Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding JAMF Push Connector files to the JAMF Solution #11630

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+1,235 −1
Open

Adding JAMF Push Connector files to the JAMF Solution #11630

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
57ee6a5
Adding JAMF Protect Push Connector files
Jan 6, 2025
5ca306c
Fix changes
Jan 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
0 ... Protect/Data Connectors/JamfProtect.json → ...a Connectors/JamfProtect/JamfProtect.json
View file
Open in desktop
File renamed without changes.
277 changes: 277 additions & 0 deletions Solutions/Jamf Protect/Data Connectors/JamfProtect_cpp/DCR.json
View file
Open in desktop

Large diffs are not rendered by default.

208 changes: 208 additions & 0 deletions Solutions/Jamf Protect/Data Connectors/JamfProtect_cpp/connectorDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,208 @@
{
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]",
"apiVersion": "2022-09-01-preview",
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
"location": "[parameters('workspace-location')]",
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "JamfProtect",
"title": "Jamf Protect",
"publisher": "Jamf",
"descriptionMarkdown": "The [Jamf Protect](https://www.jamf.com/products/jamf-protect/) connector provides the capability to read raw event data from Jamf Protect in Microsoft Sentinel.",
"graphQueries": [
{
"metricName": "Telemetry",
"legend": "jamfprotecttelemetryv2_CL",
"baseQuery": "jamfprotecttelemetryv2_CL"
},
{
"metricName": "Unified Logs",
"legend": "jamfprotectunifiedlogs_CL",
"baseQuery": "jamfprotectunifiedlogs_CL"
},
{
"metricName": "Telemetry (Legacy)",
"legend": "jamfprotecttelemetryv1_CL",
"baseQuery": "jamfprotecttelemetryv1_CL"
},
{
"metricName": "Alerts",
"legend": "jamfprotectalerts_CL",
"baseQuery": "jamfprotectalerts_CL"
}
],
"sampleQueries": [
{
"description": "Jamf Protect - All Alerts",
"query": "jamfprotectalerts_CL\n | sort by TimeGenerated desc"
},
{
"description": "Jamf Protect - All Telemetry events",
"query": "jamfprotecttelemetry_CL\n | sort by TimeGenerated desc"
}
],
"dataTypes": [
{
"name": "jamfprotecttelemetryv2_CL",
"lastDataReceivedQuery": "jamfprotecttelemetryv2_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
},
{
"name": "jamfprotectunifiedlogs_CL",
"lastDataReceivedQuery": "jamfprotectunifiedlogs_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
},
{
"name": "jamfprotecttelemetryv1_CL",
"lastDataReceivedQuery": "jamfprotecttelemetryv1_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
},
{
"name": "jamfprotectalerts_CL",
"lastDataReceivedQuery": "jamfprotectalerts_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
}
],
"connectivityCriteria": [
{
"type": "IsConnectedQuery",
"value": [
"jamfprotecttelemetryv2_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(7d)",
"jamfprotectunifiedlogs_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(7d)",
"jamfprotecttelemetryv1_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(7d)",
"jamfprotectalerts_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(7d)"
]
}
],
"availability": {
"status": 1
},
"permissions": {
"resourceProvider": [
{
"provider": "Microsoft.OperationalInsights/workspaces",
"permissionsDisplayText": "read and write permissions are required.",
"providerDisplayName": "Workspace",
"scope": "Workspace",
"requiredPermissions": {
"write": true,
"read": true,
"delete": true
}
}
],
"customs": [
{
"name": "Microsoft Entra",
"description": "Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher."
},
{
"name": "Microsoft Azure",
"description": "Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role"
}
]
},
"instructionSteps": [
{
"title": "1. Create ARM Resources and Provide the Required Permissions",
"description": "This connector reads data from the tables that Jamf Protect uses in a Microsoft Analytics Workspace, if the [data forwarding](https://docs.jamf.com/jamf-protect/documentation/Data_Forwarding_to_a_Third_Party_Storage_Solution.html?hl=sentinel#task-4227) option is enabled in Jamf Protect then raw event data is sent to the Microsoft Sentinel Ingestion API.",
"instructions": [
{
"type": "Markdown",
"parameters": {
"content": "#### Automated Configuration and Secure Data Ingestion with Entra Application \nClicking on \"Connect\" will trigger the creation of Log Analytics tables and a Data Collection Rule (DCR). \nIt will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token."
}
},
{
"parameters": {
"label": "Deploy Jamf Protect connector resources",
"applicationDisplayName": "Jamf Protect Connector Application"
},
"type": "DeployPushConnectorButton"
}
]
},
{
"title": "2. Push your logs into the workspace",
"description": "Use the following parameters to configure the your machine to send the logs to the workspace.",
"instructions": [
{
"parameters": {
"label": "Tenant ID (Directory ID)",
"fillWith": [
"TenantId"
]
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "Entra Application ID",
"fillWith": [
"ApplicationId"
],
"placeholder": "Deploy push connector to get the Application ID"
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "Entra Application Secret",
"fillWith": [
"ApplicationSecret"
],
"placeholder": "Deploy push connector to get the Application Secret"
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "DCE Uri",
"fillWith": [
"DataCollectionEndpoint"
],
"placeholder": "Deploy push connector to get the DCR Uri"
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "DCR Immutable ID",
"fillWith": [
"DataCollectionRuleId"
],
"placeholder": "Deploy push connector to get the DCR ID"
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "Telemetry Stream ID",
"value": "Custom-jamfprotecttelemetryv1_CL"
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "Unified Logs Stream ID",
"value": "Custom-jamfprotectunifiedlogs_CL"
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "Telemetry (Legacy) Stream ID",
"value": "Custom-jamfprotecttelemetryv2_CL"
},
"type": "CopyableLabel"
},
{
"parameters": {
"label": "Alerts Stream ID",
"value": "Custom-jamfprotectalerts_CL"
},
"type": "CopyableLabel"
}
]
}
]
}
}
}
24 changes: 24 additions & 0 deletions Solutions/Jamf Protect/Data Connectors/JamfProtect_cpp/dataConnector.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
{
"name": "JamfProtectPushConnector",
"apiVersion": "2022-12-01-preview",
"type": "Microsoft.SecurityInsights/dataConnectors",
"kind": "Push",
"properties": {
"connectorDefinitionName": "",
"dcrConfig": {
"dataCollectionRuleId": "[[parameters('dcrConfig').dataCollectionRuleId]",
"dataCollectionRuleImmutableId": "",
"dataCollectionEndpoint": ""
},
"auth": {
"type" : "Push",
"AppId" : "[[parameters('AppId')]",
"ServicePrincipalId" : "[[parameters('ServicePrincipalId')]"
},
"request": {
},
"response": {
"eventsJsonPaths": ["$.messages"]
}
}
}
11 changes: 11 additions & 0 deletions Solutions/Jamf Protect/Data Connectors/JamfProtect_cpp/solutionMetadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"SolutionName":"Jamf Protect for Microsoft Sentinel",
"SolutionAuthor": "Thijs Xhaflaire",
"SolutionVersion":"3.2.0",
"PackageId": "azuresentinel.azure-sentinel-solution-JamfProtectPushV1",
"TemplateName": "JamfProtectPushV1",
"ConnectorDefinitionTemplateVersion": "1.0.0",
"DataConnectorsTemplateVersion": "1.0.0",
"PackageIcon":"JamfProtect",
"SolutionTier": "Partner"
}
Loading