We released a new Jamf Protect agent on 10/18/21 (version 3.0.0.366) that overhauls the Jamf Protect Alert UI to better match your workflows and help you prioritize your security response efforts.
New featuresAlert Severity - Security teams are commonly faced with a high incoming count of alerts from various security tools. The concept of alert severity helps these teams prioritize what, if any, investigation they perform against incoming alerts and which to tackle first.
With this release, alerts will be assigned one of four default severities:
- High - Known bad malware and behavior that indicates a high confidence of compromise (CVEs, reverse shells, keyloggers, red-team frameworks, etc)
- Medium - Known adware/grayware and suspicious behavior (SSH as root, Climpli, etc)
- Low - Potentially unwanted programs and behavior that could be suspicious but also exhibited by legitimate vendors (Crypto-miners,behavior to avoid LittleSnitch, etc)
- Informational - Interesting events that aid visibility into the environment for investigations and threat hunting(normal launch agent installation, EICAR detections, etc)
Note: All the events that had previously been collected in the “Log” section, will now appear in the “Alert” section with a severity of Informational.
To make this information easy to digest and actionable, we’ve overhauled our UI for listing and digging into alerts.
All severities are assigned based on the analytic that triggered the alert and can be customized.
Note: Any older existing deployed agents will continue to function and severity will be displayed in the Jamf Protect console correctly. However, any events sent to a SIEM, S3 bucket, etc may be missing their severity.
Alert Status and Actions - Jamf Protect alerts now have a status to help teams collaborate.
By default, any new alert will have a status of “New.” The status can be changed to “In Progress” or “Resolved” in both the alert detail view and in the alert list. Status can be assigned to alerts in bulk within the UI.
Any alerts logged as a result of a Threat Prevention policy will have a status of “Auto Resolved.”
Other UI changes - With all these new alert properties, a number of other areas of the UI were updated to take advantage of them:
- New detections dashboard
- New Computer view
- Action settings
- Data retention settings
A more detailed description of each of these changes can be found in our blog post.
