Jamf Protect - Network Threats

id: 44da53c3-f3b0-4b70-afff-f79275cb9442
name: Jamf Protect - Network Threats
description: |
  'Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts.'
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: JamfProtect
    dataTypes: 
      - jamfprotect_CL
suppressionDuration: PT5H
suppressionEnabled: false
tactics:
  - InitialAccess
relevantTechniques:
  - T1133
query: |
  JamfProtectThreatEvents
  | where EventResult == "Blocked"
      and isnotempty(EventSeverity)
  | extend Tactics = "Initial Access"
  | extend Techniques = "T1566"
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: "Network Threat detected on {{DvcHostname}}"
  alertDescriptionFormat: "A Network Threat has been {{EventResult}} on {{DvcHostname}}"
  alertTacticsColumnName: Tactics
  alertSeverityColumnName: EventSeverity
  alertDynamicProperties:
    - alertProperty: AlertLink
      value: EventReportUrl
    - alertProperty: ProviderName
      value: EventVendor
    - alertProperty: ProductName
      value: EventProduct
    - alertProperty: RemediationSteps
      value: EventResult
    - alertProperty: Techniques
      value: Techniques
customDetails:
  Category: ThreatCategory
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
  - identifier: OSFamily
    columnName: DvcOs
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DstIpAddr
- entityType: Account
  fieldMappings:
  - identifier: AadUserId
    columnName: SrcUsermail
  - identifier: FullName
    columnName: SrcUsername
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: DnsQueryName
version: 1.0.5
kind: NRT