Collect Jamf Protect logs

This document describes how you can collect Jamf Protect logs by setting up a Google Security Operations feed and how log fields map to Google Security Operations Unified Data Model (UDM) fields. This document also lists the supported Jamf Protect version.

For more information, see Data ingestion to Google Security Operations.

A typical deployment consists of Jamf Protect and the Google Security Operations feed configured to send logs to Google Security Operations. Each customer deployment can differ and might be more complex.

The deployment contains the following components:

• Jamf Protect. The Jamf Protect platform from which you collect logs.

• Google Security Operations feed. The Google Security Operations feed that fetches logs from Jamf Protect and writes logs to Google Security Operations.

• Google Security Operations. Google Security Operations retains and analyzes the logs from Jamf Protect.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the JAMF_PROTECT ingestion label.

Before you begin

• Ensure that you have a Jamf Protect set up.
• Ensure that you are using Jamf Protect version 4.0.0 or later.
• Ensure that all systems in the deployment architecture are configured with the UTC time zone.

Configure a feed in Google Security Operations to ingest Jamf Protect logs

You can use either Amazon S3 or a webhook to set up an ingestion feed in Google Security Operations, but we recommend using Amazon S3.

Set up an ingestion feed in Google SecOps using Amazon S3

1. Go to SIEM Settings > Feeds.
2. Click Add New.
3. Select Amazon S3 as the Source type.
4. To create a feed for Jamf Protect, select Jamf Protect as the Log type.
5. Click Next.
6. Save the feed and then Submit.
7. Copy the Feed ID from the feed name to use in Jamf Protect.

Set up an ingestion feed in Google SecOps using a webhook

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed.
4. In the Source type list, select Webhook.
5. To create a feed for Jamf Protect, select Jamf Protect as the Log type.
6. Click Next.
7. Optional: Specify values for the following input parameters:
   • Split delimiter: the delimiter that is used to separate log lines, such as \n.
   • Asset namespace: the asset namespace.
   • Ingestion labels: the label to be applied to the events from this feed.
8. Click Next.
9. Review your new feed configuration in the Finalize screen, and then click Submit.
10. Click Generate Secret Key to generate a secret key to authenticate this feed.
11. Copy and store the Secret key. You cannot view this secret key again. If needed, you can regenerate a new secret key, but this action makes the previous secret key obsolete.
12. On the Details tab, copy the feed endpoint URL from the Endpoint Information field. You will need this HTTPS URL to set up your Jamf Protect client application.
13. Click Done.

Create an API key for a webhook feed

1. Go to Google Cloud console > Credentials.

   Go to Credentials

2. Click Create credentials, and then select API key.

3. Restrict the API key access to the Google Security Operations API.

Set up Jamf Protect for a webhook feed

1. In the Jamf Protect application, navigate to the related Action configuration.
2. To add a new Data endpoint, click Create Actions.
3. Select HTTP as the protocol.
4. Enter the HTTPS URL of the Google Security Operations API endpoint in the URL field. (This is the Endpoint Information field that you copied from the webhook feed setup. It's already in the required format.)

5. Enable authentication by specifying the API key and Secret key as part of the custom header in the following format:

   X-goog-api-key = API_KEY
   X-Webhook-Access-Key = SECRET
   

   Recommendation: Specify the API key as a header instead of specifying it in the URL. If your webhook client doesn't support custom headers, you can specify the API key and Secret key using query parameters in the following format:

   ENDPOINT_URL?key=API_KEY&secret=SECRET
   

   Replace the following:

   • ENDPOINT_URL: The feed endpoint URL.
   • API_KEY: The API key to authenticate to Google Security Operations.
   • SECRET: The secret key that you generated to authenticate the feed.

6. In the Collect Logs section, select Telemetry.

7. Click Submit.

For more information about Google Security Operations feeds, see Google Security Operations feeds documentation. For information about requirements for each feed type, see Feed configuration by type.

If you encounter issues when you create feeds, contact Google Security Operations support.

Supported Jamf Protect log types

The following table lists the log types that the Jamf Protect parser supports:

Event Type	Display name
GPClickEvent	Synthetic Click Events
GPDownloadEvent	Download Events
GPFSEvent	File System Events
GPGatekeeperEvent	Gatekeeper Events
GPKeylogRegisterEvent	Keylogger Events
GPMRTEvent	Monitor Events
GPPreventedExecutionEvent	Custom Prevent List Events
GPProcessEvent	Process Events
GPThreatMatchExecEvent	Threat Prevention Events
GPUSBEvent	USB Events
GPUnifiedLogEvent	Unified Log Events
Auth-mount	Device Controls Events

Field mapping reference

This section explains how the Google Security Operations parser maps Jamf Protect fields to Google Security Operations Unified Data Model (UDM) fields.

Field mapping reference: Event Identifier to Event Type

The following table lists the JAMF_PROTECT log types and their corresponding UDM event types.

Field mapping reference: JAMF_PROTECT

The following table lists the log fields of the JAMF_PROTECT log type and their corresponding UDM fields.

What's next

• Data ingestion to Google Security Operations