Jamf Protect

Version: 1.1
Updated: Jun 15, 2023

Jamf Protect is a purpose-built endpoint security and mobile threat defense (MTD) for Mac and mobile devices.

Actions

• List Alerts (Enrichment) - List alerts with possibility to filter alerts created over specified time.
• List Computers (Enrichment) - Retrieve a list of all computers.
• List Plans (Enrichment) - Retrieve a list of plans.
• Set Computer Plan (Containment) - Set a computer plan.
• Update Alerts Status (Containment) - Update alert status.
• Get Alerts (Daemon) - Get new alerts. Rule should be set Process from First Item . The first time the Daemon is run it will return alerts from one day before.

Jamf Protect configuration

1. Log in to Jamf Protect.
2. Click on Administrative on the left menu.
3. Create API Client and click Save.
   
4. Copy API Client Password.
5. Copy Client ID in API Client Configuration

Jamf Protect in Automation Service and Cloud SOAR

1. To configure the integration, log into the application, expand the configuration menu in the top right corner by hovering over the gear icon and click Automation.
   
2. In the Automation section, on the left menu, click Integrations.
   
3. After the list of the integrations appears, search/look for the integration and click on the row.
4. The integration details will appear. Click on the "+" button to add new Resource.
   
5. Populate all the required fields (*)
   • API URL. 'https://your-tenant.protect.jamfcloud.com'.
   • Client ID. Insert copied Client ID.
   • Password. Insert copied Password.
6. Click Save.
   
7. To make sure the resource is working, hover over the resource and then click the pencil icon that appears on the right.
   
8. Click TEST SAVED SETTINGS.
   
9. You should receive a successful notification in the bottom right corner.
   

Change Log

• February 2, 2023 - First upload
• June 15, 2023 (v1.1)- Updated the integration with Environmental Variables