+4I am interested in how we can automate some reports or feed data into a SIEM like Splunk of Jamf Connect activity. The most important data point is when a user uses the privilege elevation feature. Does anyone have any experience or advise on this?
Thanks in advance,
-Pat
+24From what I understand, Jamf Protect natively ingests this and you can use RADAR to send those logs to a SIEM of your choice.
+6We have an Action setup to send Unified Logs to our SIEM.
Then a filter in the Unified Logging section of Jamf Protect to filter for the elevation requests.
subsystem == "com.jamf.connect" && category == "PrivilegeElevation" && (eventMessage CONTAINS "temporary admin reason")
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.