Collect Jamf Protect Telemetry logs

This document describes how you can collect Jamf Protect Telemetry logs by setting up a Google Security Operations feed and how log fields map to Google Security Operations Unified Data Model (UDM) fields. This document also lists the supported Jamf Protect Telemetry version.

For more information, see Data ingestion to Google Security Operations .

A typical deployment consists of Jamf Protect Telemetry and the Google Security Operations feed configured to send logs to Google Security Operations. Each customer deployment can differ and might be more complex.

The deployment contains the following components:

• Jamf Protect Telemetry. The Jamf Protect Telemetry platform from which you collect logs.

• Google Security Operations feed. The Google Security Operations feed that fetches logs from Jamf Protect Telemetry and writes logs to Google Security Operations.

• Google Security Operations. Google Security Operations retains and analyzes the logs from Jamf Protect Telemetry.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the JAMF_TELEMETRY ingestion label.

Before you begin

Ensure you have the following prerequisites:

• A Jamf Protect Telemetry set up
• Jamf Protect version 4.0.0 or later
• All systems in the deployment architecture are configured with the UTC time zone.

Set up feeds from SIEM Settings > Feeds

You can use either Amazon S3 V2 or a webhook to set up an ingestion feed in Google Security Operations.

Set up an ingestion feed in Google SecOps using Amazon S3 V2

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Click the JAMFfeed pack.
4. Locate the Jamf Protect Telemetrylog type.
5. Select Amazon S3 V2as the Source type.

6. Specify values for the following fields:

   • S3 URI: The bucket URI.
     • s3://your-log-bucket-name/
       • Replace your-log-bucket-name with the actual name of your S3 bucket.
   • Source deletion options: Select the deletion option according to your ingestion preferences.
   • Access Key ID: The user's access key with permissions to read from the S3 bucket.
   • Maximum File Age: Includes files modified in the last number of days. Default is 180 days.
   • Secret Access Key: The user's secret key with permissions to read from the S3 bucket.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed .
   • Ingestion Labels: Labels applied to all events from this feed.

7. Click Create Feed.

Set up an ingestion feed in Google SecOps using a webhook

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Click the JAMFfeed pack.
4. Locate the Jamf Protect Telemetrylog type.
5. In the Source typelist, select Webhook.
6. Specify values for the following fields:
   • Split delimiter: The delimiter that is used to separate log lines, such as \n .
   • Asset namespace: The asset namespace .
   • Ingestion labels: The label to be applied to the events from this feed.
7. Click Create Feed.

To configure multiple feeds for different log types within this product family, see Configure feeds by product .

Create an API key for a webhook feed

1. Go to Google Cloud console > Credentials.

   Go to Credentials

2. Click Create credentials, and then select API key.

3. Restrict the API key access to the Google Security Operations API.

Set up Jamf Protect Telemetry for a webhook feed

1. In the Jamf Protect Telemetry application, navigate to the related Action configuration.
2. To add a new Data endpoint, click Create Actions.
3. Select HTTPas the protocol.
4. Enter the HTTPS URL of the Google Security Operations API endpoint in the URLfield. (This is the Endpoint Informationfield that you copied from the webhook feed setup. It's already in the required format.)

5. Enable authentication by specifying the API keyand Secret keyas part of the custom header in the following format:

    X-goog-api-key = API_KEY 
   X-Webhook-Access-Key = SECRET 
    
   

   Recommendation: Specify the API key as a header instead of specifying it in the URL. If your webhook client doesn't support custom headers, you can specify the API keyand Secret keyusing query parameters in the following format:

     ENDPOINT_URL 
   ?key= API_KEY 
   &secret= SECRET 
    
   

   Replace the following:

   • ENDPOINT_URL : The feed endpoint URL.
   • API_KEY : The API key to authenticate to Google Security Operations.
   • SECRET : The secret key that you generated to authenticate the feed.

6. In the Collect Logssection, select Telemetry.

7. Click Submit.

For more information about Google Security Operations feeds, see Google Security Operations feeds documentation . For information about requirements for each feed type, see Feed configuration by type .

If you encounter issues when you create feeds, contact Google Security Operations support .

Supported Jamf Protect Telemetry log types

The Jamf Protect Telemetry parser supports the following log types:

Supported Jamf Protect Telemetry log formats

The Jamf Protect Telemetry parser supports logs in JSON format.

Supported Jamf Protect Telemetry sample logs

• JSON

   {
    "exec_chain": {
      "uuid": "F6095AEA-C5CB-4AAB-8FC7-70B9D454319E"
    },
    "exec_chain_child": {
      "parent_path": "/sbin/launchd",
      "parent_pid": 1,
      "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02"
    },
    "header": {
      "time_seconds_epoch": 1657906179,
      "time_milliseconds_offset": 848,
      "version": 11,
      "event_modifier": 0,
      "event_id": 45018,
      "event_name": "AUE_add_to_group"
    },
    "host_info": {
      "serial_number": "C03WG0H4HDTS",
      "host_name": "Test_MacBook_Pro",
      "osversion": "Version 12.4 (Build 21F79)",
      "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
    },
    "identity": {
      "signer_id": "dummy.domain.opendirectoryd",
      "team_id_truncated": false,
      "signer_id_truncated": false,
      "cd_hash": "68d22bdec020f20010bfa9d27cd5f69d78427636",
      "team_id": "",
      "signer_type": 1
    },
    "key": "21E48D3B-4965-4072-81BF-83BE04A329C2",
    "return": {
      "error": 0,
      "description": "success",
      "return_value": 0
    },
    "subject": {
      "session_id": 100003,
      "group_id": 20,
      "process_name": "/System/Library/PreferencePanes/Accounts.prefPane/Contents/XPCServices/com.apple.preferences.users.remoteservice.xpc/Contents/MacOS/com.apple.preferences.users.remoteservice",
      "parent_pid": 1,
      "effective_user_name": "jamf",
      "user_id": 501,
      "group_name": "staff",
      "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02",
      "uuid": "F6095AEA-C5CB-4AAB-8FC7-70B9D454319E",
      "effective_group_id": 20,
      "process_hash": "507494616e05a5eb909794354fe69f29e432f2a7",
      "audit_id": 501,
      "responsible_process_id": 1391,
      "parent_path": "/sbin/launchd",
      "process_id": 1701,
      "effective_group_name": "staff",
      "audit_user_name": "jamf",
      "effective_user_id": 501,
      "terminal_id": {
        "type": 4,
        "ip_address": "198.51.100.0",
        "port": 4278
      },
      "responsible_process_name": "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences",
      "user_name": "jamf"
    },
    "texts": [
      "Added Groups membership username to '_lpadmin' node '/Local/Default', value = 'baddie'"
    ]
  } 
  

Field mapping reference

This section explains how the Google Security Operations parser maps Jamf Protect Telemetry fields to Google Security Operations Unified Data Model (UDM) fields.

Field mapping reference: Event Identifier to Event Type

Field mapping reference: JAMF_TELEMETRY

What's next

• Data ingestion to Google Security Operations

Need more help? Get answers from Community members and Google SecOps professionals.