kcreddy · Mar 5, 2025 · Feb 24, 2025 · Feb 24, 2025 · Feb 27, 2025 · Feb 27, 2025
@@ -1,4 +1,12 @@
 # newer versions go on top
+- version: "3.0.0"
+  changes:
+    - description: Adding new Gatekeeper Override event for Telemetry
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12871
+    - description: Mapping fields to new ECS fields that got added recently.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12871
 - version: "2.9.2"
   changes:
     - description: Updated SSL description in package manifest.yml to be uniform and to include links to documentation.

@@ -3,7 +3,7 @@ description: Pipeline for parsing Jamf Protect Alert and Unified Logging logs
 processors:
     - set:
         field: ecs.version
-        value: '8.11.0'
+        value: '8.16.0'
     - json:
         field: message
         target_field: jamf_protect.alerts

@@ -1,24 +1,24 @@
 {
-    "@timestamp": "2024-10-29T15:33:09.283Z",
+    "@timestamp": "2025-02-24T07:36:51.749Z",
     "agent": {
-        "ephemeral_id": "671ffaef-2f9c-40c3-bc44-8f7dd8f41bf3",
-        "id": "fffef289-536c-44b3-8a3a-7edce9a79be4",
-        "name": "elastic-agent-79065",
+        "ephemeral_id": "05b5d07a-298d-4d27-ba4c-f4d06b4ab9cf",
+        "id": "678c464f-aeaf-4ddb-82c3-fea65b2c795e",
+        "name": "elastic-agent-76578",
         "type": "filebeat",
-        "version": "8.14.3"
+        "version": "8.17.0"
     },
     "data_stream": {
         "dataset": "jamf_protect.alerts",
-        "namespace": "64311",
+        "namespace": "22645",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "fffef289-536c-44b3-8a3a-7edce9a79be4",
+        "id": "678c464f-aeaf-4ddb-82c3-fea65b2c795e",
         "snapshot": false,
-        "version": "8.14.3"
+        "version": "8.17.0"
     },
     "event": {
         "action": "CustomURLHandlerCreation",
@@ -29,7 +29,7 @@
         ],
         "dataset": "jamf_protect.alerts",
         "id": "6bdb0697-6d07-47bc-a37d-6c3348a5d953",
-        "ingested": "2024-10-29T15:33:10Z",
+        "ingested": "2025-02-24T07:36:52Z",
         "kind": "alert",
         "provider": "Jamf Protect",
         "reason": "Application that uses custom url handler created",
@@ -146,4 +146,4 @@
     "tags": [
         "Visibility"
     ]
-}
+}
@@ -30,3 +30,4 @@
 {"event":{"file_collection":{"contents":"Date/Time:        2024-04-17 18:19:13.962 -0500\nEnd time:         2024-04-17 18:21:05.619 -0500\n","file":{"path":"/Library/Logs/DiagnosticReports/spotlightknowledged_MacBook-Pro.cpu_resource.diag","size":28}}},"event_type":9002,"host":{"hostname":"MacBookPro","ips":["192.168.0.185"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.0.1","provisioningUDID":"00006000-001C58882238801E","serial":"123ABC456DE"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-05-28T05:45:58.729Z","uuid":"06CE8D4D-6848-4562-B947-2D607580283A"}
 {"event":{"bios_uefi":{"architecture":"arm64","bios":{"firmware-version":"iBoot-10151.101.3","system-firmware-version":"iBoot-10151.101.3"}}},"event_type":9004,"host":{"hostname":"MacBookPro","ips":["192.168.0.185"],"os":"Version 14.4.1 (Build 23E224)","protectVersion":"6.0.0.1","provisioningUDID":"00006000-001C58882238801E","serial":"LFQ5YXH377"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-05-22T16:49:22.294Z","uuid":"DDFDF887-D3F1-4F01-A8E1-0506BBCCD2BF"}
 {"event":{"system_performance":{"metrics":{"hw_model":"MacBookPro18,3","tasks":[{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":202.193,"cputime_ns":1013161791,"cputime_sample_ms_per_s":202.187,"cputime_userland_ratio":0.573927,"diskio_bytesread":380928,"diskio_bytesread_per_s":76020.3,"diskio_byteswritten":0,"diskio_byteswritten_per_s":0,"energy_impact":3140.59,"energy_impact_per_s":626.755,"idle_wakeups":0,"interval_ns":5010874875,"intr_wakeups_per_s":0.199566,"name":"SourceKitService","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":0,"pageins_per_s":0,"pid":36354,"qos_background_ms_per_s":0,"qos_background_ns":0,"qos_default_ms_per_s":202.086,"qos_default_ns":1012626541,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":0.105654,"qos_user_initiated_ns":529416,"qos_user_interactive_ms_per_s":0,"qos_user_interactive_ns":0,"qos_utility_ms_per_s":0,"qos_utility_ns":0,"started_abstime_ns":1968573181764,"timer_wakeups":[{"wakeups":1},{"wakeups":0}]},{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":138.511,"cputime_ns":694060541,"cputime_sample_ms_per_s":138.507,"cputime_userland_ratio":0.879748,"diskio_bytesread":151552,"diskio_bytesread_per_s":30244.6,"diskio_byteswritten":3981312,"diskio_byteswritten_per_s":794534,"energy_impact":1258.85,"energy_impact_per_s":251.224,"idle_wakeups":2,"interval_ns":5010874875,"intr_wakeups_per_s":58.872,"name":"Xcode","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":3,"pageins_per_s":0.598698,"pid":36337,"qos_background_ms_per_s":0.0153998,"qos_background_ns":77166,"qos_default_ms_per_s":11.2632,"qos_default_ns":56438500,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":11.1361,"qos_user_initiated_ns":55801625,"qos_user_interactive_ms_per_s":114.393,"qos_user_interactive_ns":573208208,"qos_utility_ms_per_s":1.7033,"qos_utility_ns":8535041,"started_abstime_ns":1968419476399,"timer_wakeups":[{"wakeups":2},{"wakeups":174}]},{"bytes_received":0,"bytes_received_per_s":0,"bytes_sent":0,"bytes_sent_per_s":0,"cputime_ms_per_s":83.7332,"cputime_ns":419576500,"cputime_sample_ms_per_s":83.7307,"cputime_userland_ratio":0.981833,"diskio_bytesread":57344,"diskio_bytesread_per_s":11443.9,"diskio_byteswritten":0,"diskio_byteswritten_per_s":0,"energy_impact":1198.09,"energy_impact_per_s":239.099,"idle_wakeups":0,"interval_ns":5010874875,"intr_wakeups_per_s":0.199566,"name":"JamfProtect","packets_received":0,"packets_received_per_s":0,"packets_sent":0,"packets_sent_per_s":0,"pageins":0,"pageins_per_s":0,"pid":58824,"qos_background_ms_per_s":0,"qos_background_ns":0,"qos_default_ms_per_s":82.6678,"qos_default_ns":414237833,"qos_disabled_ms_per_s":0,"qos_disabled_ns":0,"qos_maintenance_ms_per_s":0,"qos_maintenance_ns":0,"qos_user_initiated_ms_per_s":1.06542,"qos_user_initiated_ns":5338666,"qos_user_interactive_ms_per_s":0,"qos_user_interactive_ns":0,"qos_utility_ms_per_s":0,"qos_utility_ns":0,"started_abstime_ns":2357421081500,"timer_wakeups":[{"wakeups":0},{"wakeups":0}]}]},"page_info":{"page":1,"total":4}}},"event_type":9001,"host":{"hostname":"MacBookPro","ips":["192.168.100.102"],"os":"Version 14.5 (Build 23F79)","protectVersion":"6.0.1.1","provisioningUDID":"00006000-001C58882238801E","serial":"123ABC456DE"},"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"time":"2024-06-04T09:41:38.708Z","uuid":"710782C4-489E-4003-945C-316F65C50379"}
+{"action":{"result":{"result":{"auth":0},"result_type":0}},"action_type":1,"deadline":0,"event":{"gatekeeper_user_override":{"file":{"path":"/Applications/ImHex.app","stat":{"st_ino":276410,"st_nlink":3,"st_flags":0,"st_gid":80,"st_ctimespec":"2024-08-13T12:45:32.702896951Z","st_mode":16877,"st_size":96,"st_blksize":4096,"st_dev":16777233,"st_birthtimespec":"2024-07-09T06:14:53.000000000Z","st_mtimespec":"2024-07-09T06:14:53.000000000Z","st_uid":501,"st_atimespec":"2024-08-13T12:44:06.493954409Z","st_blocks":0,"st_gen":0,"st_rdev":0},"path_truncated":false},"signing_info":{"cdhash":"8F5EE5FD68737F31100CFFD5C8C4C0F9F129F61E","team_id":null,"signing_id":"net.WerWolv.ImHex"},"sha256":"NULL","file_type":1}},"event_type":146,"global_seq_num":0,"host":{"hostname":"MacBookPro","ips":["192.168.6.74"],"os":"Version 15.3 (Build 24D5055b)","protectVersion":"6.3.3.4","provisioningUDID":"337a9bb866f898a336b0d3d2176045a3a1347ad8","serial":"ZL2GDYMJDM"},"mach_time":30818180643,"metadata":{"product":"Device Telemetry Stream","schemaVersion":"1.0","vendor":"Jamf"},"process":{"original_ppid":1,"ppid":1,"session_id":171,"signing_id":"com.apple.syspolicyd","is_platform_binary":true,"parent_audit_token":{"egid":0,"pid":1,"asid":100001,"rgid":0,"ruid":0,"euid":0,"pidversion":7,"auid":4294967295,"uuid":"2B6E1584-0A36-4FC1-9897-A282D6A6F2F0"},"team_id":null,"group_id":171,"tty":null,"is_es_client":false,"executable":{"stat":{"st_nlink":1,"st_gid":0,"st_dev":16777233,"st_mode":33261,"st_birthtimespec":"2024-08-09T12:23:23.000000000Z","st_size":2502224,"st_atimespec":"2024-08-09T12:23:23.000000000Z","st_uid":0,"st_blksize":4096,"st_flags":524320,"st_gen":0,"st_ino":1152921500312492700,"st_rdev":0,"st_ctimespec":"2024-08-09T12:23:23.000000000Z","st_mtimespec":"2024-08-09T12:23:23.000000000Z","st_blocks":2088},"path":"/usr/libexec/syspolicyd","path_truncated":false},"cdhash":"F276F6DF70766BBD0D90BF25CED170468EF306D3","audit_token":{"auid":4294967295,"egid":0,"euid":0,"asid":100001,"rgid":0,"ruid":0,"pidversion":461,"pid":171,"uuid":"94DF5DE7-6851-4E24-9D9A-BFD45DC826FD"},"start_time":"2024-08-13T12:24:14.599716Z","codesigning_flags":570522369,"responsible_audit_token":{"auid":4294967295,"pid":171,"rgid":0,"euid":0,"asid":100001,"pidversion":461,"ruid":0,"egid":0,"uuid":"C7A6D408-273C-4F6E-B5A4-903F641E3BCE"}},"seq_num":0,"thread":{"thread_id":22745,"uuid":"2F21A566-B8E0-4F52-869A-E92445FB794E"},"time":"2024-08-13T12:45:32.706386826Z","uuid":"A8C84E30-C305-4E69-87CD-789ADFEB0FE4","version":8}