path_truncated":false,"sha1":"fa70141612f0ba15b00f2a2b27e32a24d9162f33","sha256":"2395da9f5fbd34f78277b58e7ed8766e3f22bc14fa4b2feccb2406a2695e4075","stat":{"st_atimespec":"2025-07-30T10:42:58.971Z","st_birthtimespec":"2025-07-22T13:35:06.000Z","st_blksize":4096,"st_blocks":207864,"st_ctimespec":"2025-07-30T10:42:20.492Z","st_dev":16777230,"st_flags":0,"st_gen":0,"st_gid":0,"st_ino":156989410,"st_mode":33261,"st_mtimespec":"2025-07-22T13:35:06.000Z","st_nlink":1,"st_rdev":0,"st_size":106422642,"st_uid":502}},"group_id":89970,"is_es_client":false,"is_platform_binary":false,"original_ppid":89401,"parent_audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":89401,"pidversion":3417437,"rgid":20,"ruid":502,"signing_id":"com.apple.zsh","uuid":"92C4549D-E485-51A7-8CDA-86C61D04C7D7"},"ppid":89401,"responsible_audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":48761,"pidversion":2575070,"rgid":20,"ruid":502,"signing_id":"dev.warp.Warp-Stable","uuid":"DA46B7E3-F0D3-5E1F-A329-F240D0C29267"},"session_id":89401,"signing_id":"a.out","start_time":"2025-07-30T10:42:57.000Z","team_id":null,"tty":{"path":"\/dev\/ttys018","path_truncated":false,"stat":{"st_atimespec":"2025-07-30T10:42:57.196Z","st_birthtimespec":"1970-01-01T00:00:00.000Z","st_blksize":65536,"st_blocks":0,"st_ctimespec":"2025-07-30T10:42:59.265Z","st_dev":-58166916,"st_flags":0,"st_gen":0,"st_gid":4,"st_ino":2479,"st_mode":8592,"st_mtimespec":"2025-07-30T10:42:59.265Z","st_nlink":1,"st_rdev":268435474,"st_size":0,"st_uid":502}}},"seq_num":0,"thread":{"thread_id":76667536,"uuid":"F954E93B-DF31-590B-A1A3-0C3E8EA27A6A"},"time":"2025-07-30T10:43:00.398Z","uuid":"EE7212E7-D7BA-4100-A568-DF9B71435098","version":8} +{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"tcc_modify":{"identity":"com.redcanary.agent.securityextension","identity_type":0,"instigator":{"audit_token":{"asid":100016,"auid":502,"egid":20,"euid":502,"pid":96352,"pidversion":1240892,"rgid":20,"ruid":502,"signing_id":"com.apple.settings.PrivacySecurity.extension","uuid":"EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45"},"cdhash":"9f8d7e11bfd45a352a49b54f556dd315d00f4c07","codesigning_flags":637631233,"executable":{"path":"/System/Library/ExtensionKit/Extensions/SecurityPrivacyExtension.appex/Contents/MacOS/SecurityPrivacyExtension","path_truncated":false,"sha1":"6ea0b92fb18de82b3d4b2f0672ed7587440c12c5","sha256":"2d1f05bd6559d6baf48d59fbf2f99cca9e43094eb9d65d8e2d00fbd6ed2fca8e","stat":{"st_atimespec":"2025-07-20T07:19:46.000Z","st_birthtimespec":"2025-07-20T07:19:46.000Z","st_blksize":4096,"st_blocks":3176,"st_ctimespec":"2025-07-20T07:19:46.000Z","st_dev":16777229,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312115791,"st_mode":33261,"st_mtimespec":"2025-07-20T07:19:46.000Z","st_nlink":1,"st_rdev":0,"st_size":3618896,"st_uid":0}},"group_id":96352,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":1111,"rgid":0,"ruid":0,"uuid":"BB988465-F537-5679-896E-490BB9F5E4C1"},"ppid":1,"responsible_audit_token":{"asid":100016,"auid":502,"egid":20,"euid":502,"pid":96352,"pidversion":1240892,"rgid":20,"ruid":502,"signing_id":"com.apple.settings.PrivacySecurity.extension","uuid":"EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45"},"session_id":96352,"signing_id":"com.apple.settings.PrivacySecurity.extension","start_time":"2025-07-30T12:33:43.001Z","team_id":null,"tty":null},"instigator_token":{"asid":100016,"auid":502,"egid":20,"euid":502,"pid":96352,"pidversion":1240892,"rgid":20,"ruid":502,"signing_id":"com.apple.settings.PrivacySecurity.extension","uuid":"EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45"},"reason":3,"right":0,"service":"SystemPolicyAllFiles","update_type":2}},"event_type":147,"global_seq_num":613647,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":14415254265270,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":648,"pidversion":1444,"rgid":0,"ruid":0,"signing_id":"com.apple.tccd","uuid":"B70AB577-DEE7-59A7-9E46-FCA1971A385E"},"cdhash":"910f0978369dbbeb6aa6dcb51b047323c0d06275","codesigning_flags":637631233,"executable":{"path":"/System/Library/PrivateFrameworks/TCC.framework/Support/tccd","path_truncated":false,"sha1":"61d9445e5d59102e4f12a81999bd0e4a15bfc75f","sha256":"6f5a31d8d2e74b08ab644a2615d155d4032f7454115691d82b73caf1849ccec5","stat":{"st_atimespec":"2025-07-20T07:19:46.000Z","st_birthtimespec":"2025-07-20T07:19:46.000Z","st_blksize":4096,"st_blocks":1320,"st_ctimespec":"2025-07-20T07:19:46.000Z","st_dev":16777229,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312451094,"st_mode":33261,"st_mtimespec":"2025-07-20T07:19:46.000Z","st_nlink":1,"st_rdev":0,"st_size":1625088,"st_uid":0}},"group_id":648,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":1111,"rgid":0,"ruid":0,"uuid":"BB988465-F537-5679-896E-490BB9F5E4C1"},"ppid":1,"responsible_audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":648,"pidversion":1444,"rgid":0,"ruid":0,"signing_id":"com.apple.tccd","uuid":"B70AB577-DEE7-59A7-9E46-FCA1971A385E"},"session_id":648,"signing_id":"com.apple.tccd","start_time":"2025-07-22T19:12:25.000Z","team_id":null,"tty":null},"seq_num":1,"thread":{"thread_id":26037400,"uuid":"1E85E074-2E23-5E96-9682-CE9369C063BE"},"time":"2025-07-30T12:34:35.848Z","uuid":"4976F7D5-136A-4DE5-A52D-AE34CBB93E76","version":10} +{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"mount":{"device":{"block_size":512,"bsd_major":1,"bsd_minor":21,"bsd_name":"disk4s1","bsd_unit":4,"bus_name":"usb-drd0-port-ss","bus_path":"IODeviceTree:/arm-io@10F00000/usb-drd0@82280000/usb-drd0-port-ss@00200000","content":"48465300-0000-11AA-AA11-00306543ECAC","device_class":0,"device_model":"Extreme 55AE","device_path":"IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-ss@00200000/Extreme 55AE@00200000/IOUSBHostInterface@0/IOUSBMassStorageInterfaceNub/IOUSBMassStorageDriverNub/IOUSBMassStorageUASDriver/IOSCSITargetDevice/IOSCSIHierarchicalLogicalUnit@0000000000000000/IOSCSIPeripheralDeviceType00/IOBlockStorageServices","device_sub_class":0,"encryption_detail":0,"is_ejectable":0,"is_encrypted":0,"is_internal":0,"is_leaf":1,"is_mountable":1,"is_network_volume":0,"is_removable":0,"is_whole":0,"is_writable":1,"media_kind":"IOMedia","media_name":"Extreme SSD","media_path":"IODeviceTree:/arm-io@10F00000/usb-drd0@82280000/usb-drd0-port-ss@00200000/@1:1","product_id":"0x55ae","product_name":"Extreme 55AE","protocol":"USB","revision":"3000","serial_number":"323132383639343032303633","size":1000035009024,"unit":1,"vendor_id":"0x0781","vendor_name":"SanDisk","volume_kind":"hfs","volume_name":"Extreme SSD","volume_type":"Mac OS Extended (Journaled)"},"disposition":1,"statfs":{"f_bavail":179988282,"f_bfree":179988282,"f_blocks":244149172,"f_bsize":4096,"f_ffree":4294858948,"f_files":4294967279,"f_flags":77632024,"f_flags_ext":0,"f_fsid":[16777237,25],"f_fssubtype":1,"f_fstypename":"hfs","f_iosize":1048576,"f_mntfromname":"/dev/disk4s1","f_mntonname":"/Volumes/Extreme SSD","f_owner":0,"f_type":25}}},"event_type":22,"global_seq_num":1868,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":143342977912,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":2264,"pidversion":5800,"rgid":0,"ruid":0,"signing_id":"com.apple.mount_hfs","uuid":"6F03D9EB-00F5-5063-80A4-807B2748E27C"},"cdhash":"fa137bee0557f3eabf4f2951706c6dd4ea098a1a","codesigning_flags":637623057,"executable":{"path":"/System/Library/Filesystems/hfs.fs/Contents/Resources/mount_hfs","path_truncated":false,"sha1":"f27266481af35326c7d731e9812ebe6cb97257b6","sha256":"3852f3975caa4b9a65a7aed745949085a819926c9c09621b4d3e0a65437341f5","stat":{"st_atimespec":"2025-01-16T09:35:10.000Z","st_birthtimespec":"2025-01-16T09:35:10.000Z","st_blksize":4096,"st_blocks":48,"st_ctimespec":"2025-01-16T09:35:10.000Z","st_dev":16777232,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312119900,"st_mode":33261,"st_mtimespec":"2025-01-16T09:35:10.000Z","st_nlink":1,"st_rdev":0,"st_size":137680,"st_uid":0}},"group_id":142,"is_es_client":false,"is_platform_binary":true,"original_ppid":2263,"parent_audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":2263,"pidversion":5798,"rgid":0,"ruid":0,"signing_id":"com.apple.mount","uuid":"E78A506A-AEDA-55BB-AB9E-1BFBC1FFC44E"},"ppid":2263,"responsible_audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":142,"pidversion":273,"rgid":0,"ruid":0,"signing_id":"com.apple.diskarbitrationd","uuid":"34B43207-EF50-5039-B37E-6A02976BBBFE"},"session_id":142,"signing_id":"com.apple.mount_hfs","start_time":"2025-02-11T19:18:30.001Z","team_id":null,"tty":null},"seq_num":0,"thread":{"thread_id":60013,"uuid":"2A21C001-B7E2-5696-B459-C34A09E46B95"},"time":"2025-02-11T19:18:30.568Z","uuid":"3F1E5452-13A2-40E5-8620-8238DB9F81B3","version":8} \ No newline at end of file diff --git a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json index a3382f546a5..58fb5318b1b 100644 --- a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json +++ b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json @@ -56,7 +56,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.loginwindow" }, "endpoint_security_client": false, @@ -176,7 +176,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.loginwindow" }, "endpoint_security_client": false, @@ -299,7 +299,7 @@ }, "process": { "code_signature": { - "flags": "570506001", + "flags": 570506001, "signing_id": "com.apple.pwpolicy" }, "endpoint_security_client": false, @@ -417,7 +417,7 @@ }, "process": { "code_signature": { - "flags": "570522385", + "flags": 570522385, "signing_id": "com.apple.sudo" }, "command_line": "/usr/local/bin/protectctl", @@ -547,7 +547,7 @@ ], "args_count": 3, "code_signature": { - "flags": "570493697", + "flags": 570493697, "signing_id": "com.apple.zsh" }, "endpoint_security_client": false, @@ -689,7 +689,7 @@ }, "process": { "code_signature": { - "flags": "570506001", + "flags": 570506001, "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -818,7 +818,7 @@ }, "process": { "code_signature": { - "flags": "570506001", + "flags": 570506001, "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -943,7 +943,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.Users-Groups-Settings.extension" }, "endpoint_security_client": false, @@ -1063,7 +1063,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.Users-Groups-Settings.extension" }, "endpoint_security_client": false, @@ -1188,7 +1188,7 @@ }, "process": { "code_signature": { - "flags": "570506001", + "flags": 570506001, "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -1313,7 +1313,7 @@ }, "process": { "code_signature": { - "flags": "570506001", + "flags": 570506001, "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -1556,7 +1556,7 @@ }, "process": { "code_signature": { - "flags": "570522385", + "flags": 570522385, "signing_id": "com.apple.coreauthd" }, "endpoint_security_client": false, @@ -1675,7 +1675,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.loginwindow" }, "endpoint_security_client": false, @@ -1798,7 +1798,7 @@ }, "process": { "code_signature": { - "flags": "570522385", + "flags": 570522385, "signing_id": "com.apple.sshd" }, "endpoint_security_client": false, @@ -1921,7 +1921,7 @@ }, "process": { "code_signature": { - "flags": "570522385", + "flags": 570522385, "signing_id": "com.apple.login" }, "endpoint_security_client": false, @@ -2044,7 +2044,7 @@ }, "process": { "code_signature": { - "flags": "570522385", + "flags": 570522385, "signing_id": "com.apple.login" }, "endpoint_security_client": false, @@ -2165,7 +2165,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.XProtectFramework.plugins.KeySteal" }, "endpoint_security_client": false, @@ -2298,7 +2298,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.XprotectFramework.AnalysisService" }, "endpoint_security_client": false, @@ -2443,7 +2443,7 @@ ], "args_count": 1, "code_signature": { - "flags": "570522385", + "flags": 570522385, "signing_id": "com.apple.su" }, "endpoint_security_client": false, @@ -2609,7 +2609,7 @@ }, "process": { "code_signature": { - "flags": "570522385", + "flags": 570522385, "signing_id": "com.apple.screensharing.daemon" }, "endpoint_security_client": false, @@ -2731,7 +2731,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.kernelmanagerd" }, "endpoint_security_client": false, @@ -2860,7 +2860,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.mdmclient" }, "endpoint_security_client": false, @@ -2978,7 +2978,7 @@ }, "process": { "code_signature": { - "flags": "570506001", + "flags": 570506001, "signing_id": "com.apple.sntp" }, "endpoint_security_client": false, @@ -3105,7 +3105,7 @@ }, "process": { "code_signature": { - "flags": "570503953", + "flags": 570503953, "signing_id": "com.txhaflaire.JamfCheck", "team_id": "CLQKFNPCCP" }, @@ -3233,7 +3233,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.backgroundtaskmanagementd" }, "endpoint_security_client": false, @@ -3416,7 +3416,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.dirhelper" }, "endpoint_security_client": false, @@ -3481,133 +3481,6 @@ } } }, - { - "device": { - "id": "KJQMQP4XW0", - "manufacturer": "Apple", - "serial_number": "KJQMQP4XW0" - }, - "ecs": { - "version": "8.17.0" - }, - "event": { - "action": "mount", - "category": [ - "process" - ], - "code": "22", - "id": "0CAC3D00-385F-4F44-872A-B6035375C197", - "kind": "event", - "provider": "Jamf Protect", - "reason": "A file system has been mounted", - "sequence": 106336, - "start": "2024-06-11T11:35:28.142Z", - "type": [ - "info", - "start" - ] - }, - "host": { - "hostname": "MacBookPro-Sjaffy (2)", - "id": "00006030-001E301C0228001C", - "ip": [ - "192.168.11.251", - "192.168.64.1", - "192.168.11.232" - ], - "name": "macbookpro-sjaffy (2)", - "os": { - "family": "macos", - "full": "14.5 (Build 23F79)", - "name": "macOS", - "type": "macos", - "version": "14.5" - } - }, - "jamf_protect": { - "telemetry": { - "event_allowed_by_esclient": true - } - }, - "observer": { - "product": "Jamf Protect", - "type": "Endpoint Security", - "vendor": "Jamf", - "version": "6.0.1.11" - }, - "process": { - "code_signature": { - "flags": "570522369", - "signing_id": "com.apple.mount_apfs" - }, - "endpoint_security_client": false, - "entity_id": "39AE3A81-23C1-5E15-9871-295A85E0FEA1", - "executable": "/System/Library/Filesystems/apfs.fs/Contents/Resources/mount_apfs", - "hash": { - "cdhash": "7804bd9c2e3b5e16cf9fcfba943564485fb6f20f" - }, - "interactive": false, - "name": "mount_apfs", - "parent": { - "entity_id": "F7ED3BE5-780C-5F1B-AD74-F5F01CB3DC39", - "pid": 26930, - "real_group": { - "id": "20" - }, - "real_user": { - "id": "502" - }, - "user": { - "id": "502" - } - }, - "pid": 26932, - "platform_binary": true, - "responsible": { - "entity_id": "6FC75B65-1B69-5020-A07F-7541488904C3", - "pid": 1148, - "real_group": { - "id": "0" - }, - "real_user": { - "id": "0" - }, - "user": { - "id": "0" - } - }, - "start": "2024-06-11T11:35:28.000Z", - "thread": { - "id": 15379585 - } - }, - "related": { - "hash": [ - "7804bd9c2e3b5e16cf9fcfba943564485fb6f20f" - ], - "hosts": [ - "MacBookPro-Sjaffy (2)" - ], - "ip": [ - "192.168.11.251", - "192.168.64.1", - "192.168.11.232" - ] - }, - "user": { - "effective": { - "id": [ - "502" - ] - } - }, - "volume": { - "device_name": "/dev/disk9s1", - "file_system_type": "apfs", - "mount_name": "/Volumes/JamfConnect", - "size": 4096 - } - }, { "device": { "id": "123ABC456DE", @@ -4011,7 +3884,7 @@ }, "process": { "code_signature": { - "flags": "570522369", + "flags": 570522369, "signing_id": "com.apple.syspolicyd" }, "endpoint_security_client": false, @@ -4083,6 +3956,663 @@ ] } } + }, + { + "destination": { + "domain": "speedtracer.apple.com", + "ip": "fddd:dddd::", + "port": 53 + }, + "device": { + "id": "123ABC456DJ", + "manufacturer": "Apple", + "serial_number": "123ABC456DJ" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "network_connect", + "category": [ + "process", + "network" + ], + "code": "9010", + "id": "20A751C4-493E-402C-8CEA-771E173C2642", + "kind": "event", + "provider": "Jamf Protect", + "reason": "A network connection has been established", + "start": "2025-07-29T08:15:22.815Z", + "type": [ + "info" + ] + }, + "host": { + "hostname": "MacbookPro", + "id": "00006030-001E301C0228001C", + "ip": [ + "192.168.11.16" + ], + "name": "macbookpro", + "os": { + "family": "macos", + "full": "15.5 (Build 24F74)", + "name": "macOS", + "type": "macos", + "version": "15.5" + } + }, + "jamf_protect": { + "telemetry": { + "network_socket_family": "af_inet6", + "network_socket_type": "sock_dgram" + } + }, + "network": { + "transport": "udp" + }, + "observer": { + "product": "Jamf Protect", + "type": "Endpoint Security", + "vendor": "Jamf", + "version": "7.3.0.5" + }, + "process": { + "code_signature": { + "flags": 637623057, + "signing_id": "com.apple.ProblemReporter" + }, + "endpoint_security_client": false, + "entity_id": "F482DC7B-7A7B-5D76-8180-65700ECC7162", + "executable": "/System/Library/CoreServices/Problem Reporter.app/Contents/MacOS/Problem Reporter", + "hash": { + "cdhash": "53ff5b03cc0351d19fe705d4cdb082d1254e6fb7", + "sha1": "718b11e5a4d3e993a1272885e15d6f8476bd45a5", + "sha256": "270da9528d4b3fb1c3b7d9c4312e46504d3fd5025a1b7bffe9285a6d2bb82cdc" + }, + "interactive": false, + "name": "Problem Reporter", + "parent": { + "entity_id": "B23766A5-BA72-5526-9604-D743646381A6", + "pid": 1, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "user": { + "id": "0" + } + }, + "pid": 29408, + "platform_binary": true, + "responsible": { + "code_signature": { + "signing_id": "com.apple.ProblemReporter" + }, + "entity_id": "F482DC7B-7A7B-5D76-8180-65700ECC7162", + "pid": 29408, + "real_group": { + "id": "20" + }, + "real_user": { + "id": "502" + }, + "user": { + "id": "502" + } + }, + "start": "2025-07-29T08:15:22.000Z" + }, + "related": { + "hash": [ + "718b11e5a4d3e993a1272885e15d6f8476bd45a5", + "270da9528d4b3fb1c3b7d9c4312e46504d3fd5025a1b7bffe9285a6d2bb82cdc", + "53ff5b03cc0351d19fe705d4cdb082d1254e6fb7" + ], + "hosts": [ + "MacbookPro" + ], + "ip": [ + "192.168.11.16" + ] + }, + "source": { + "ip": "::", + "port": 61272 + }, + "url": { + "domain": [ + "speedtracer.apple.com" + ] + }, + "user": { + "effective": { + "id": [ + "502" + ] + } + } + }, + { + "device": { + "id": "123ABC456DJ", + "manufacturer": "Apple", + "serial_number": "123ABC456DJ" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "pty_grant", + "category": [ + "process" + ], + "code": "83", + "id": "5CCEB621-7191-44F6-8500-CB3F5B01B959", + "kind": "event", + "provider": "Jamf Protect", + "reason": "A pseudoterminal control device is granted", + "start": "2025-07-30T10:23:47.469Z", + "type": [ + "info", + "start" + ] + }, + "host": { + "hostname": "MacbookPro", + "id": "00006030-001E301C0228001C", + "ip": [ + "192.168.11.16" + ], + "name": "macbookpro", + "os": { + "family": "macos", + "full": "15.5 (Build 24F74)", + "name": "macOS", + "type": "macos", + "version": "15.5" + } + }, + "jamf_protect": { + "telemetry": { + "dev": 251658253, + "event_allowed_by_esclient": true + } + }, + "observer": { + "product": "Jamf Protect", + "type": "Endpoint Security", + "vendor": "Jamf", + "version": "7.3.0.5" + }, + "process": { + "code_signature": { + "flags": 637631233, + "signing_id": "com.apple.Terminal" + }, + "endpoint_security_client": false, + "entity_id": "785AAD3C-C87D-5498-90D5-D2A9F0C385D1", + "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal", + "hash": { + "cdhash": "2021c15444de9c59374b33d9235d392859a1c6ff", + "sha1": "572272ffc9997da2d1d3ce727ada066d2947db36", + "sha256": "f2e2965986674f21934513c353de4669bf9332391d097a056c3f981c5557c1aa" + }, + "interactive": false, + "name": "Terminal", + "parent": { + "entity_id": "B23766A5-BA72-5526-9604-D743646381A6", + "pid": 1, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "user": { + "id": "0" + } + }, + "pid": 54143, + "platform_binary": true, + "responsible": { + "entity_id": "785AAD3C-C87D-5498-90D5-D2A9F0C385D1", + "pid": 54143, + "real_group": { + "id": "20" + }, + "real_user": { + "id": "502" + }, + "user": { + "id": "502" + } + }, + "start": "2025-07-23T16:24:28.001Z", + "thread": { + "id": 59491663 + } + }, + "related": { + "hash": [ + "572272ffc9997da2d1d3ce727ada066d2947db36", + "f2e2965986674f21934513c353de4669bf9332391d097a056c3f981c5557c1aa", + "2021c15444de9c59374b33d9235d392859a1c6ff" + ], + "hosts": [ + "MacbookPro" + ], + "ip": [ + "192.168.11.16" + ] + }, + "user": { + "effective": { + "id": [ + "502" + ] + } + } + }, + { + "device": { + "id": "123ABC456DJ", + "manufacturer": "Apple", + "serial_number": "123ABC456DJ" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "pty_close", + "category": [ + "process" + ], + "code": "84", + "id": "EE7212E7-D7BA-4100-A568-DF9B71435098", + "kind": "event", + "provider": "Jamf Protect", + "reason": "A pseudoterminal control device is closed", + "start": "2025-07-30T10:43:00.398Z", + "type": [ + "info", + "end" + ] + }, + "host": { + "hostname": "MacbookPro", + "id": "00006030-001E301C0228001C", + "ip": [ + "192.168.11.16" + ], + "name": "macbookpro", + "os": { + "family": "macos", + "full": "15.5 (Build 24F74)", + "name": "macOS", + "type": "macos", + "version": "15.5" + } + }, + "jamf_protect": { + "telemetry": { + "dev": 251658259, + "event_allowed_by_esclient": true + } + }, + "observer": { + "product": "Jamf Protect", + "type": "Endpoint Security", + "vendor": "Jamf", + "version": "7.3.0.5" + }, + "process": { + "code_signature": { + "flags": 570556931, + "signing_id": "a.out" + }, + "endpoint_security_client": false, + "entity_id": "F09D3275-F7D6-5F3B-9448-29814244081B", + "executable": "/usr/local/bin/elastic-package", + "hash": { + "cdhash": "c9f4b9ee8039ba1c3854dbb2e4576cf675c2753a", + "sha1": "fa70141612f0ba15b00f2a2b27e32a24d9162f33", + "sha256": "2395da9f5fbd34f78277b58e7ed8766e3f22bc14fa4b2feccb2406a2695e4075" + }, + "interactive": true, + "name": "elastic-package", + "parent": { + "code_signature": { + "signing_id": "com.apple.zsh" + }, + "entity_id": "92C4549D-E485-51A7-8CDA-86C61D04C7D7", + "pid": 89401, + "real_group": { + "id": "20" + }, + "real_user": { + "id": "502" + }, + "user": { + "id": "502" + } + }, + "pid": 89970, + "platform_binary": false, + "responsible": { + "code_signature": { + "signing_id": "dev.warp.Warp-Stable" + }, + "entity_id": "DA46B7E3-F0D3-5E1F-A329-F240D0C29267", + "pid": 48761, + "real_group": { + "id": "20" + }, + "real_user": { + "id": "502" + }, + "user": { + "id": "502" + } + }, + "start": "2025-07-30T10:42:57.000Z", + "thread": { + "id": 76667536 + } + }, + "related": { + "hash": [ + "fa70141612f0ba15b00f2a2b27e32a24d9162f33", + "2395da9f5fbd34f78277b58e7ed8766e3f22bc14fa4b2feccb2406a2695e4075", + "c9f4b9ee8039ba1c3854dbb2e4576cf675c2753a" + ], + "hosts": [ + "MacbookPro" + ], + "ip": [ + "192.168.11.16" + ] + }, + "user": { + "effective": { + "id": [ + "502" + ] + } + } + }, + { + "device": { + "id": "123ABC456DJ", + "manufacturer": "Apple", + "serial_number": "123ABC456DJ" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "tcc_modify", + "category": [ + "process", + "configuration" + ], + "code": "147", + "id": "4976F7D5-136A-4DE5-A52D-AE34CBB93E76", + "kind": "event", + "provider": "Jamf Protect", + "reason": "A Transparency Consent and Control (TCC) permission is granted or revoked.", + "start": "2025-07-30T12:34:35.848Z", + "type": [ + "info", + "change" + ] + }, + "host": { + "hostname": "MacbookPro", + "id": "00006030-001E301C0228001C", + "ip": [ + "192.168.11.16" + ], + "name": "macbookpro", + "os": { + "family": "macos", + "full": "15.5 (Build 24F74)", + "name": "macOS", + "type": "macos", + "version": "15.5" + } + }, + "jamf_protect": { + "telemetry": { + "event_allowed_by_esclient": true, + "tcc_identity": "com.redcanary.agent.securityextension", + "tcc_identity_type": 0, + "tcc_reason": "user_set", + "tcc_right": "denied", + "tcc_service": "SystemPolicyAllFiles", + "tcc_update_type": "modify" + } + }, + "observer": { + "product": "Jamf Protect", + "type": "Endpoint Security", + "vendor": "Jamf", + "version": "7.3.0.5" + }, + "process": { + "code_signature": { + "flags": 637631233, + "signing_id": "com.apple.settings.PrivacySecurity.extension" + }, + "endpoint_security_client": false, + "entity_id": "EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45", + "executable": "/System/Library/ExtensionKit/Extensions/SecurityPrivacyExtension.appex/Contents/MacOS/SecurityPrivacyExtension", + "hash": { + "cdhash": "9f8d7e11bfd45a352a49b54f556dd315d00f4c07", + "sha1": "6ea0b92fb18de82b3d4b2f0672ed7587440c12c5", + "sha256": "2d1f05bd6559d6baf48d59fbf2f99cca9e43094eb9d65d8e2d00fbd6ed2fca8e" + }, + "interactive": false, + "name": "SecurityPrivacyExtension", + "parent": { + "entity_id": "BB988465-F537-5679-896E-490BB9F5E4C1", + "pid": 1, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "user": { + "id": "0" + } + }, + "pid": 96352, + "platform_binary": true, + "responsible": { + "code_signature": { + "signing_id": "com.apple.settings.PrivacySecurity.extension" + }, + "entity_id": "EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45", + "pid": 96352, + "real_group": { + "id": "20" + }, + "real_user": { + "id": "502" + }, + "user": { + "id": "502" + } + }, + "start": "2025-07-30T12:33:43.001Z", + "thread": { + "id": 26037400 + } + }, + "related": { + "hash": [ + "6ea0b92fb18de82b3d4b2f0672ed7587440c12c5", + "2d1f05bd6559d6baf48d59fbf2f99cca9e43094eb9d65d8e2d00fbd6ed2fca8e", + "9f8d7e11bfd45a352a49b54f556dd315d00f4c07" + ], + "hosts": [ + "MacbookPro" + ], + "ip": [ + "192.168.11.16" + ] + }, + "user": { + "effective": { + "id": [ + "502" + ] + } + } + }, + { + "device": { + "id": "123ABC456DJ", + "manufacturer": "Apple", + "serial_number": "123ABC456DJ" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "mount", + "category": [ + "process" + ], + "code": "22", + "id": "3F1E5452-13A2-40E5-8620-8238DB9F81B3", + "kind": "event", + "provider": "Jamf Protect", + "reason": "A file system has been mounted", + "start": "2025-02-11T19:18:30.568Z", + "type": [ + "info", + "start" + ] + }, + "host": { + "hostname": "MacbookPro", + "id": "00006030-001E301C0228001C", + "ip": [ + "192.168.11.16" + ], + "name": "macbookpro", + "os": { + "family": "macos", + "full": "15.5 (Build 24F74)", + "name": "macOS", + "type": "macos", + "version": "15.5" + } + }, + "jamf_protect": { + "telemetry": { + "event_allowed_by_esclient": true + } + }, + "observer": { + "product": "Jamf Protect", + "type": "Endpoint Security", + "vendor": "Jamf", + "version": "7.3.0.5" + }, + "process": { + "code_signature": { + "flags": 637623057, + "signing_id": "com.apple.mount_hfs" + }, + "endpoint_security_client": false, + "entity_id": "6F03D9EB-00F5-5063-80A4-807B2748E27C", + "executable": "/System/Library/Filesystems/hfs.fs/Contents/Resources/mount_hfs", + "hash": { + "cdhash": "fa137bee0557f3eabf4f2951706c6dd4ea098a1a", + "sha1": "f27266481af35326c7d731e9812ebe6cb97257b6", + "sha256": "3852f3975caa4b9a65a7aed745949085a819926c9c09621b4d3e0a65437341f5" + }, + "interactive": false, + "name": "mount_hfs", + "parent": { + "code_signature": { + "signing_id": "com.apple.mount" + }, + "entity_id": "E78A506A-AEDA-55BB-AB9E-1BFBC1FFC44E", + "pid": 2263, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "user": { + "id": "0" + } + }, + "pid": 2264, + "platform_binary": true, + "responsible": { + "code_signature": { + "signing_id": "com.apple.diskarbitrationd" + }, + "entity_id": "34B43207-EF50-5039-B37E-6A02976BBBFE", + "pid": 142, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "user": { + "id": "0" + } + }, + "start": "2025-02-11T19:18:30.001Z", + "thread": { + "id": 60013 + } + }, + "related": { + "hash": [ + "f27266481af35326c7d731e9812ebe6cb97257b6", + "3852f3975caa4b9a65a7aed745949085a819926c9c09621b4d3e0a65437341f5", + "fa137bee0557f3eabf4f2951706c6dd4ea098a1a" + ], + "hosts": [ + "MacbookPro" + ], + "ip": [ + "192.168.11.16" + ] + }, + "user": { + "effective": { + "id": [ + "0" + ] + } + }, + "volume": { + "bus_type": "usb-drd0-port-ss", + "device_name": "/dev/disk4s1", + "device_type": "USB", + "file_system_type": "hfs", + "mount_name": "/Volumes/Extreme SSD", + "product_id": "0x55ae", + "product_name": "Extreme 55AE", + "removable": 0, + "serial_number": "323132383639343032303633", + "size": 4096, + "vendor_id": "0x0781", + "vendor_name": "SanDisk", + "writable": 1 + } } ] } diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml index 6a0749ab081..a9b950ce7cd 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml @@ -315,14 +315,18 @@ processors: - pipeline: name: '{{ IngestPipeline "pipeline_event_gatekeeper_user_override" }}' if: ctx.event.action == "gatekeeper_user_override" - - convert: - field: process.code_signature.flags - type: string - ignore_missing: true - - convert: - field: process.parent.code_signature.flags - type: string - ignore_missing: true + - pipeline: + name: '{{ IngestPipeline "pipeline_event_network_connect" }}' + if: ctx.event.action == "network_connect" + - pipeline: + name: '{{ IngestPipeline "pipeline_event_tcc_modify" }}' + if: ctx.event.action == "tcc_modify" + - pipeline: + name: '{{ IngestPipeline "pipeline_event_pty_grant" }}' + if: ctx.event.action == "pty_grant" + - pipeline: + name: '{{ IngestPipeline "pipeline_event_pty_close" }}' + if: ctx.event.action == "pty_close" ############# ## Cleanup ## @@ -348,6 +352,7 @@ processors: - jamf_protect.telemetry.version - jamf_protect.telemetry.global_seq_num - jamf_protect.telemetry.timestamp + - jamf_protect.telemetry.process_token - message ignore_missing: true - script: diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_mount.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_mount.yml index 588cb15628b..a98a5c00a90 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_mount.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_mount.yml @@ -24,9 +24,45 @@ processors: target_field: volume.file_system_type ignore_missing: true - rename: - field: jamf_protect.telemetry.event.mount.statfs.f_bsize + field: jamf_protect.telemetry.event.mount.device.size target_field: volume.size ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.bus_name + target_field: volume.bus_type + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.product_id + target_field: volume.product_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.product_name + target_field: volume.product_name + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.vendor_id + target_field: volume.vendor_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.vendor_name + target_field: volume.vendor_name + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.protocol + target_field: volume.device_type + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.is_removable + target_field: volume.removable + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.is_writable + target_field: volume.writable + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.mount.device.serial_number + target_field: volume.serial_number + ignore_missing: true ########################## ## ECS Process ## ########################## diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml new file mode 100644 index 00000000000..d0d27490648 --- /dev/null +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml @@ -0,0 +1,279 @@ +--- +description: Pipeline for parsing specific fields related to Network Connection events in Jamf Protect +processors: + +########################## +## ECS Event Specific ## +########################## + - set: + field: event.reason + value: A network connection has been established + - append: + field: event.category + value: network + - rename: + field: jamf_protect.telemetry.event.network_connect.file.direction + target_field: network.direction + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.remote_hostname + target_field: destination.domain + ignore_missing: true + - append: + field: url.domain + value: '{{{destination.domain}}}' + if: ctx.destination?.domain != null + allow_duplicates: false + - rename: + field: jamf_protect.telemetry.event.network_connect.remote_endpoint.host + target_field: destination.ip + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.remote_endpoint.port + target_field: destination.port + type: integer + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.local_endpoint.host + target_field: source.ip + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.local_endpoint.port + target_field: source.port + type: integer + ignore_missing: true + - script: + lang: painless + params: + itemTypeMap: + '1': icmp + '6': tcp + '17': udp + '41': ip6in4 + '58': icmp6 + '255': ipproto_raw + source: > + if (ctx.jamf_protect?.telemetry?.event?.network_connect?.socket_protocol != null) { + String itemType = ctx.jamf_protect.telemetry.event.network_connect.socket_protocol.toString(); + def itemTypeString = params.itemTypeMap.containsKey(itemType) ? params.itemTypeMap[itemType] : 'unknown'; + + if (ctx.network == null) { + ctx.network = new HashMap(); + } + + ctx.network.transport = itemTypeString; + } + - script: + lang: painless + params: + itemTypeMap: + '1': af_unix + '2': af_inet + '30': af_inet6 + source: > + if (ctx.jamf_protect?.telemetry?.event?.network_connect?.socket_family != null) { + String itemType = ctx.jamf_protect.telemetry.event.network_connect.socket_family.toString(); + def itemTypeString = params.itemTypeMap.containsKey(itemType) ? params.itemTypeMap[itemType] : 'Unknown'; + ctx.jamf_protect = ctx.jamf_protect != null ? ctx.jamf_protect : new HashMap(); + ctx.jamf_protect.telemetry.network_socket_family = itemTypeString; + } + - script: + lang: painless + params: + itemTypeMap: + '1': sock_stream + '2': sock_dgram + '3': sock_raw + '4': sock_rdm + '5': sock_seqpacket + source: > + if (ctx.jamf_protect?.telemetry?.event?.network_connect?.socket_type != null) { + String itemType = ctx.jamf_protect.telemetry.event.network_connect.socket_type.toString(); + def itemTypeString = params.itemTypeMap.containsKey(itemType) ? params.itemTypeMap[itemType] : 'Unknown'; + ctx.jamf_protect = ctx.jamf_protect != null ? ctx.jamf_protect : new HashMap(); + ctx.jamf_protect.telemetry.network_socket_type = itemTypeString; + } +########################## +## ECS Process ## +########################## + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.start_time + target_field: process.start + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.audit_token.egid + target_field: jamf_protect.telemetry.event.network_connect.instigator.audit_token.egid + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.audit_token.euid + target_field: jamf_protect.telemetry.event.network_connect.instigator.audit_token.euid + type: string + ignore_missing: true + - append: + field: user.effective.id + value: '{{{jamf_protect.telemetry.event.network_connect.instigator.audit_token.euid}}}' + if: ctx.jamf_protect.telemetry?.event?.network_connect?.instigator?.audit_token?.euid != null + allow_duplicates: false + ignore_failure: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.is_platform_binary + target_field: process.platform_binary + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.is_es_client + target_field: process.endpoint_security_client + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.cdhash + target_field: process.hash.cdhash + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.executable.sha1 + target_field: process.hash.sha1 + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.executable.sha256 + target_field: process.hash.sha256 + ignore_missing: true + - append: + field: related.hash + value: '{{{process.hash.sha1}}}' + if: ctx.process?.hash?.sha1 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.hash.sha256}}}' + if: ctx.process?.hash?.sha256 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.hash.cdhash}}}' + if: ctx.process?.hash?.cdhash != null && ctx.process.hash.cdhash != '' + allow_duplicates: false + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.tty.path + target_field: jamf_protect.telemetry.tty + ignore_missing: true + - set: + field: process.interactive + value: true + if: ctx.jamf_protect.telemetry?.event?.network_connect?.instigator?.tty != null + - set: + field: process.interactive + value: false + if: ctx.jamf_protect.telemetry?.event?.network_connect?.instigator?.tty == null + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.audit_token.pid + target_field: process.pid + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.audit_token.uuid + target_field: process.entity_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.executable.path + target_field: process.executable + ignore_missing: true + - script: + lang: painless + source: > + if (ctx.process?.executable != null) { + int lastSlashIndex = ctx.process.executable.lastIndexOf('/'); + if (lastSlashIndex != -1) { + ctx.process.name = ctx.process.executable.substring(lastSlashIndex + 1); + } else { + ctx.process.name = ctx.process.executable; // Fallback if no slash is found + } + } + - rename: + field: jamf_protect.telemetry.thread.thread_id + target_field: process.thread.id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.db_path + target_field: process.working_directory + ignore_missing: true + if: ctx.jamf_protect?.telemetry?.event?.network_connect?.db_path != null + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.signing_id + target_field: process.code_signature.signing_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.team_id + target_field: process.code_signature.team_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.codesigning_flags + target_field: process.code_signature.flags + ignore_missing: true + +########################## +## ECS Parent Process ## +########################## + + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.parent_audit_token.uuid + target_field: process.parent.entity_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.parent_audit_token.pid + target_field: process.parent.pid + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.parent_audit_token.euid + target_field: process.parent.user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.parent_audit_token.ruid + target_field: process.parent.real_user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.parent_audit_token.rgid + target_field: process.parent.real_group.id + type: string + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.parent_audit_token.signing_id + target_field: process.parent.code_signature.signing_id + ignore_missing: true + +########################## +## ECS Responsible Process ## +########################## + + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.uuid + target_field: process.responsible.entity_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.pid + target_field: process.responsible.pid + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.euid + target_field: process.responsible.user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.ruid + target_field: process.responsible.real_user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.rgid + target_field: process.responsible.real_group.id + type: string + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.signing_id + target_field: process.responsible.code_signature.signing_id + ignore_missing: true + \ No newline at end of file diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml new file mode 100644 index 00000000000..20e1a29c8d7 --- /dev/null +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml @@ -0,0 +1,23 @@ +--- +description: Pipeline for parsing specific fields related to pty close events in Jamf Protect +processors: + +########################## +## ECS Event Specific ## +########################## + - set: + field: event.reason + value: A pseudoterminal control device is closed + - append: + field: event.type + value: end + - rename: + field: jamf_protect.telemetry.event.pty_close.dev + target_field: jamf_protect.telemetry.dev + ignore_missing: true +########################## +## ECS Process ## +########################## + - pipeline: + name: '{{ IngestPipeline "pipeline_object_process" }}' + \ No newline at end of file diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml new file mode 100644 index 00000000000..2ab9aa65d04 --- /dev/null +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml @@ -0,0 +1,23 @@ +--- +description: Pipeline for parsing specific fields related to pty grant events in Jamf Protect +processors: + +########################## +## ECS Event Specific ## +########################## + - set: + field: event.reason + value: A pseudoterminal control device is granted + - append: + field: event.type + value: start + - rename: + field: jamf_protect.telemetry.event.pty_grant.dev + target_field: jamf_protect.telemetry.dev + ignore_missing: true +########################## +## ECS Process ## +########################## + - pipeline: + name: '{{ IngestPipeline "pipeline_object_process" }}' + \ No newline at end of file diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_remount.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_remount.yml index 26e90db7a3c..a32551b4915 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_remount.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_remount.yml @@ -24,9 +24,45 @@ processors: target_field: volume.file_system_type ignore_missing: true - rename: - field: jamf_protect.telemetry.event.remount.statfs.f_bsize + field: jamf_protect.telemetry.event.remount.device.size target_field: volume.size ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.bus_name + target_field: volume.bus_type + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.product_id + target_field: volume.product_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.product_name + target_field: volume.product_name + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.vendor_id + target_field: volume.vendor_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.vendor_name + target_field: volume.vendor_name + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.protocol + target_field: volume.device_type + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.is_removable + target_field: volume.removable + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.is_writable + target_field: volume.writable + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.remount.device.serial_number + target_field: volume.serial_number + ignore_missing: true ########################## ## ECS Process ## ########################## diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_tcc_modify.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_tcc_modify.yml new file mode 100644 index 00000000000..359b4f8b4d4 --- /dev/null +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_tcc_modify.yml @@ -0,0 +1,269 @@ +--- +description: Pipeline for parsing specific fields related to TCC Permission events in Jamf Protect +processors: + +########################## +## ECS Event Specific ## +########################## + - set: + field: event.reason + value: A Transparency Consent and Control (TCC) permission is granted or revoked. + - append: + field: event.type + value: change + - append: + field: event.category + value: configuration + - rename: + field: jamf_protect.telemetry.event.tcc_modify.service + target_field: jamf_protect.telemetry.tcc_service + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.identity + target_field: jamf_protect.telemetry.tcc_identity + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.identity_type + target_field: jamf_protect.telemetry.tcc_identity_type + ignore_missing: true + - script: + lang: painless + params: + itemTypeMap: + '0': denied + '1': unknown + '2': allowed + '3': limited + '4': add_modify_added + '5': session_pid + '6': learn_more + source: > + if (ctx.jamf_protect?.telemetry?.event?.tcc_modify?.right != null) { + String itemType = ctx.jamf_protect.telemetry.event.tcc_modify.right.toString(); + def itemTypeString = params.itemTypeMap.containsKey(itemType) ? params.itemTypeMap[itemType] : 'Unknown'; + ctx.jamf_protect = ctx.jamf_protect != null ? ctx.jamf_protect : new HashMap(); + ctx.jamf_protect.telemetry.tcc_right = itemTypeString; + } + - script: + lang: painless + params: + itemTypeMap: + '0': none + '1': error + '2': user_consent + '3': user_set + '4': system_set + '5': service_policy + '6': mdm_policy + '7': service_override_policy + '8': missing_usage_string + '9': prompt_timeout + '10': preflight_unknown + '11': entitled + '12': app_type_policy + '13': prompt_cancel + source: > + if (ctx.jamf_protect?.telemetry?.event?.tcc_modify?.reason != null) { + String itemType = ctx.jamf_protect.telemetry.event.tcc_modify.reason.toString(); + def itemTypeString = params.itemTypeMap.containsKey(itemType) ? params.itemTypeMap[itemType] : 'Unknown'; + ctx.jamf_protect = ctx.jamf_protect != null ? ctx.jamf_protect : new HashMap(); + ctx.jamf_protect.telemetry.tcc_reason = itemTypeString; + } + - script: + lang: painless + params: + itemTypeMap: + '0': unknown + '1': create + '2': modify + '3': delete + source: > + if (ctx.jamf_protect?.telemetry?.event?.tcc_modify?.update_type != null) { + String itemType = ctx.jamf_protect.telemetry.event.tcc_modify.update_type.toString(); + def itemTypeString = params.itemTypeMap.containsKey(itemType) ? params.itemTypeMap[itemType] : 'Unknown'; + ctx.jamf_protect = ctx.jamf_protect != null ? ctx.jamf_protect : new HashMap(); + ctx.jamf_protect.telemetry.tcc_update_type = itemTypeString; + } +########################## +## ECS Process ## +########################## + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.start_time + target_field: process.start + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.audit_token.egid + target_field: jamf_protect.telemetry.event.tcc_modify.instigator.audit_token.egid + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.audit_token.euid + target_field: jamf_protect.telemetry.event.tcc_modify.instigator.audit_token.euid + type: string + ignore_missing: true + - append: + field: user.effective.id + value: '{{{jamf_protect.telemetry.event.tcc_modify.instigator.audit_token.euid}}}' + if: ctx.jamf_protect.telemetry?.event?.tcc_modify?.instigator?.audit_token?.euid != null + allow_duplicates: false + ignore_failure: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.is_platform_binary + target_field: process.platform_binary + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.is_es_client + target_field: process.endpoint_security_client + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.cdhash + target_field: process.hash.cdhash + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.executable.sha1 + target_field: process.hash.sha1 + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.executable.sha256 + target_field: process.hash.sha256 + ignore_missing: true + - append: + field: related.hash + value: '{{{process.hash.sha1}}}' + if: ctx.process?.hash?.sha1 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.hash.sha256}}}' + if: ctx.process?.hash?.sha256 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.hash.cdhash}}}' + if: ctx.process?.hash?.cdhash != null && ctx.process.hash.cdhash != '' + allow_duplicates: false + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.tty.path + target_field: jamf_protect.telemetry.tty + ignore_missing: true + - set: + field: process.interactive + value: true + if: ctx.jamf_protect.telemetry?.event?.tcc_modify?.instigator?.tty != null + - set: + field: process.interactive + value: false + if: ctx.jamf_protect.telemetry?.event?.tcc_modify?.instigator?.tty == null + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.audit_token.pid + target_field: process.pid + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.audit_token.uuid + target_field: process.entity_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.executable.path + target_field: process.executable + ignore_missing: true + - script: + lang: painless + source: > + if (ctx.process?.executable != null) { + int lastSlashIndex = ctx.process.executable.lastIndexOf('/'); + if (lastSlashIndex != -1) { + ctx.process.name = ctx.process.executable.substring(lastSlashIndex + 1); + } else { + ctx.process.name = ctx.process.executable; // Fallback if no slash is found + } + } + - rename: + field: jamf_protect.telemetry.thread.thread_id + target_field: process.thread.id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.db_path + target_field: process.working_directory + ignore_missing: true + if: ctx.jamf_protect?.telemetry?.event?.tcc_modify?.db_path != null + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.signing_id + target_field: process.code_signature.signing_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.team_id + target_field: process.code_signature.team_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.codesigning_flags + target_field: process.code_signature.flags + ignore_missing: true + +########################## +## ECS Parent Process ## +########################## + + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.parent_audit_token.uuid + target_field: process.parent.entity_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.parent_audit_token.pid + target_field: process.parent.pid + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.parent_audit_token.euid + target_field: process.parent.user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.parent_audit_token.ruid + target_field: process.parent.real_user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.parent_audit_token.rgid + target_field: process.parent.real_group.id + type: string + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.parent_audit_token.signing_id + target_field: process.parent.code_signature.signing_id + ignore_missing: true + +########################## +## ECS Responsible Process ## +########################## + + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.responsible_audit_token.uuid + target_field: process.responsible.entity_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.responsible_audit_token.pid + target_field: process.responsible.pid + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.responsible_audit_token.euid + target_field: process.responsible.user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.responsible_audit_token.ruid + target_field: process.responsible.real_user.id + type: string + ignore_missing: true + - convert: + field: jamf_protect.telemetry.event.tcc_modify.instigator.responsible_audit_token.rgid + target_field: process.responsible.real_group.id + type: string + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.tcc_modify.instigator.responsible_audit_token.signing_id + target_field: process.responsible.code_signature.signing_id + ignore_missing: true diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_unmount.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_unmount.yml index 1765059828f..05b7d471a95 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_unmount.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_unmount.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for parsing specific fields related to volume remount events in Jamf Protect +description: Pipeline for parsing specific fields related to volume unmount events in Jamf Protect processors: ########################## @@ -24,9 +24,45 @@ processors: target_field: volume.file_system_type ignore_missing: true - rename: - field: jamf_protect.telemetry.event.unmount.statfs.f_bsize + field: jamf_protect.telemetry.event.unmount.device.size target_field: volume.size ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.bus_name + target_field: volume.bus_type + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.product_id + target_field: volume.product_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.product_name + target_field: volume.product_name + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.vendor_id + target_field: volume.vendor_id + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.vendor_name + target_field: volume.vendor_name + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.protocol + target_field: volume.device_type + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.is_removable + target_field: volume.removable + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.is_writable + target_field: volume.writable + ignore_missing: true + - rename: + field: jamf_protect.telemetry.event.unmount.device.serial_number + target_field: volume.serial_number + ignore_missing: true ########################## ## ECS Process ## ########################## diff --git a/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml b/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml index b136dfcb4c1..89d1fd83abc 100644 --- a/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml +++ b/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml @@ -24,10 +24,12 @@ type: keyword - name: volume.writable type: boolean +- name: volume.device_type + type: keyword - name: device.serial_number type: keyword - name: process.code_signature.flags - type: keyword + type: long - name: process.endpoint_security_client type: boolean - name: process.hash.cdhash @@ -49,4 +51,10 @@ - name: process.parent.code_signature.flags type: keyword - name: process.responsible.code_signature.flags - type: long + type: keyword +- name: process.code_signature.signing_id + type: keyword +- name: process.parent.code_signature.signing_id + type: keyword +- name: process.responsible.code_signature.signing_id + type: keyword diff --git a/packages/jamf_protect/data_stream/telemetry/fields/fields.yml b/packages/jamf_protect/data_stream/telemetry/fields/fields.yml index 39f696a3956..cc7ebd37921 100644 --- a/packages/jamf_protect/data_stream/telemetry/fields/fields.yml +++ b/packages/jamf_protect/data_stream/telemetry/fields/fields.yml @@ -150,6 +150,30 @@ - name: network_socket_family type: keyword description: The family type of a network socket + - name: network_socket_type + type: keyword + description: The type of a network socket + - name: dev + type: integer + description: The major and minor numbers of the device + - name: tcc_service + type: keyword + description: The TCC service for which permissions are being modified + - name: tcc_identity + type: keyword + description: The identity of the application that is the subject of the permission + - name: tcc_identity_type + type: integer + description: The identity type of the application string + - name: tcc_right + type: keyword + description: The resulting TCC permission of the operation/modification + - name: tcc_reason + type: keyword + description: The reason the TCC permissions were updated + - name: tcc_update_type + type: keyword + description: The type of TCC modification event - name: system_performance type: group description: An array containing system performance metrics diff --git a/packages/jamf_protect/data_stream/telemetry/sample_event.json b/packages/jamf_protect/data_stream/telemetry/sample_event.json index 79ed443624d..9678ba0fa3e 100644 --- a/packages/jamf_protect/data_stream/telemetry/sample_event.json +++ b/packages/jamf_protect/data_stream/telemetry/sample_event.json @@ -1,15 +1,15 @@ { - "@timestamp": "2025-05-06T07:05:49.773Z", + "@timestamp": "2025-07-30T13:26:04.600Z", "agent": { - "ephemeral_id": "472f9f11-a6e7-4d0b-9e1b-130ef698ff6d", - "id": "ae8a71b9-4f10-4cd9-af9d-d9d188b4eb47", - "name": "elastic-agent-24313", + "ephemeral_id": "f1993c3e-8c6c-4e33-8f97-27aa2fe8da8b", + "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", + "name": "elastic-agent-18319", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.telemetry", - "namespace": "81248", + "namespace": "68977", "type": "logs" }, "device": { @@ -21,9 +21,9 @@ "version": "8.17.0" }, "elastic_agent": { - "id": "ae8a71b9-4f10-4cd9-af9d-d9d188b4eb47", + "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "exec", @@ -34,7 +34,7 @@ "code": "9", "dataset": "jamf_protect.telemetry", "id": "CDB31202-8CB4-4C72-A9C6-7F494CD5F598", - "ingested": "2025-05-06T07:05:50Z", + "ingested": "2025-07-30T13:26:05Z", "kind": "event", "provider": "Jamf Protect", "reason": "A new process has been executed", @@ -84,7 +84,7 @@ ], "args_count": 3, "code_signature": { - "flags": "570493697", + "flags": 570493697, "signing_id": "com.apple.zsh" }, "endpoint_security_client": false, diff --git a/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json b/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json index 51045e79fe1..542b933527e 100644 --- a/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json +++ b/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json @@ -1,24 +1,24 @@ { "@timestamp": "2024-02-06T16:01:34.442Z", "agent": { - "ephemeral_id": "113a5c9c-f492-4678-b0da-64c719584c38", - "id": "f5b76bb2-c8fa-4b9f-8d09-cb9e7d936b5a", - "name": "elastic-agent-72300", + "ephemeral_id": "981a5b24-08c9-416a-ba7e-15f7831193d7", + "id": "f8c7b758-0275-485c-b940-5c6d53afadde", + "name": "elastic-agent-94327", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.telemetry_legacy", - "namespace": "18477", + "namespace": "27225", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "f5b76bb2-c8fa-4b9f-8d09-cb9e7d936b5a", + "id": "f8c7b758-0275-485c-b940-5c6d53afadde", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "error": { "code": "0" @@ -31,7 +31,7 @@ ], "code": "43190", "dataset": "jamf_protect.telemetry_legacy", - "ingested": "2025-05-06T07:06:41Z", + "ingested": "2025-07-30T13:27:09Z", "kind": "event", "outcome": "success", "type": [ diff --git a/packages/jamf_protect/data_stream/web_threat_events/sample_event.json b/packages/jamf_protect/data_stream/web_threat_events/sample_event.json index 259b578c83f..c35d809906d 100644 --- a/packages/jamf_protect/data_stream/web_threat_events/sample_event.json +++ b/packages/jamf_protect/data_stream/web_threat_events/sample_event.json @@ -1,15 +1,15 @@ { - "@timestamp": "2025-05-06T07:07:40.814Z", + "@timestamp": "2025-07-30T13:28:21.865Z", "agent": { - "ephemeral_id": "8d7fdfb8-8f36-464d-86ae-a74755cae28f", - "id": "a3e98343-39ea-4445-8f5a-05c63b91a565", - "name": "elastic-agent-85660", + "ephemeral_id": "5417b069-c0ad-49fe-81a4-b92544f8dee8", + "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", + "name": "elastic-agent-25987", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_threat_events", - "namespace": "85085", + "namespace": "65249", "type": "logs" }, "destination": { @@ -21,9 +21,9 @@ "version": "8.17.0" }, "elastic_agent": { - "id": "a3e98343-39ea-4445-8f5a-05c63b91a565", + "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "Detected", @@ -33,7 +33,7 @@ ], "dataset": "jamf_protect.web_threat_events", "id": "013b15c9-8f62-4bf1-948a-d82367af2a10", - "ingested": "2025-05-06T07:07:41Z", + "ingested": "2025-07-30T13:28:22Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Sideloaded App", diff --git a/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json b/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json index 53819ef41dd..c9142bf67a1 100644 --- a/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json +++ b/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json @@ -1,15 +1,15 @@ { - "@timestamp": "2025-05-06T07:08:31.909Z", + "@timestamp": "2025-07-30T13:29:21.886Z", "agent": { - "ephemeral_id": "42d89806-2bc9-4e59-8539-6f725aadae26", - "id": "e51e5e0d-4398-4748-89e5-25ff802b9665", - "name": "elastic-agent-61468", + "ephemeral_id": "72b9d59b-b2cc-441f-a864-5d8cbb76f828", + "id": "e39bab3e-da35-453a-ba89-e24b1d047749", + "name": "elastic-agent-78988", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_traffic_events", - "namespace": "12323", + "namespace": "68911", "type": "logs" }, "dns": { @@ -28,9 +28,9 @@ "version": "8.17.0" }, "elastic_agent": { - "id": "e51e5e0d-4398-4748-89e5-25ff802b9665", + "id": "e39bab3e-da35-453a-ba89-e24b1d047749", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "DNS Lookup", @@ -40,7 +40,7 @@ "network" ], "dataset": "jamf_protect.web_traffic_events", - "ingested": "2025-05-06T07:08:32Z", + "ingested": "2025-07-30T13:29:22Z", "kind": "event", "outcome": [ "success" diff --git a/packages/jamf_protect/docs/README.md b/packages/jamf_protect/docs/README.md index 2e0fac8304c..6e94dcc7b4f 100644 --- a/packages/jamf_protect/docs/README.md +++ b/packages/jamf_protect/docs/README.md @@ -112,26 +112,26 @@ An example event for `alerts` looks as following: ```json { - "@timestamp": "2025-05-06T07:04:59.704Z", + "@timestamp": "2025-07-30T13:24:50.442Z", "agent": { - "ephemeral_id": "29dd8752-991c-4f0f-8625-76b7c8cf07a1", - "id": "91381ecc-cd6d-4b82-8918-53fd23b92f71", - "name": "elastic-agent-26611", + "ephemeral_id": "543d6574-b616-440a-9e2f-5d999a7392fd", + "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", + "name": "elastic-agent-66883", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.alerts", - "namespace": "86504", + "namespace": "61044", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "91381ecc-cd6d-4b82-8918-53fd23b92f71", + "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "CustomURLHandlerCreation", @@ -142,7 +142,7 @@ An example event for `alerts` looks as following: ], "dataset": "jamf_protect.alerts", "id": "6bdb0697-6d07-47bc-a37d-6c3348a5d953", - "ingested": "2025-05-06T07:05:00Z", + "ingested": "2025-07-30T13:24:51Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Application that uses custom url handler created", @@ -304,17 +304,17 @@ An example event for `telemetry` looks as following: ```json { - "@timestamp": "2025-05-06T07:05:49.773Z", + "@timestamp": "2025-07-30T13:26:04.600Z", "agent": { - "ephemeral_id": "472f9f11-a6e7-4d0b-9e1b-130ef698ff6d", - "id": "ae8a71b9-4f10-4cd9-af9d-d9d188b4eb47", - "name": "elastic-agent-24313", + "ephemeral_id": "f1993c3e-8c6c-4e33-8f97-27aa2fe8da8b", + "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", + "name": "elastic-agent-18319", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.telemetry", - "namespace": "81248", + "namespace": "68977", "type": "logs" }, "device": { @@ -326,9 +326,9 @@ An example event for `telemetry` looks as following: "version": "8.17.0" }, "elastic_agent": { - "id": "ae8a71b9-4f10-4cd9-af9d-d9d188b4eb47", + "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "exec", @@ -339,7 +339,7 @@ An example event for `telemetry` looks as following: "code": "9", "dataset": "jamf_protect.telemetry", "id": "CDB31202-8CB4-4C72-A9C6-7F494CD5F598", - "ingested": "2025-05-06T07:05:50Z", + "ingested": "2025-07-30T13:26:05Z", "kind": "event", "provider": "Jamf Protect", "reason": "A new process has been executed", @@ -389,7 +389,7 @@ An example event for `telemetry` looks as following: ], "args_count": 3, "code_signature": { - "flags": "570493697", + "flags": 570493697, "signing_id": "com.apple.zsh" }, "endpoint_security_client": false, @@ -515,6 +515,7 @@ An example event for `telemetry` looks as following: | jamf_protect.telemetry.btm_item_url | URL of the BTM item | keyword | | jamf_protect.telemetry.btm_item_user_uid | UID of the user associated with the BTM item | keyword | | jamf_protect.telemetry.code_directory_hash | Code directory hash of a application bundle | keyword | +| jamf_protect.telemetry.dev | The major and minor numbers of the device | integer | | jamf_protect.telemetry.env_count | Count of environment variables | integer | | jamf_protect.telemetry.error_message | Contains the event specific error message | keyword | | jamf_protect.telemetry.es_client | Set to true if the process is an Endpoint Security client | boolean | @@ -527,6 +528,7 @@ An example event for `telemetry` looks as following: | jamf_protect.telemetry.identifier | Identifier for an entity or action | keyword | | jamf_protect.telemetry.log_entries | Log entries being collected in an event | object | | jamf_protect.telemetry.network_socket_family | The family type of a network socket | keyword | +| jamf_protect.telemetry.network_socket_type | The type of a network socket | keyword | | jamf_protect.telemetry.platform_binary | This is set to true for all binaries that are shipped with macOS | boolean | | jamf_protect.telemetry.profile_display_name | Display name of the profile | keyword | | jamf_protect.telemetry.profile_identifier | Identifier of the profile | keyword | @@ -582,15 +584,24 @@ An example event for `telemetry` looks as following: | jamf_protect.telemetry.system_performance.started_abstime_ns | Absolute start time in nanoseconds for the task | long | | jamf_protect.telemetry.system_performance.timer_wakeups | Timer wakeups for the task | nested | | jamf_protect.telemetry.system_performance.timer_wakeups.wakeups | Number of wakeups | long | +| jamf_protect.telemetry.tcc_identity | The identity of the application that is the subject of the permission | keyword | +| jamf_protect.telemetry.tcc_identity_type | The identity type of the application string | integer | +| jamf_protect.telemetry.tcc_reason | The reason the TCC permissions were updated | keyword | +| jamf_protect.telemetry.tcc_right | The resulting TCC permission of the operation/modification | keyword | +| jamf_protect.telemetry.tcc_service | The TCC service for which permissions are being modified | keyword | +| jamf_protect.telemetry.tcc_update_type | The type of TCC modification event | keyword | | jamf_protect.telemetry.to_username | Username to which an action is directed | keyword | | jamf_protect.telemetry.tty | Software terminal device file that the process is associated with | keyword | | log.offset | Log offset | long | -| process.code_signature.flags | | keyword | +| process.code_signature.flags | | long | +| process.code_signature.signing_id | | keyword | | process.endpoint_security_client | | boolean | | process.hash.cdhash | | keyword | | process.parent.code_signature.flags | | keyword | +| process.parent.code_signature.signing_id | | keyword | | process.platform_binary | | boolean | -| process.responsible.code_signature.flags | | long | +| process.responsible.code_signature.flags | | keyword | +| process.responsible.code_signature.signing_id | | keyword | | process.responsible.entity_id | | keyword | | process.responsible.pid | | long | | process.responsible.real_group.id | | keyword | @@ -598,6 +609,7 @@ An example event for `telemetry` looks as following: | process.responsible.user.id | | keyword | | volume.bus_type | | keyword | | volume.device_name | | keyword | +| volume.device_type | | keyword | | volume.file_system_type | | keyword | | volume.mount_name | | keyword | | volume.nt_name | | keyword | @@ -621,17 +633,17 @@ An example event for `web_threat_events` looks as following: ```json { - "@timestamp": "2025-05-06T07:07:40.814Z", + "@timestamp": "2025-07-30T13:28:21.865Z", "agent": { - "ephemeral_id": "8d7fdfb8-8f36-464d-86ae-a74755cae28f", - "id": "a3e98343-39ea-4445-8f5a-05c63b91a565", - "name": "elastic-agent-85660", + "ephemeral_id": "5417b069-c0ad-49fe-81a4-b92544f8dee8", + "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", + "name": "elastic-agent-25987", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_threat_events", - "namespace": "85085", + "namespace": "65249", "type": "logs" }, "destination": { @@ -643,9 +655,9 @@ An example event for `web_threat_events` looks as following: "version": "8.17.0" }, "elastic_agent": { - "id": "a3e98343-39ea-4445-8f5a-05c63b91a565", + "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "Detected", @@ -655,7 +667,7 @@ An example event for `web_threat_events` looks as following: ], "dataset": "jamf_protect.web_threat_events", "id": "013b15c9-8f62-4bf1-948a-d82367af2a10", - "ingested": "2025-05-06T07:07:41Z", + "ingested": "2025-07-30T13:28:22Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Sideloaded App", @@ -748,17 +760,17 @@ An example event for `web_traffic_events` looks as following: ```json { - "@timestamp": "2025-05-06T07:08:31.909Z", + "@timestamp": "2025-07-30T13:29:21.886Z", "agent": { - "ephemeral_id": "42d89806-2bc9-4e59-8539-6f725aadae26", - "id": "e51e5e0d-4398-4748-89e5-25ff802b9665", - "name": "elastic-agent-61468", + "ephemeral_id": "72b9d59b-b2cc-441f-a864-5d8cbb76f828", + "id": "e39bab3e-da35-453a-ba89-e24b1d047749", + "name": "elastic-agent-78988", "type": "filebeat", - "version": "8.16.5" + "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_traffic_events", - "namespace": "12323", + "namespace": "68911", "type": "logs" }, "dns": { @@ -777,9 +789,9 @@ An example event for `web_traffic_events` looks as following: "version": "8.17.0" }, "elastic_agent": { - "id": "e51e5e0d-4398-4748-89e5-25ff802b9665", + "id": "e39bab3e-da35-453a-ba89-e24b1d047749", "snapshot": false, - "version": "8.16.5" + "version": "8.18.3" }, "event": { "action": "DNS Lookup", @@ -789,7 +801,7 @@ An example event for `web_traffic_events` looks as following: "network" ], "dataset": "jamf_protect.web_traffic_events", - "ingested": "2025-05-06T07:08:32Z", + "ingested": "2025-07-30T13:29:22Z", "kind": "event", "outcome": [ "success" diff --git a/packages/jamf_protect/manifest.yml b/packages/jamf_protect/manifest.yml index 8c034af84a3..1f5972eb79c 100644 --- a/packages/jamf_protect/manifest.yml +++ b/packages/jamf_protect/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.3 name: jamf_protect title: Jamf Protect -version: "3.0.2" +version: "3.1.0" description: Receives events from Jamf Protect with Elastic Agent. type: integration categories: @@ -182,4 +182,4 @@ policy_templates: description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. owner: github: elastic/security-service-integrations - type: partner \ No newline at end of file + type: partner From 3acdcd9ebab2ac099065a116956022ce3733dfa5 Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Wed, 30 Jul 2025 17:22:20 +0200 Subject: [PATCH 02/11] change PR number --- packages/jamf_protect/changelog.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/jamf_protect/changelog.yml b/packages/jamf_protect/changelog.yml index edf7536c93e..f55f92273e7 100644 --- a/packages/jamf_protect/changelog.yml +++ b/packages/jamf_protect/changelog.yml @@ -3,19 +3,19 @@ changes: - description: Adding new Network Connect event for telemetry data streams. type: enhancement - link: https://github.com/elastic/integrations/pull/12871 + link: https://github.com/elastic/integrations/pull/14750 - description: Adding new TCC Modify event for telemetry data streams. type: enhancement - link: https://github.com/elastic/integrations/pull/12871 + link: https://github.com/elastic/integrations/pull/14750 - description: Adding new PTY Grant event for telemetry data streams. type: enhancement - link: https://github.com/elastic/integrations/pull/12871 + link: https://github.com/elastic/integrations/pull/14750 - description: Adding new PTY Close event for telemetry data streams. type: enhancement - link: https://github.com/elastic/integrations/pull/12871 + link: https://github.com/elastic/integrations/pull/14750 - description: Enhancments to the mount, remount and unmount events for telemetry data streams. type: enhancement - link: https://github.com/elastic/integrations/pull/12871 + link: https://github.com/elastic/integrations/pull/14750 - version: "3.0.2" changes: - description: Fix field type from `long` to `keyword` for `process.code_signature.flags`, `process.parent.code_signature.flags` fields to resolve conflicts with ECS. From 2bb418f6794f6e35d3eca7ebfaf472a4d94b2e39 Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Wed, 30 Jul 2025 20:48:05 +0200 Subject: [PATCH 03/11] Update test-jamf-protect-telemetry-sample-logs.log-expected.json --- .../test-jamf-protect-telemetry-sample-logs.log-expected.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json index 58fb5318b1b..4c1bbdf5bbb 100644 --- a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json +++ b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json @@ -4608,7 +4608,7 @@ "product_name": "Extreme 55AE", "removable": 0, "serial_number": "323132383639343032303633", - "size": 4096, + "size": 1000035009024, "vendor_id": "0x0781", "vendor_name": "SanDisk", "writable": 1 From fb2f49bef2fbe8ee69784ee0cbe77c2c098d6a5e Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Thu, 31 Jul 2025 07:23:16 +0200 Subject: [PATCH 04/11] Update packages/jamf_protect/changelog.yml Co-authored-by: Krishna Chaitanya Reddy Burri --- packages/jamf_protect/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/jamf_protect/changelog.yml b/packages/jamf_protect/changelog.yml index f55f92273e7..267e237e593 100644 --- a/packages/jamf_protect/changelog.yml +++ b/packages/jamf_protect/changelog.yml @@ -13,7 +13,7 @@ - description: Adding new PTY Close event for telemetry data streams. type: enhancement link: https://github.com/elastic/integrations/pull/14750 - - description: Enhancments to the mount, remount and unmount events for telemetry data streams. + - description: Enhancements to the mount, remount and unmount events for telemetry data streams. type: enhancement link: https://github.com/elastic/integrations/pull/14750 - version: "3.0.2" From 3a2e5e0eb43fb35551c5409d720f080ae02a9a23 Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Thu, 31 Jul 2025 07:24:07 +0200 Subject: [PATCH 05/11] Update packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml Co-authored-by: Dan Kortschak --- .../elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml index 2ab9aa65d04..6fb02c059fc 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml @@ -19,5 +19,4 @@ processors: ## ECS Process ## ########################## - pipeline: - name: '{{ IngestPipeline "pipeline_object_process" }}' - \ No newline at end of file + name: '{{ IngestPipeline "pipeline_object_process" }}' \ No newline at end of file From 18a85b824b63771c86b8ff861f4dae5aed0852ca Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Thu, 31 Jul 2025 07:24:16 +0200 Subject: [PATCH 06/11] Update packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml Co-authored-by: Dan Kortschak --- .../elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml index 20e1a29c8d7..fdf53c136ff 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml @@ -19,5 +19,4 @@ processors: ## ECS Process ## ########################## - pipeline: - name: '{{ IngestPipeline "pipeline_object_process" }}' - \ No newline at end of file + name: '{{ IngestPipeline "pipeline_object_process" }}' \ No newline at end of file From e065d4709e251029be6b2aa3ab256dc31a6dc6d0 Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Thu, 31 Jul 2025 07:24:27 +0200 Subject: [PATCH 07/11] Update packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml Co-authored-by: Dan Kortschak --- .../ingest_pipeline/pipeline_event_network_connect.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml index d0d27490648..1eca08e6986 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml @@ -275,5 +275,4 @@ processors: - rename: field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.signing_id target_field: process.responsible.code_signature.signing_id - ignore_missing: true - \ No newline at end of file + ignore_missing: true \ No newline at end of file From 06b781a0c01d7bc258e258e8b7aba3293d4f9aba Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Thu, 31 Jul 2025 08:04:16 +0200 Subject: [PATCH 08/11] Resolving feedback --- packages/jamf_protect/_dev/build/build.yml | 2 +- .../data_stream/alerts/sample_event.json | 14 +- ...est-jamf-protect-telemetry-sample-logs.log | 1 + ...ct-telemetry-sample-logs.log-expected.json | 126 ++++++++++++++++++ .../data_stream/telemetry/fields/ecs.yml | 2 +- .../telemetry_legacy/sample_event.json | 12 +- .../web_threat_events/sample_event.json | 14 +- .../web_traffic_events/sample_event.json | 14 +- packages/jamf_protect/docs/README.md | 44 +++--- 9 files changed, 178 insertions(+), 51 deletions(-) diff --git a/packages/jamf_protect/_dev/build/build.yml b/packages/jamf_protect/_dev/build/build.yml index 2bfcfc223b0..d8553567e9c 100644 --- a/packages/jamf_protect/_dev/build/build.yml +++ b/packages/jamf_protect/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: "git@v8.11.0" + reference: "git@v8.17.0" diff --git a/packages/jamf_protect/data_stream/alerts/sample_event.json b/packages/jamf_protect/data_stream/alerts/sample_event.json index 8abc3388eb5..cecb8f4e925 100644 --- a/packages/jamf_protect/data_stream/alerts/sample_event.json +++ b/packages/jamf_protect/data_stream/alerts/sample_event.json @@ -1,22 +1,22 @@ { - "@timestamp": "2025-07-30T13:24:50.442Z", + "@timestamp": "2025-07-31T05:48:48.881Z", "agent": { - "ephemeral_id": "543d6574-b616-440a-9e2f-5d999a7392fd", - "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", - "name": "elastic-agent-66883", + "ephemeral_id": "c84f4740-e168-48f3-9128-b2038e00262c", + "id": "503e4258-ae05-4e72-858f-5a69d0889a13", + "name": "elastic-agent-51923", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.alerts", - "namespace": "61044", + "namespace": "44087", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", + "id": "503e4258-ae05-4e72-858f-5a69d0889a13", "snapshot": false, "version": "8.18.3" }, @@ -29,7 +29,7 @@ ], "dataset": "jamf_protect.alerts", "id": "6bdb0697-6d07-47bc-a37d-6c3348a5d953", - "ingested": "2025-07-30T13:24:51Z", + "ingested": "2025-07-31T05:48:49Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Application that uses custom url handler created", diff --git a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log index 77e71799f4a..3c8f3a1ab0e 100644 --- a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log +++ b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log @@ -26,6 +26,7 @@ {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"btm_launch_item_remove":{"item":{"app_url":"","item_type":3,"item_url":"file:///Library/LaunchAgents/inSyncAgent.plist","legacy":true,"managed":true,"uid":502}}},"event_type":125,"glob_seq_num":1068,"host":{"hostname":"MacBookPro","ips":["192.168.11.251","192.168.11.232","192.168.64.1"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"5.5.0.6","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":30270988724172,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":28267,"pidversion":47589294,"rgid":0,"ruid":0,"uuid":"CB0CAAE3-08B8-56CA-BDCA-BD5F44B17CE4"},"cdhash":"1c01957ea34ce597bbbb6f52245e0a3cb4917cab","codesigning_flags":570522369,"executable":{"path":"/System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Versions/A/Resources/backgroundtaskmanagementd","path_truncated":false,"stat":{"st_atimespec":"2024-03-21T06:13:23.000Z","st_birthtimespec":"2024-03-21T06:13:23.000Z","st_blksize":4096,"st_blocks":448,"st_ctimespec":"2024-03-21T06:13:23.000Z","st_dev":16777231,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312287141,"st_mode":33261,"st_mtimespec":"2024-03-21T06:13:23.000Z","st_nlink":1,"st_rdev":0,"st_size":611840,"st_uid":0}},"group_id":28267,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":551,"rgid":0,"ruid":0,"uuid":"650F695A-E78B-547C-B6B9-34D752DB435F"},"ppid":1,"responsible_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":28267,"pidversion":47589294,"rgid":0,"ruid":0,"uuid":"CB0CAAE3-08B8-56CA-BDCA-BD5F44B17CE4"},"session_id":28267,"signing_id":"com.apple.backgroundtaskmanagementd","start_time":"2024-05-23T03:54:49.001Z"},"seq_num":1,"thread":{"thread_id":96231556,"uuid":"05973043-9E0A-5366-9E3D-B64947F5BF43"},"time":"2024-05-23T05:53:39.686Z","uuid":"BE5A2C6D-75D6-4ECA-BCFE-FB1B676DBE1E","version":7} {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"cs_invalidate":{}},"event_type":94,"glob_seq_num":13820,"host":{"hostname":"MacBookPro","ips":["192.168.1.27"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"5.4.0.1","provisioningUDID":"00006020-000C69E03633C01E","serial":"123ABC456DJ"},"mach_time":1753178733092,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100019,"auid":502,"egid":20,"euid":502,"pid":55767,"pidversion":128858,"rgid":20,"ruid":502,"uuid":"F06AF30C-2C9B-5227-9BCD-48078F09C78C"},"cdhash":"21012241103cd6658464ef81e04cb153d67f53e5","codesigning_flags":587334146,"executable":{"path":"/Users/jappleseed/Downloads/common/sleep","path_truncated":false,"sha1":"774ad8206f412d07161d174b6519d40ef601c02a","sha256":"d4791b942dbd4dd0eee0b31e46424fe673df586e2fdd166b6fe4f303a19767b4","stat":{"st_atimespec":"2024-04-19T15:33:31.392Z","st_birthtimespec":"2024-04-19T15:32:37.060Z","st_blksize":4096,"st_blocks":72,"st_ctimespec":"2024-04-19T15:32:37.060Z","st_dev":16777233,"st_flags":0,"st_gen":0,"st_gid":20,"st_ino":30081940,"st_mode":33261,"st_mtimespec":"2024-04-19T15:32:37.060Z","st_nlink":1,"st_rdev":0,"st_size":33432,"st_uid":502}},"group_id":55767,"is_es_client":false,"is_platform_binary":false,"original_ppid":55484,"parent_audit_token":{"asid":100019,"auid":502,"egid":20,"euid":502,"pid":55484,"pidversion":128242,"rgid":20,"ruid":502,"uuid":"732B7C17-3D83-52FC-B114-08FBE9FC43FA"},"ppid":55484,"responsible_audit_token":{"asid":100019,"auid":502,"egid":20,"euid":502,"pid":712,"pidversion":1695,"rgid":20,"ruid":502,"uuid":"32648F68-FC35-5EAA-A81F-5FEAAB9AA187"},"session_id":55483,"signing_id":"sleep","start_time":"2024-04-19T15:33:31.000Z","tty":{"path":"/dev/ttys003","path_truncated":false,"stat":{"st_atimespec":"2024-04-19T15:33:14.382Z","st_birthtimespec":"1970-01-01T00:00:00.000Z","st_blksize":65536,"st_blocks":0,"st_ctimespec":"2024-04-19T15:33:31.387Z","st_dev":-874482363,"st_flags":0,"st_gen":0,"st_gid":4,"st_ino":723,"st_mode":8592,"st_mtimespec":"2024-04-19T15:33:31.387Z","st_nlink":1,"st_rdev":268435459,"st_size":0,"st_uid":502}}},"seq_num":0,"time":"2024-04-19T15:34:28.834Z","uuid":"415148AF-9371-4C01-8D60-72DBEEEC71F2","version":7} {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"chroot":{"target":{"path":"/private/var/folders/2f/w7qslkks19ncxg48w_559zp80000gn/T","path_truncated":false,"stat":{"st_atimespec":"2024-05-03T13:41:50.517Z","st_birthtimespec":"2024-01-26T13:05:32.470Z","st_blksize":4096,"st_blocks":0,"st_ctimespec":"2024-05-06T06:40:35.185Z","st_dev":16777231,"st_flags":1048576,"st_gen":0,"st_gid":20,"st_ino":26462,"st_mode":16832,"st_mtimespec":"2024-05-06T06:40:35.185Z","st_nlink":4,"st_rdev":0,"st_size":128,"st_uid":501}}}},"event_type":57,"glob_seq_num":4183,"host":{"hostname":"MacBookPro","ips":["192.168.11.251","192.168.11.232","192.168.64.1"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"5.5.0.6","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":29994345187967,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":14802,"pidversion":47557822,"rgid":0,"ruid":0,"uuid":"257005DD-1A0C-5F6F-8563-D790DABEF5B7"},"cdhash":"2680cbf567b9aff559d740365e00603fe93bccdf","codesigning_flags":570522369,"executable":{"path":"/usr/libexec/dirhelper","path_truncated":false,"stat":{"st_atimespec":"2024-03-21T06:13:23.000Z","st_birthtimespec":"2024-03-21T06:13:23.000Z","st_blksize":4096,"st_blocks":72,"st_ctimespec":"2024-03-21T06:13:23.000Z","st_dev":16777231,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312527264,"st_mode":33261,"st_mtimespec":"2024-03-21T06:13:23.000Z","st_nlink":1,"st_rdev":0,"st_size":182288,"st_uid":0}},"group_id":14795,"is_es_client":false,"is_platform_binary":true,"original_ppid":14795,"parent_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":14795,"pidversion":47557809,"rgid":0,"ruid":0,"uuid":"5BA4345F-357E-550B-9236-0BE320B979A9"},"ppid":14795,"responsible_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":14795,"pidversion":47557809,"rgid":0,"ruid":0,"uuid":"5BA4345F-357E-550B-9236-0BE320B979A9"},"session_id":14795,"signing_id":"com.apple.dirhelper","start_time":"2024-05-23T01:35:28.000Z"},"seq_num":2,"thread":{"thread_id":95725389,"uuid":"4D26A299-1C49-5205-94DD-B3676DA161AF"},"time":"2024-05-23T01:35:29.599Z","uuid":"29204089-B6AB-44F9-97B2-A72C09A8B783","version":7} +{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"mount":{"statfs":{"f_bavail":3674,"f_bfree":3674,"f_blocks":14122,"f_bsize":4096,"f_ffree":146960,"f_files":147256,"f_flags":77633049,"f_flags_ext":0,"f_fsid":[16777248,26],"f_fssubtype":0,"f_fstypename":"apfs","f_iosize":1048576,"f_mntfromname":"/dev/disk9s1","f_mntonname":"/Volumes/JamfConnect","f_owner":502,"f_type":26}}},"event_type":22,"glob_seq_num":106336,"host":{"hostname":"MacBookPro-Sjaffy (2)","ips":["192.168.11.251","192.168.64.1","192.168.11.232"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.1.11","provisioningUDID":"00006030-001E301C0228001C","serial":"KJQMQP4XW0"},"is_telemetry":true,"mach_time":15726279369169,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100010,"auid":4294967295,"egid":20,"euid":502,"pid":26932,"pidversion":1379581,"rgid":20,"ruid":502,"uuid":"39AE3A81-23C1-5E15-9871-295A85E0FEA1"},"cdhash":"7804bd9c2e3b5e16cf9fcfba943564485fb6f20f","codesigning_flags":570522369,"executable":{"path":"/System/Library/Filesystems/apfs.fs/Contents/Resources/mount_apfs","path_truncated":false,"stat":{"st_atimespec":"2024-05-07T07:01:44.000Z","st_birthtimespec":"2024-05-07T07:01:44.000Z","st_blksize":4096,"st_blocks":64,"st_ctimespec":"2024-05-07T07:01:44.000Z","st_dev":16777231,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312156599,"st_mode":33261,"st_mtimespec":"2024-05-07T07:01:44.000Z","st_nlink":1,"st_rdev":0,"st_size":139824,"st_uid":0}},"group_id":1148,"is_es_client":false,"is_platform_binary":true,"original_ppid":26930,"parent_audit_token":{"asid":100010,"auid":4294967295,"egid":20,"euid":502,"pid":26930,"pidversion":1379579,"rgid":20,"ruid":502,"uuid":"F7ED3BE5-780C-5F1B-AD74-F5F01CB3DC39"},"ppid":26930,"responsible_audit_token":{"asid":100010,"auid":4294967295,"egid":0,"euid":0,"pid":1148,"pidversion":2434,"rgid":0,"ruid":0,"uuid":"6FC75B65-1B69-5020-A07F-7541488904C3"},"session_id":1148,"signing_id":"com.apple.mount_apfs","start_time":"2024-06-11T11:35:28.000Z","team_id":null,"tty":null},"seq_num":31,"thread":{"thread_id":15379585,"uuid":"83C515F9-CD46-5ECF-AEC2-FB6840024437"},"time":"2024-06-11T11:35:28.142Z","uuid":"0CAC3D00-385F-4F44-872A-B6035375C197","version":7} {"event":{"file_collection":{"contents":"Date/Time: 2024-04-17 18:19:13.962 -0500\nEnd time: 2024-04-17 18:21:05.619 -0500\n","file":{"path":"/Library/Logs/DiagnosticReports/spotlightknowledged_MacBook-Pro.cpu_resource.diag","size":28}}},"event_type":9002,"host":{"hostname":"MacBookPro","ips":["192.168.0.185"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.0.1","provisioningUDID":"00006000-001C58882238801E","serial":"123ABC456DE"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-05-28T05:45:58.729Z","uuid":"06CE8D4D-6848-4562-B947-2D607580283A"} {"event":{"bios_uefi":{"architecture":"arm64","bios":{"firmware-version":"iBoot-10151.101.3","system-firmware-version":"iBoot-10151.101.3"}}},"event_type":9004,"host":{"hostname":"MacBookPro","ips":["192.168.0.185"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"6.0.0.1","provisioningUDID":"00006000-001C58882238801E","serial":"LFQ5YXH377"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-05-22T16:49:22.294Z","uuid":"DDFDF887-D3F1-4F01-A8E1-0506BBCCD2BF"} {"event":{"system_performance":{"metrics":{"hw_model":"MacBookPro18,3","tasks":[{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":202.193,"cputime_ns":1013161791,"cputime_sample_ms_per_s":202.187,"cputime_userland_ratio":0.573927,"diskio_bytesread":380928,"diskio_bytesread_per_s":76020.3,"diskio_byteswritten":0,"diskio_byteswritten_per_s":0,"energy_impact":3140.59,"energy_impact_per_s":626.755,"idle_wakeups":0,"interval_ns":5010874875,"intr_wakeups_per_s":0.199566,"name":"SourceKitService","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":0,"pageins_per_s":0,"pid":36354,"qos_background_ms_per_s":0,"qos_background_ns":0,"qos_default_ms_per_s":202.086,"qos_default_ns":1012626541,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":0.105654,"qos_user_initiated_ns":529416,"qos_user_interactive_ms_per_s":0,"qos_user_interactive_ns":0,"qos_utility_ms_per_s":0,"qos_utility_ns":0,"started_abstime_ns":1968573181764,"timer_wakeups":[{"wakeups":1},{"wakeups":0}]},{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":138.511,"cputime_ns":694060541,"cputime_sample_ms_per_s":138.507,"cputime_userland_ratio":0.879748,"diskio_bytesread":151552,"diskio_bytesread_per_s":30244.6,"diskio_byteswritten":3981312,"diskio_byteswritten_per_s":794534,"energy_impact":1258.85,"energy_impact_per_s":251.224,"idle_wakeups":2,"interval_ns":5010874875,"intr_wakeups_per_s":58.872,"name":"Xcode","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":3,"pageins_per_s":0.598698,"pid":36337,"qos_background_ms_per_s":0.0153998,"qos_background_ns":77166,"qos_default_ms_per_s":11.2632,"qos_default_ns":56438500,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":11.1361,"qos_user_initiated_ns":55801625,"qos_user_interactive_ms_per_s":114.393,"qos_user_interactive_ns":573208208,"qos_utility_ms_per_s":1.7033,"qos_utility_ns":8535041,"started_abstime_ns":1968419476399,"timer_wakeups":[{"wakeups":2},{"wakeups":174}]},{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":83.7332,"cputime_ns":419576500,"cputime_sample_ms_per_s":83.7307,"cputime_userland_ratio":0.981833,"diskio_bytesread":57344,"diskio_bytesread_per_s":11443.9,"diskio_byteswritten":0,"diskio_byteswritten_per_s":0,"energy_impact":1198.09,"energy_impact_per_s":239.099,"idle_wakeups":0,"interval_ns":5010874875,"intr_wakeups_per_s":0.199566,"name":"JamfProtect","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":0,"pageins_per_s":0,"pid":58824,"qos_background_ms_per_s":0,"qos_background_ns":0,"qos_default_ms_per_s":82.6678,"qos_default_ns":414237833,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":1.06542,"qos_user_initiated_ns":5338666,"qos_user_interactive_ms_per_s":0,"qos_user_interactive_ns":0,"qos_utility_ms_per_s":0,"qos_utility_ns":0,"started_abstime_ns":2357421081500,"timer_wakeups":[{"wakeups":0},{"wakeups":0}]}]},"page_info":{"page":1,"total":4}}},"event_type":9001,"host":{"hostname":"MacBookPro","ips":["192.168.100.102"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.1.1","provisioningUDID":"00006000-001C58882238801E","serial":"123ABC456DE"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-06-04T09:41:38.708Z","uuid":"710782C4-489E-4003-945C-316F65C50379"} diff --git a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json index 4c1bbdf5bbb..10f7fe9a0e4 100644 --- a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json +++ b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json @@ -3481,6 +3481,132 @@ } } }, + { + "device": { + "id": "KJQMQP4XW0", + "manufacturer": "Apple", + "serial_number": "KJQMQP4XW0" + }, + "ecs": { + "version": "8.17.0" + }, + "event": { + "action": "mount", + "category": [ + "process" + ], + "code": "22", + "id": "0CAC3D00-385F-4F44-872A-B6035375C197", + "kind": "event", + "provider": "Jamf Protect", + "reason": "A file system has been mounted", + "sequence": 106336, + "start": "2024-06-11T11:35:28.142Z", + "type": [ + "info", + "start" + ] + }, + "host": { + "hostname": "MacBookPro-Sjaffy (2)", + "id": "00006030-001E301C0228001C", + "ip": [ + "192.168.11.251", + "192.168.64.1", + "192.168.11.232" + ], + "name": "macbookpro-sjaffy (2)", + "os": { + "family": "macos", + "full": "14.5 (Build 23F79)", + "name": "macOS", + "type": "macos", + "version": "14.5" + } + }, + "jamf_protect": { + "telemetry": { + "event_allowed_by_esclient": true + } + }, + "observer": { + "product": "Jamf Protect", + "type": "Endpoint Security", + "vendor": "Jamf", + "version": "6.0.1.11" + }, + "process": { + "code_signature": { + "flags": 570522369, + "signing_id": "com.apple.mount_apfs" + }, + "endpoint_security_client": false, + "entity_id": "39AE3A81-23C1-5E15-9871-295A85E0FEA1", + "executable": "/System/Library/Filesystems/apfs.fs/Contents/Resources/mount_apfs", + "hash": { + "cdhash": "7804bd9c2e3b5e16cf9fcfba943564485fb6f20f" + }, + "interactive": false, + "name": "mount_apfs", + "parent": { + "entity_id": "F7ED3BE5-780C-5F1B-AD74-F5F01CB3DC39", + "pid": 26930, + "real_group": { + "id": "20" + }, + "real_user": { + "id": "502" + }, + "user": { + "id": "502" + } + }, + "pid": 26932, + "platform_binary": true, + "responsible": { + "entity_id": "6FC75B65-1B69-5020-A07F-7541488904C3", + "pid": 1148, + "real_group": { + "id": "0" + }, + "real_user": { + "id": "0" + }, + "user": { + "id": "0" + } + }, + "start": "2024-06-11T11:35:28.000Z", + "thread": { + "id": 15379585 + } + }, + "related": { + "hash": [ + "7804bd9c2e3b5e16cf9fcfba943564485fb6f20f" + ], + "hosts": [ + "MacBookPro-Sjaffy (2)" + ], + "ip": [ + "192.168.11.251", + "192.168.64.1", + "192.168.11.232" + ] + }, + "user": { + "effective": { + "id": [ + "502" + ] + } + }, + "volume": { + "device_name": "/dev/disk9s1", + "file_system_type": "apfs", + "mount_name": "/Volumes/JamfConnect" + } + }, { "device": { "id": "123ABC456DE", diff --git a/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml b/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml index 89d1fd83abc..69a9b569beb 100644 --- a/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml +++ b/packages/jamf_protect/data_stream/telemetry/fields/ecs.yml @@ -29,7 +29,7 @@ - name: device.serial_number type: keyword - name: process.code_signature.flags - type: long + type: keyword - name: process.endpoint_security_client type: boolean - name: process.hash.cdhash diff --git a/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json b/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json index 542b933527e..d0321a855cb 100644 --- a/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json +++ b/packages/jamf_protect/data_stream/telemetry_legacy/sample_event.json @@ -1,22 +1,22 @@ { "@timestamp": "2024-02-06T16:01:34.442Z", "agent": { - "ephemeral_id": "981a5b24-08c9-416a-ba7e-15f7831193d7", - "id": "f8c7b758-0275-485c-b940-5c6d53afadde", - "name": "elastic-agent-94327", + "ephemeral_id": "eece836d-c076-4153-944e-3e5ec9db8236", + "id": "91e71d1a-748f-44cb-ab86-34bf2c96f57e", + "name": "elastic-agent-72060", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.telemetry_legacy", - "namespace": "27225", + "namespace": "28723", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "f8c7b758-0275-485c-b940-5c6d53afadde", + "id": "91e71d1a-748f-44cb-ab86-34bf2c96f57e", "snapshot": false, "version": "8.18.3" }, @@ -31,7 +31,7 @@ ], "code": "43190", "dataset": "jamf_protect.telemetry_legacy", - "ingested": "2025-07-30T13:27:09Z", + "ingested": "2025-07-31T05:50:49Z", "kind": "event", "outcome": "success", "type": [ diff --git a/packages/jamf_protect/data_stream/web_threat_events/sample_event.json b/packages/jamf_protect/data_stream/web_threat_events/sample_event.json index c35d809906d..64b1d707d08 100644 --- a/packages/jamf_protect/data_stream/web_threat_events/sample_event.json +++ b/packages/jamf_protect/data_stream/web_threat_events/sample_event.json @@ -1,15 +1,15 @@ { - "@timestamp": "2025-07-30T13:28:21.865Z", + "@timestamp": "2025-07-31T05:51:48.487Z", "agent": { - "ephemeral_id": "5417b069-c0ad-49fe-81a4-b92544f8dee8", - "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", - "name": "elastic-agent-25987", + "ephemeral_id": "8f1469da-2f5f-4a30-b5e1-808bbb78998a", + "id": "905f7c20-1101-4cbb-9dcd-dbb7cc469ecd", + "name": "elastic-agent-17924", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_threat_events", - "namespace": "65249", + "namespace": "14286", "type": "logs" }, "destination": { @@ -21,7 +21,7 @@ "version": "8.17.0" }, "elastic_agent": { - "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", + "id": "905f7c20-1101-4cbb-9dcd-dbb7cc469ecd", "snapshot": false, "version": "8.18.3" }, @@ -33,7 +33,7 @@ ], "dataset": "jamf_protect.web_threat_events", "id": "013b15c9-8f62-4bf1-948a-d82367af2a10", - "ingested": "2025-07-30T13:28:22Z", + "ingested": "2025-07-31T05:51:49Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Sideloaded App", diff --git a/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json b/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json index c9142bf67a1..47c70717395 100644 --- a/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json +++ b/packages/jamf_protect/data_stream/web_traffic_events/sample_event.json @@ -1,15 +1,15 @@ { - "@timestamp": "2025-07-30T13:29:21.886Z", + "@timestamp": "2025-07-31T05:52:58.688Z", "agent": { - "ephemeral_id": "72b9d59b-b2cc-441f-a864-5d8cbb76f828", - "id": "e39bab3e-da35-453a-ba89-e24b1d047749", - "name": "elastic-agent-78988", + "ephemeral_id": "1c40876d-259c-45a1-a832-6b34a2f1afeb", + "id": "2410af22-f2c1-4d7b-9d5a-28d217307a21", + "name": "elastic-agent-80230", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_traffic_events", - "namespace": "68911", + "namespace": "37615", "type": "logs" }, "dns": { @@ -28,7 +28,7 @@ "version": "8.17.0" }, "elastic_agent": { - "id": "e39bab3e-da35-453a-ba89-e24b1d047749", + "id": "2410af22-f2c1-4d7b-9d5a-28d217307a21", "snapshot": false, "version": "8.18.3" }, @@ -40,7 +40,7 @@ "network" ], "dataset": "jamf_protect.web_traffic_events", - "ingested": "2025-07-30T13:29:22Z", + "ingested": "2025-07-31T05:52:59Z", "kind": "event", "outcome": [ "success" diff --git a/packages/jamf_protect/docs/README.md b/packages/jamf_protect/docs/README.md index 6e94dcc7b4f..6a0cd21f4fe 100644 --- a/packages/jamf_protect/docs/README.md +++ b/packages/jamf_protect/docs/README.md @@ -112,24 +112,24 @@ An example event for `alerts` looks as following: ```json { - "@timestamp": "2025-07-30T13:24:50.442Z", + "@timestamp": "2025-07-31T05:48:48.881Z", "agent": { - "ephemeral_id": "543d6574-b616-440a-9e2f-5d999a7392fd", - "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", - "name": "elastic-agent-66883", + "ephemeral_id": "c84f4740-e168-48f3-9128-b2038e00262c", + "id": "503e4258-ae05-4e72-858f-5a69d0889a13", + "name": "elastic-agent-51923", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.alerts", - "namespace": "61044", + "namespace": "44087", "type": "logs" }, "ecs": { "version": "8.17.0" }, "elastic_agent": { - "id": "e598b23e-3ba9-44fc-a761-7e3a0886ab3a", + "id": "503e4258-ae05-4e72-858f-5a69d0889a13", "snapshot": false, "version": "8.18.3" }, @@ -142,7 +142,7 @@ An example event for `alerts` looks as following: ], "dataset": "jamf_protect.alerts", "id": "6bdb0697-6d07-47bc-a37d-6c3348a5d953", - "ingested": "2025-07-30T13:24:51Z", + "ingested": "2025-07-31T05:48:49Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Application that uses custom url handler created", @@ -593,7 +593,7 @@ An example event for `telemetry` looks as following: | jamf_protect.telemetry.to_username | Username to which an action is directed | keyword | | jamf_protect.telemetry.tty | Software terminal device file that the process is associated with | keyword | | log.offset | Log offset | long | -| process.code_signature.flags | | long | +| process.code_signature.flags | | keyword | | process.code_signature.signing_id | | keyword | | process.endpoint_security_client | | boolean | | process.hash.cdhash | | keyword | @@ -633,17 +633,17 @@ An example event for `web_threat_events` looks as following: ```json { - "@timestamp": "2025-07-30T13:28:21.865Z", + "@timestamp": "2025-07-31T05:51:48.487Z", "agent": { - "ephemeral_id": "5417b069-c0ad-49fe-81a4-b92544f8dee8", - "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", - "name": "elastic-agent-25987", + "ephemeral_id": "8f1469da-2f5f-4a30-b5e1-808bbb78998a", + "id": "905f7c20-1101-4cbb-9dcd-dbb7cc469ecd", + "name": "elastic-agent-17924", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_threat_events", - "namespace": "65249", + "namespace": "14286", "type": "logs" }, "destination": { @@ -655,7 +655,7 @@ An example event for `web_threat_events` looks as following: "version": "8.17.0" }, "elastic_agent": { - "id": "6b3bb09d-3f4a-4474-9c95-93ad4fe06d08", + "id": "905f7c20-1101-4cbb-9dcd-dbb7cc469ecd", "snapshot": false, "version": "8.18.3" }, @@ -667,7 +667,7 @@ An example event for `web_threat_events` looks as following: ], "dataset": "jamf_protect.web_threat_events", "id": "013b15c9-8f62-4bf1-948a-d82367af2a10", - "ingested": "2025-07-30T13:28:22Z", + "ingested": "2025-07-31T05:51:49Z", "kind": "alert", "provider": "Jamf Protect", "reason": "Sideloaded App", @@ -760,17 +760,17 @@ An example event for `web_traffic_events` looks as following: ```json { - "@timestamp": "2025-07-30T13:29:21.886Z", + "@timestamp": "2025-07-31T05:52:58.688Z", "agent": { - "ephemeral_id": "72b9d59b-b2cc-441f-a864-5d8cbb76f828", - "id": "e39bab3e-da35-453a-ba89-e24b1d047749", - "name": "elastic-agent-78988", + "ephemeral_id": "1c40876d-259c-45a1-a832-6b34a2f1afeb", + "id": "2410af22-f2c1-4d7b-9d5a-28d217307a21", + "name": "elastic-agent-80230", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.web_traffic_events", - "namespace": "68911", + "namespace": "37615", "type": "logs" }, "dns": { @@ -789,7 +789,7 @@ An example event for `web_traffic_events` looks as following: "version": "8.17.0" }, "elastic_agent": { - "id": "e39bab3e-da35-453a-ba89-e24b1d047749", + "id": "2410af22-f2c1-4d7b-9d5a-28d217307a21", "snapshot": false, "version": "8.18.3" }, @@ -801,7 +801,7 @@ An example event for `web_traffic_events` looks as following: "network" ], "dataset": "jamf_protect.web_traffic_events", - "ingested": "2025-07-30T13:29:22Z", + "ingested": "2025-07-31T05:52:59Z", "kind": "event", "outcome": [ "success" From abf50016f08f0c058252fe47b59244c8e6a67b85 Mon Sep 17 00:00:00 2001 From: Thijs Xhaflaire Date: Thu, 31 Jul 2025 08:25:49 +0200 Subject: [PATCH 09/11] resolving ecs mapping for process signing flags --- ...ct-telemetry-sample-logs.log-expected.json | 66 +++++++++---------- .../elasticsearch/ingest_pipeline/default.yml | 13 +++- .../data_stream/telemetry/sample_event.json | 16 ++--- packages/jamf_protect/docs/README.md | 16 ++--- 4 files changed, 61 insertions(+), 50 deletions(-) diff --git a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json index 10f7fe9a0e4..29327169873 100644 --- a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json +++ b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log-expected.json @@ -56,7 +56,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.loginwindow" }, "endpoint_security_client": false, @@ -176,7 +176,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.loginwindow" }, "endpoint_security_client": false, @@ -299,7 +299,7 @@ }, "process": { "code_signature": { - "flags": 570506001, + "flags": "570506001", "signing_id": "com.apple.pwpolicy" }, "endpoint_security_client": false, @@ -417,7 +417,7 @@ }, "process": { "code_signature": { - "flags": 570522385, + "flags": "570522385", "signing_id": "com.apple.sudo" }, "command_line": "/usr/local/bin/protectctl", @@ -547,7 +547,7 @@ ], "args_count": 3, "code_signature": { - "flags": 570493697, + "flags": "570493697", "signing_id": "com.apple.zsh" }, "endpoint_security_client": false, @@ -689,7 +689,7 @@ }, "process": { "code_signature": { - "flags": 570506001, + "flags": "570506001", "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -818,7 +818,7 @@ }, "process": { "code_signature": { - "flags": 570506001, + "flags": "570506001", "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -943,7 +943,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.Users-Groups-Settings.extension" }, "endpoint_security_client": false, @@ -1063,7 +1063,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.Users-Groups-Settings.extension" }, "endpoint_security_client": false, @@ -1188,7 +1188,7 @@ }, "process": { "code_signature": { - "flags": 570506001, + "flags": "570506001", "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -1313,7 +1313,7 @@ }, "process": { "code_signature": { - "flags": 570506001, + "flags": "570506001", "signing_id": "com.apple.dscl" }, "endpoint_security_client": false, @@ -1556,7 +1556,7 @@ }, "process": { "code_signature": { - "flags": 570522385, + "flags": "570522385", "signing_id": "com.apple.coreauthd" }, "endpoint_security_client": false, @@ -1675,7 +1675,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.loginwindow" }, "endpoint_security_client": false, @@ -1798,7 +1798,7 @@ }, "process": { "code_signature": { - "flags": 570522385, + "flags": "570522385", "signing_id": "com.apple.sshd" }, "endpoint_security_client": false, @@ -1921,7 +1921,7 @@ }, "process": { "code_signature": { - "flags": 570522385, + "flags": "570522385", "signing_id": "com.apple.login" }, "endpoint_security_client": false, @@ -2044,7 +2044,7 @@ }, "process": { "code_signature": { - "flags": 570522385, + "flags": "570522385", "signing_id": "com.apple.login" }, "endpoint_security_client": false, @@ -2165,7 +2165,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.XProtectFramework.plugins.KeySteal" }, "endpoint_security_client": false, @@ -2298,7 +2298,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.XprotectFramework.AnalysisService" }, "endpoint_security_client": false, @@ -2443,7 +2443,7 @@ ], "args_count": 1, "code_signature": { - "flags": 570522385, + "flags": "570522385", "signing_id": "com.apple.su" }, "endpoint_security_client": false, @@ -2609,7 +2609,7 @@ }, "process": { "code_signature": { - "flags": 570522385, + "flags": "570522385", "signing_id": "com.apple.screensharing.daemon" }, "endpoint_security_client": false, @@ -2731,7 +2731,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.kernelmanagerd" }, "endpoint_security_client": false, @@ -2860,7 +2860,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.mdmclient" }, "endpoint_security_client": false, @@ -2978,7 +2978,7 @@ }, "process": { "code_signature": { - "flags": 570506001, + "flags": "570506001", "signing_id": "com.apple.sntp" }, "endpoint_security_client": false, @@ -3105,7 +3105,7 @@ }, "process": { "code_signature": { - "flags": 570503953, + "flags": "570503953", "signing_id": "com.txhaflaire.JamfCheck", "team_id": "CLQKFNPCCP" }, @@ -3233,7 +3233,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.backgroundtaskmanagementd" }, "endpoint_security_client": false, @@ -3416,7 +3416,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.dirhelper" }, "endpoint_security_client": false, @@ -3537,7 +3537,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.mount_apfs" }, "endpoint_security_client": false, @@ -4010,7 +4010,7 @@ }, "process": { "code_signature": { - "flags": 570522369, + "flags": "570522369", "signing_id": "com.apple.syspolicyd" }, "endpoint_security_client": false, @@ -4145,7 +4145,7 @@ }, "process": { "code_signature": { - "flags": 637623057, + "flags": "637623057", "signing_id": "com.apple.ProblemReporter" }, "endpoint_security_client": false, @@ -4275,7 +4275,7 @@ }, "process": { "code_signature": { - "flags": 637631233, + "flags": "637631233", "signing_id": "com.apple.Terminal" }, "endpoint_security_client": false, @@ -4396,7 +4396,7 @@ }, "process": { "code_signature": { - "flags": 570556931, + "flags": "570556931", "signing_id": "a.out" }, "endpoint_security_client": false, @@ -4529,7 +4529,7 @@ }, "process": { "code_signature": { - "flags": 637631233, + "flags": "637631233", "signing_id": "com.apple.settings.PrivacySecurity.extension" }, "endpoint_security_client": false, @@ -4652,7 +4652,7 @@ }, "process": { "code_signature": { - "flags": 637623057, + "flags": "637623057", "signing_id": "com.apple.mount_hfs" }, "endpoint_security_client": false, diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml index a9b950ce7cd..45408902a42 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml @@ -327,7 +327,18 @@ processors: - pipeline: name: '{{ IngestPipeline "pipeline_event_pty_close" }}' if: ctx.event.action == "pty_close" - + - convert: + field: process.code_signature.flags + type: string + ignore_missing: true + - convert: + field: process.parent.code_signature.flags + type: string + ignore_missing: true + - convert: + field: process.responsible.code_signature.flags + type: string + ignore_missing: true ############# ## Cleanup ## ############# diff --git a/packages/jamf_protect/data_stream/telemetry/sample_event.json b/packages/jamf_protect/data_stream/telemetry/sample_event.json index 9678ba0fa3e..ef24b6b9a9a 100644 --- a/packages/jamf_protect/data_stream/telemetry/sample_event.json +++ b/packages/jamf_protect/data_stream/telemetry/sample_event.json @@ -1,15 +1,15 @@ { - "@timestamp": "2025-07-30T13:26:04.600Z", + "@timestamp": "2025-07-31T06:23:53.803Z", "agent": { - "ephemeral_id": "f1993c3e-8c6c-4e33-8f97-27aa2fe8da8b", - "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", - "name": "elastic-agent-18319", + "ephemeral_id": "1eae9172-02c5-42d5-b79d-6dc5e9687787", + "id": "1ee07800-44a8-429d-a7c9-d1c938fe544c", + "name": "elastic-agent-77701", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.telemetry", - "namespace": "68977", + "namespace": "14190", "type": "logs" }, "device": { @@ -21,7 +21,7 @@ "version": "8.17.0" }, "elastic_agent": { - "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", + "id": "1ee07800-44a8-429d-a7c9-d1c938fe544c", "snapshot": false, "version": "8.18.3" }, @@ -34,7 +34,7 @@ "code": "9", "dataset": "jamf_protect.telemetry", "id": "CDB31202-8CB4-4C72-A9C6-7F494CD5F598", - "ingested": "2025-07-30T13:26:05Z", + "ingested": "2025-07-31T06:23:54Z", "kind": "event", "provider": "Jamf Protect", "reason": "A new process has been executed", @@ -84,7 +84,7 @@ ], "args_count": 3, "code_signature": { - "flags": 570493697, + "flags": "570493697", "signing_id": "com.apple.zsh" }, "endpoint_security_client": false, diff --git a/packages/jamf_protect/docs/README.md b/packages/jamf_protect/docs/README.md index 6a0cd21f4fe..b339d91766c 100644 --- a/packages/jamf_protect/docs/README.md +++ b/packages/jamf_protect/docs/README.md @@ -304,17 +304,17 @@ An example event for `telemetry` looks as following: ```json { - "@timestamp": "2025-07-30T13:26:04.600Z", + "@timestamp": "2025-07-31T06:23:53.803Z", "agent": { - "ephemeral_id": "f1993c3e-8c6c-4e33-8f97-27aa2fe8da8b", - "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", - "name": "elastic-agent-18319", + "ephemeral_id": "1eae9172-02c5-42d5-b79d-6dc5e9687787", + "id": "1ee07800-44a8-429d-a7c9-d1c938fe544c", + "name": "elastic-agent-77701", "type": "filebeat", "version": "8.18.3" }, "data_stream": { "dataset": "jamf_protect.telemetry", - "namespace": "68977", + "namespace": "14190", "type": "logs" }, "device": { @@ -326,7 +326,7 @@ An example event for `telemetry` looks as following: "version": "8.17.0" }, "elastic_agent": { - "id": "aec49bb1-5892-4ad1-896c-33feb1de1b50", + "id": "1ee07800-44a8-429d-a7c9-d1c938fe544c", "snapshot": false, "version": "8.18.3" }, @@ -339,7 +339,7 @@ An example event for `telemetry` looks as following: "code": "9", "dataset": "jamf_protect.telemetry", "id": "CDB31202-8CB4-4C72-A9C6-7F494CD5F598", - "ingested": "2025-07-30T13:26:05Z", + "ingested": "2025-07-31T06:23:54Z", "kind": "event", "provider": "Jamf Protect", "reason": "A new process has been executed", @@ -389,7 +389,7 @@ An example event for `telemetry` looks as following: ], "args_count": 3, "code_signature": { - "flags": 570493697, + "flags": "570493697", "signing_id": "com.apple.zsh" }, "endpoint_security_client": false, From eeb3c4a1ef92ddbd0c2ec0e41ee96343ccc86a91 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Thu, 31 Jul 2025 16:34:11 +0930 Subject: [PATCH 10/11] fix indentation --- .../elasticsearch/ingest_pipeline/default.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml index 45408902a42..d55bcc9215a 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/default.yml @@ -328,17 +328,17 @@ processors: name: '{{ IngestPipeline "pipeline_event_pty_close" }}' if: ctx.event.action == "pty_close" - convert: - field: process.code_signature.flags - type: string - ignore_missing: true + field: process.code_signature.flags + type: string + ignore_missing: true - convert: - field: process.parent.code_signature.flags - type: string - ignore_missing: true + field: process.parent.code_signature.flags + type: string + ignore_missing: true - convert: - field: process.responsible.code_signature.flags - type: string - ignore_missing: true + field: process.responsible.code_signature.flags + type: string + ignore_missing: true ############# ## Cleanup ## ############# From a46353dde9395cbdb5efcb2386996d26590d6275 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Thu, 31 Jul 2025 16:39:48 +0930 Subject: [PATCH 11/11] fix trailing whitespace --- .../test/pipeline/test-jamf-protect-telemetry-sample-logs.log | 2 +- .../ingest_pipeline/pipeline_event_network_connect.yml | 2 +- .../elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml | 2 +- .../elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log index 3c8f3a1ab0e..f8efd2d81b4 100644 --- a/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log +++ b/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline/test-jamf-protect-telemetry-sample-logs.log @@ -35,4 +35,4 @@ {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"pty_grant":{"dev":251658253}},"event_type":83,"global_seq_num":14369,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"mach_time":36711229234880,"process":{"audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":54143,"pidversion":2585097,"rgid":20,"ruid":502,"uuid":"785AAD3C-C87D-5498-90D5-D2A9F0C385D1"},"cdhash":"2021c15444de9c59374b33d9235d392859a1c6ff","codesigning_flags":637631233,"executable":{"path":"\/System\/Applications\/Utilities\/Terminal.app\/Contents\/MacOS\/Terminal","path_truncated":false,"sha1":"572272ffc9997da2d1d3ce727ada066d2947db36","sha256":"f2e2965986674f21934513c353de4669bf9332391d097a056c3f981c5557c1aa","stat":{"st_atimespec":"2025-05-04T05:39:22.000Z","st_birthtimespec":"2025-05-04T05:39:22.000Z","st_blksize":4096,"st_blocks":1872,"st_ctimespec":"2025-05-04T05:39:22.000Z","st_dev":16777230,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500311911766,"st_mode":33261,"st_mtimespec":"2025-05-04T05:39:22.000Z","st_nlink":1,"st_rdev":0,"st_size":2207824,"st_uid":0}},"group_id":54143,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100015,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":564,"rgid":0,"ruid":0,"uuid":"B23766A5-BA72-5526-9604-D743646381A6"},"ppid":1,"responsible_audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":54143,"pidversion":2585097,"rgid":20,"ruid":502,"uuid":"785AAD3C-C87D-5498-90D5-D2A9F0C385D1"},"session_id":1,"signing_id":"com.apple.Terminal","start_time":"2025-07-23T16:24:28.001Z","team_id":null,"tty":null},"seq_num":2,"thread":{"thread_id":59491663,"uuid":"ED098736-8793-5939-ACA5-613214C3952D"},"time":"2025-07-30T10:23:47.469Z","uuid":"5CCEB621-7191-44F6-8500-CB3F5B01B959","version":8} {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"pty_close":{"dev":251658259}},"event_type":84,"global_seq_num":2444,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":36738899244634,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":89970,"pidversion":3418373,"rgid":20,"ruid":502,"signing_id":"a.out","uuid":"F09D3275-F7D6-5F3B-9448-29814244081B"},"cdhash":"c9f4b9ee8039ba1c3854dbb2e4576cf675c2753a","codesigning_flags":570556931,"executable":{"path":"\/usr\/local\/bin\/elastic-package","path_truncated":false,"sha1":"fa70141612f0ba15b00f2a2b27e32a24d9162f33","sha256":"2395da9f5fbd34f78277b58e7ed8766e3f22bc14fa4b2feccb2406a2695e4075","stat":{"st_atimespec":"2025-07-30T10:42:58.971Z","st_birthtimespec":"2025-07-22T13:35:06.000Z","st_blksize":4096,"st_blocks":207864,"st_ctimespec":"2025-07-30T10:42:20.492Z","st_dev":16777230,"st_flags":0,"st_gen":0,"st_gid":0,"st_ino":156989410,"st_mode":33261,"st_mtimespec":"2025-07-22T13:35:06.000Z","st_nlink":1,"st_rdev":0,"st_size":106422642,"st_uid":502}},"group_id":89970,"is_es_client":false,"is_platform_binary":false,"original_ppid":89401,"parent_audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":89401,"pidversion":3417437,"rgid":20,"ruid":502,"signing_id":"com.apple.zsh","uuid":"92C4549D-E485-51A7-8CDA-86C61D04C7D7"},"ppid":89401,"responsible_audit_token":{"asid":100017,"auid":502,"egid":20,"euid":502,"pid":48761,"pidversion":2575070,"rgid":20,"ruid":502,"signing_id":"dev.warp.Warp-Stable","uuid":"DA46B7E3-F0D3-5E1F-A329-F240D0C29267"},"session_id":89401,"signing_id":"a.out","start_time":"2025-07-30T10:42:57.000Z","team_id":null,"tty":{"path":"\/dev\/ttys018","path_truncated":false,"stat":{"st_atimespec":"2025-07-30T10:42:57.196Z","st_birthtimespec":"1970-01-01T00:00:00.000Z","st_blksize":65536,"st_blocks":0,"st_ctimespec":"2025-07-30T10:42:59.265Z","st_dev":-58166916,"st_flags":0,"st_gen":0,"st_gid":4,"st_ino":2479,"st_mode":8592,"st_mtimespec":"2025-07-30T10:42:59.265Z","st_nlink":1,"st_rdev":268435474,"st_size":0,"st_uid":502}}},"seq_num":0,"thread":{"thread_id":76667536,"uuid":"F954E93B-DF31-590B-A1A3-0C3E8EA27A6A"},"time":"2025-07-30T10:43:00.398Z","uuid":"EE7212E7-D7BA-4100-A568-DF9B71435098","version":8} {"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"tcc_modify":{"identity":"com.redcanary.agent.securityextension","identity_type":0,"instigator":{"audit_token":{"asid":100016,"auid":502,"egid":20,"euid":502,"pid":96352,"pidversion":1240892,"rgid":20,"ruid":502,"signing_id":"com.apple.settings.PrivacySecurity.extension","uuid":"EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45"},"cdhash":"9f8d7e11bfd45a352a49b54f556dd315d00f4c07","codesigning_flags":637631233,"executable":{"path":"/System/Library/ExtensionKit/Extensions/SecurityPrivacyExtension.appex/Contents/MacOS/SecurityPrivacyExtension","path_truncated":false,"sha1":"6ea0b92fb18de82b3d4b2f0672ed7587440c12c5","sha256":"2d1f05bd6559d6baf48d59fbf2f99cca9e43094eb9d65d8e2d00fbd6ed2fca8e","stat":{"st_atimespec":"2025-07-20T07:19:46.000Z","st_birthtimespec":"2025-07-20T07:19:46.000Z","st_blksize":4096,"st_blocks":3176,"st_ctimespec":"2025-07-20T07:19:46.000Z","st_dev":16777229,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312115791,"st_mode":33261,"st_mtimespec":"2025-07-20T07:19:46.000Z","st_nlink":1,"st_rdev":0,"st_size":3618896,"st_uid":0}},"group_id":96352,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":1111,"rgid":0,"ruid":0,"uuid":"BB988465-F537-5679-896E-490BB9F5E4C1"},"ppid":1,"responsible_audit_token":{"asid":100016,"auid":502,"egid":20,"euid":502,"pid":96352,"pidversion":1240892,"rgid":20,"ruid":502,"signing_id":"com.apple.settings.PrivacySecurity.extension","uuid":"EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45"},"session_id":96352,"signing_id":"com.apple.settings.PrivacySecurity.extension","start_time":"2025-07-30T12:33:43.001Z","team_id":null,"tty":null},"instigator_token":{"asid":100016,"auid":502,"egid":20,"euid":502,"pid":96352,"pidversion":1240892,"rgid":20,"ruid":502,"signing_id":"com.apple.settings.PrivacySecurity.extension","uuid":"EF758DB3-9CBE-54E7-AEE4-A7E4DFC3AF45"},"reason":3,"right":0,"service":"SystemPolicyAllFiles","update_type":2}},"event_type":147,"global_seq_num":613647,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":14415254265270,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":648,"pidversion":1444,"rgid":0,"ruid":0,"signing_id":"com.apple.tccd","uuid":"B70AB577-DEE7-59A7-9E46-FCA1971A385E"},"cdhash":"910f0978369dbbeb6aa6dcb51b047323c0d06275","codesigning_flags":637631233,"executable":{"path":"/System/Library/PrivateFrameworks/TCC.framework/Support/tccd","path_truncated":false,"sha1":"61d9445e5d59102e4f12a81999bd0e4a15bfc75f","sha256":"6f5a31d8d2e74b08ab644a2615d155d4032f7454115691d82b73caf1849ccec5","stat":{"st_atimespec":"2025-07-20T07:19:46.000Z","st_birthtimespec":"2025-07-20T07:19:46.000Z","st_blksize":4096,"st_blocks":1320,"st_ctimespec":"2025-07-20T07:19:46.000Z","st_dev":16777229,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312451094,"st_mode":33261,"st_mtimespec":"2025-07-20T07:19:46.000Z","st_nlink":1,"st_rdev":0,"st_size":1625088,"st_uid":0}},"group_id":648,"is_es_client":false,"is_platform_binary":true,"original_ppid":1,"parent_audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":1,"pidversion":1111,"rgid":0,"ruid":0,"uuid":"BB988465-F537-5679-896E-490BB9F5E4C1"},"ppid":1,"responsible_audit_token":{"asid":100014,"auid":4294967295,"egid":0,"euid":0,"pid":648,"pidversion":1444,"rgid":0,"ruid":0,"signing_id":"com.apple.tccd","uuid":"B70AB577-DEE7-59A7-9E46-FCA1971A385E"},"session_id":648,"signing_id":"com.apple.tccd","start_time":"2025-07-22T19:12:25.000Z","team_id":null,"tty":null},"seq_num":1,"thread":{"thread_id":26037400,"uuid":"1E85E074-2E23-5E96-9682-CE9369C063BE"},"time":"2025-07-30T12:34:35.848Z","uuid":"4976F7D5-136A-4DE5-A52D-AE34CBB93E76","version":10} -{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"mount":{"device":{"block_size":512,"bsd_major":1,"bsd_minor":21,"bsd_name":"disk4s1","bsd_unit":4,"bus_name":"usb-drd0-port-ss","bus_path":"IODeviceTree:/arm-io@10F00000/usb-drd0@82280000/usb-drd0-port-ss@00200000","content":"48465300-0000-11AA-AA11-00306543ECAC","device_class":0,"device_model":"Extreme 55AE","device_path":"IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-ss@00200000/Extreme 55AE@00200000/IOUSBHostInterface@0/IOUSBMassStorageInterfaceNub/IOUSBMassStorageDriverNub/IOUSBMassStorageUASDriver/IOSCSITargetDevice/IOSCSIHierarchicalLogicalUnit@0000000000000000/IOSCSIPeripheralDeviceType00/IOBlockStorageServices","device_sub_class":0,"encryption_detail":0,"is_ejectable":0,"is_encrypted":0,"is_internal":0,"is_leaf":1,"is_mountable":1,"is_network_volume":0,"is_removable":0,"is_whole":0,"is_writable":1,"media_kind":"IOMedia","media_name":"Extreme SSD","media_path":"IODeviceTree:/arm-io@10F00000/usb-drd0@82280000/usb-drd0-port-ss@00200000/@1:1","product_id":"0x55ae","product_name":"Extreme 55AE","protocol":"USB","revision":"3000","serial_number":"323132383639343032303633","size":1000035009024,"unit":1,"vendor_id":"0x0781","vendor_name":"SanDisk","volume_kind":"hfs","volume_name":"Extreme SSD","volume_type":"Mac OS Extended (Journaled)"},"disposition":1,"statfs":{"f_bavail":179988282,"f_bfree":179988282,"f_blocks":244149172,"f_bsize":4096,"f_ffree":4294858948,"f_files":4294967279,"f_flags":77632024,"f_flags_ext":0,"f_fsid":[16777237,25],"f_fssubtype":1,"f_fstypename":"hfs","f_iosize":1048576,"f_mntfromname":"/dev/disk4s1","f_mntonname":"/Volumes/Extreme SSD","f_owner":0,"f_type":25}}},"event_type":22,"global_seq_num":1868,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":143342977912,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":2264,"pidversion":5800,"rgid":0,"ruid":0,"signing_id":"com.apple.mount_hfs","uuid":"6F03D9EB-00F5-5063-80A4-807B2748E27C"},"cdhash":"fa137bee0557f3eabf4f2951706c6dd4ea098a1a","codesigning_flags":637623057,"executable":{"path":"/System/Library/Filesystems/hfs.fs/Contents/Resources/mount_hfs","path_truncated":false,"sha1":"f27266481af35326c7d731e9812ebe6cb97257b6","sha256":"3852f3975caa4b9a65a7aed745949085a819926c9c09621b4d3e0a65437341f5","stat":{"st_atimespec":"2025-01-16T09:35:10.000Z","st_birthtimespec":"2025-01-16T09:35:10.000Z","st_blksize":4096,"st_blocks":48,"st_ctimespec":"2025-01-16T09:35:10.000Z","st_dev":16777232,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312119900,"st_mode":33261,"st_mtimespec":"2025-01-16T09:35:10.000Z","st_nlink":1,"st_rdev":0,"st_size":137680,"st_uid":0}},"group_id":142,"is_es_client":false,"is_platform_binary":true,"original_ppid":2263,"parent_audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":2263,"pidversion":5798,"rgid":0,"ruid":0,"signing_id":"com.apple.mount","uuid":"E78A506A-AEDA-55BB-AB9E-1BFBC1FFC44E"},"ppid":2263,"responsible_audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":142,"pidversion":273,"rgid":0,"ruid":0,"signing_id":"com.apple.diskarbitrationd","uuid":"34B43207-EF50-5039-B37E-6A02976BBBFE"},"session_id":142,"signing_id":"com.apple.mount_hfs","start_time":"2025-02-11T19:18:30.001Z","team_id":null,"tty":null},"seq_num":0,"thread":{"thread_id":60013,"uuid":"2A21C001-B7E2-5696-B459-C34A09E46B95"},"time":"2025-02-11T19:18:30.568Z","uuid":"3F1E5452-13A2-40E5-8620-8238DB9F81B3","version":8} \ No newline at end of file +{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"event":{"mount":{"device":{"block_size":512,"bsd_major":1,"bsd_minor":21,"bsd_name":"disk4s1","bsd_unit":4,"bus_name":"usb-drd0-port-ss","bus_path":"IODeviceTree:/arm-io@10F00000/usb-drd0@82280000/usb-drd0-port-ss@00200000","content":"48465300-0000-11AA-AA11-00306543ECAC","device_class":0,"device_model":"Extreme 55AE","device_path":"IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/usb-drd0@82280000/AppleT8103USBXHCI@00000000/usb-drd0-port-ss@00200000/Extreme 55AE@00200000/IOUSBHostInterface@0/IOUSBMassStorageInterfaceNub/IOUSBMassStorageDriverNub/IOUSBMassStorageUASDriver/IOSCSITargetDevice/IOSCSIHierarchicalLogicalUnit@0000000000000000/IOSCSIPeripheralDeviceType00/IOBlockStorageServices","device_sub_class":0,"encryption_detail":0,"is_ejectable":0,"is_encrypted":0,"is_internal":0,"is_leaf":1,"is_mountable":1,"is_network_volume":0,"is_removable":0,"is_whole":0,"is_writable":1,"media_kind":"IOMedia","media_name":"Extreme SSD","media_path":"IODeviceTree:/arm-io@10F00000/usb-drd0@82280000/usb-drd0-port-ss@00200000/@1:1","product_id":"0x55ae","product_name":"Extreme 55AE","protocol":"USB","revision":"3000","serial_number":"323132383639343032303633","size":1000035009024,"unit":1,"vendor_id":"0x0781","vendor_name":"SanDisk","volume_kind":"hfs","volume_name":"Extreme SSD","volume_type":"Mac OS Extended (Journaled)"},"disposition":1,"statfs":{"f_bavail":179988282,"f_bfree":179988282,"f_blocks":244149172,"f_bsize":4096,"f_ffree":4294858948,"f_files":4294967279,"f_flags":77632024,"f_flags_ext":0,"f_fsid":[16777237,25],"f_fssubtype":1,"f_fstypename":"hfs","f_iosize":1048576,"f_mntfromname":"/dev/disk4s1","f_mntonname":"/Volumes/Extreme SSD","f_owner":0,"f_type":25}}},"event_type":22,"global_seq_num":1868,"host":{"hostname":"MacbookPro","ips":["192.168.11.16"],"os":"Version 15.5 (Build 24F74)","protectVersion":"7.3.0.5","provisioningUDID":"00006030-001E301C0228001C","serial":"123ABC456DJ"},"mach_time":143342977912,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":2264,"pidversion":5800,"rgid":0,"ruid":0,"signing_id":"com.apple.mount_hfs","uuid":"6F03D9EB-00F5-5063-80A4-807B2748E27C"},"cdhash":"fa137bee0557f3eabf4f2951706c6dd4ea098a1a","codesigning_flags":637623057,"executable":{"path":"/System/Library/Filesystems/hfs.fs/Contents/Resources/mount_hfs","path_truncated":false,"sha1":"f27266481af35326c7d731e9812ebe6cb97257b6","sha256":"3852f3975caa4b9a65a7aed745949085a819926c9c09621b4d3e0a65437341f5","stat":{"st_atimespec":"2025-01-16T09:35:10.000Z","st_birthtimespec":"2025-01-16T09:35:10.000Z","st_blksize":4096,"st_blocks":48,"st_ctimespec":"2025-01-16T09:35:10.000Z","st_dev":16777232,"st_flags":524320,"st_gen":0,"st_gid":0,"st_ino":1152921500312119900,"st_mode":33261,"st_mtimespec":"2025-01-16T09:35:10.000Z","st_nlink":1,"st_rdev":0,"st_size":137680,"st_uid":0}},"group_id":142,"is_es_client":false,"is_platform_binary":true,"original_ppid":2263,"parent_audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":2263,"pidversion":5798,"rgid":0,"ruid":0,"signing_id":"com.apple.mount","uuid":"E78A506A-AEDA-55BB-AB9E-1BFBC1FFC44E"},"ppid":2263,"responsible_audit_token":{"asid":100001,"auid":4294967295,"egid":0,"euid":0,"pid":142,"pidversion":273,"rgid":0,"ruid":0,"signing_id":"com.apple.diskarbitrationd","uuid":"34B43207-EF50-5039-B37E-6A02976BBBFE"},"session_id":142,"signing_id":"com.apple.mount_hfs","start_time":"2025-02-11T19:18:30.001Z","team_id":null,"tty":null},"seq_num":0,"thread":{"thread_id":60013,"uuid":"2A21C001-B7E2-5696-B459-C34A09E46B95"},"time":"2025-02-11T19:18:30.568Z","uuid":"3F1E5452-13A2-40E5-8620-8238DB9F81B3","version":8} diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml index 1eca08e6986..727907c26fd 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_network_connect.yml @@ -275,4 +275,4 @@ processors: - rename: field: jamf_protect.telemetry.event.network_connect.instigator.responsible_audit_token.signing_id target_field: process.responsible.code_signature.signing_id - ignore_missing: true \ No newline at end of file + ignore_missing: true diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml index fdf53c136ff..1bb85116c14 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_close.yml @@ -19,4 +19,4 @@ processors: ## ECS Process ## ########################## - pipeline: - name: '{{ IngestPipeline "pipeline_object_process" }}' \ No newline at end of file + name: '{{ IngestPipeline "pipeline_object_process" }}' diff --git a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml index 6fb02c059fc..800d2fc74ba 100644 --- a/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml +++ b/packages/jamf_protect/data_stream/telemetry/elasticsearch/ingest_pipeline/pipeline_event_pty_grant.yml @@ -19,4 +19,4 @@ processors: ## ECS Process ## ########################## - pipeline: - name: '{{ IngestPipeline "pipeline_object_process" }}' \ No newline at end of file + name: '{{ IngestPipeline "pipeline_object_process" }}'