Jamf Protect - Unified Logs

id: 9eb2f758-003b-4303-83c6-97aed4c03e41
name: Jamf Protect - Unified Logs
description: |
  'Creates an informational incident based on Jamf Protect Unified Log data in Microsoft Sentinel'
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: JamfProtect
    dataTypes: 
      - jamfprotect_CL
suppressionDuration: PT5H
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionEnabled: false
tactics:
relevantTechniques:
query: |
  JamfProtectUnifiedLogs
  | where isnotempty(EventSeverity)
  | extend Host_IPs = tostring(parse_json(DvcIpAddr)[0])
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
alertDetailsOverride:
  alertDisplayNameFormat: "{{EventDescription}} on {{DvcHostname}}"
  alertDescriptionFormat: "{{EventDescription}} has been captured in the unified logs"
  alertSeverityColumnName: EventSeverity
  alertDynamicProperties:
    - alertProperty: ProviderName
      value: EventVendor
    - alertProperty: ProductName
      value: EventProduct
customDetails:
  Protect_Event_Type: EventType
  Unified_Log: EventDescription
  Tags: Match_tags
  Event_Process: TargetProcessName
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DvcHostname
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: Host_IPs
version: 1.0.3
kind: NRT