JamfProtect Inslights updating??

[robbo007]

Hi,
I've deployed a policy to force Password Required To Wake Computer From Sleep Or Screen Saver. On the mac where it was deployed I see its active.

Under JamfProtect I still see the insight says it's not active. Can I force the Insights to be updated on the computer so it detects the changes?

Regards,

[Wakko]

@robbo007 I've run into this before and I trust me I understand that it's a pain. However I have some tips.

Check your insight checkin time in JAMFProtect
Go to JAMFProtect --> Plans --> (Click on your Plan) Plan Summary and hit edit. Once here scroll down "Insight". By default it set to 24 hours. I personally change it to 12 hours (720 minutes).

Secondly you can force a checkin from the client via "protectctl".
1. Launch Terminal
2. Escalate yourself to root
3. type "protectctl -h" to get familiar with the commands
4. "protectctl info" is very helpful - it will show you the last check-in and most importantly the last insight check in
5. I personally do a force check-in via "protectctl checkin"
6. Then run "protectctl checkin --insights" -- this will force an insight check-in
7. Run "protectctl info" again and you will notice that the device has checked in
8. Check JAMF Protect to see if the insight status has changed

I found this workflow to be extremely helpful as I was testing profiles and verifying that they functioned as needed. LMK if this helps you out.

~L0$

[Rob_Jamf]

Amazing, thanks :)

[Pei_Lin]

@Wakko Are you referring to the Sync Interval? Mine is set to 5 minutes, but it hasn't updated in a day. 

[kreansanm]

Just started at a new company and they are in dire need of an endpoint AV solution (among just about every other security precaution that exists).

I am working to set us up with Jamf Pro and I wanted to reach out to see if you have any experience with Jamf Protect (instead of a "more traditional" AV). Most of the posts here are from last year and before I commit to something like MalwareBytes I wanted to check to see if anyone has experience with Jamf Protect as I am a big fan of the tight MacOS integrations and the reduced risk of something breaking with OS updates.

I am 100% not sold on an AV yet so I figured I'd reach out here before diving further into the weeds.

Thanks!

[Pei_Lin]

@kreansanm 

I've been using Jamf Protect for about 1.5 years now. It's just decent. I like the insights and analytics it already comes with, but I wish their documentation is better. It really depends on how much time you're willing to spend on configuring your needs and learning the system. They did add some new features in the past year that I'm not able to utilize, since our OS is older. We haven't had any issues with the security of our computers, so I'm satisfied. A traditional AV is not used widespread in our environment, so I can't compare them fairly. We do have a test computer with MalwareBytes. Something about having a recurring AV run and report scans does give me more reassurance. Sometimes I wonder if Jamf Protect is actually fully protecting our system to our needs. 

Mind you, I'm still learning a lot about ways of managing and securing our system. 

Hope this helps!