Jamf Protect 로그 수집

다음에서 지원:

이 문서에서는 Google Security Operations 피드를 설정하여 Jamf Protect 로그를 수집하는 방법과 로그 필드가 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑되는 방식을 설명합니다. 또한 이 문서에는 지원되는 Jamf Protect 버전도 나와 있습니다.

자세한 내용은 Google Security Operations에 데이터 수집을 참조하세요.

일반적인 배포는 Google Security Operations에 로그를 전송하도록 구성된 Google Security Operations 피드와 Jamf Protect로 구성됩니다. 고객 배포마다 다를 수 있으며 더 복잡할 수도 있습니다.

배포에는 다음 구성요소가 포함됩니다.

  • Jamf Protect. 로그를 수집하는 Jamf Protect 플랫폼입니다.

  • Google Security Operations 피드. Jamf Protect에서 로그를 가져오고 로그를 Google Security Operations에 작성하는 Google Security Operations 피드입니다.

  • Google Security Operations. Google Security Operations는 Jamf Protect의 로그를 보관하고 분석합니다.

수집 라벨은 원시 로그 데이터를 구조화된 UDM 형식으로 정규화하는 파서를 식별합니다. 이 문서의 정보는 JAMF_PROTECT 수집 라벨이 있는 파서에 적용됩니다.

시작하기 전에

  • Jamf Protect 버전 4.0.0 이상을 사용하는지 확인합니다.
  • 배포 아키텍처의 모든 시스템이 UTC 시간대로 구성되었는지 확인합니다.

Jamf Protect 로그를 수집하도록 Google Security Operations에서 피드 구성

Amazon S3 또는 웹훅을 사용하여 Google Security Operations에서 수집 피드를 설정할 수 있지만 Amazon S3를 사용하는 것이 좋습니다.

Amazon S3를 사용하여 수집 피드 설정

  1. Google Security Operations 메뉴에서 설정을 선택한 후 피드를 클릭합니다.
  2. 새 항목 추가를 클릭합니다.
  3. 소스 유형으로 Amazon S3를 선택합니다.
  4. Jamf Protect의 피드를 만들려면 로그 유형으로 Jamf Protect 알림을 선택합니다.
  5. 다음을 클릭합니다.
  6. 피드를 저장한 후 제출합니다.
  7. Jamf Protect에서 사용할 피드 이름에서 피드 ID를 복사합니다.

웹훅을 사용하여 수집 피드 설정

  1. Google Security Operations 메뉴에서 설정을 선택한 후 피드를 클릭합니다.
  2. 새로 추가를 클릭합니다.
  3. 피드 이름 필드에 피드 이름을 입력합니다.
  4. 소스 유형 목록에서 웹훅을 선택합니다.
  5. Jamf Protect의 피드를 만들려면 로그 유형으로 Jamf Protect 알림을 선택합니다.
  6. 다음을 클릭합니다.
  7. 선택사항: 다음 입력 파라미터의 값을 지정합니다.
    • 분할 구분 기호: 로그 줄을 구분하는 데 사용되는 구분 기호입니다(예: \n).
    • 애셋 네임스페이스: 애셋 네임스페이스입니다.
    • 수집 라벨: 이 피드의 이벤트에 적용할 라벨입니다.
  8. 다음을 클릭합니다.
  9. 확정 화면에서 새 피드 구성을 검토한 다음 제출을 클릭합니다.
  10. 보안 비밀 키 생성을 클릭하여 이 피드를 인증하기 위한 보안 비밀 키를 생성합니다.
  11. 이 보안 비밀을 다시 볼 수 없으므로 보안 비밀 키를 복사하여 저장합니다. 새 보안 비밀 키를 다시 생성할 수 있지만 보안 비밀 키를 다시 생성하면 이전 보안 비밀 키는 더 이상 사용할 수 없게 됩니다.
  12. 세부정보 탭의 엔드포인트 정보 필드에서 피드 엔드포인트 URL을 복사합니다. Jamf Protect 알림 애플리케이션에서 이 엔드포인트 URL을 지정해야 합니다.
  13. 완료를 클릭합니다.
  14. Jamf Protect에서 엔드포인트 URL을 지정합니다.

Google Security Operations 피드에 대한 자세한 내용은 Google Security Operations 피드 문서를 참조하세요. 각 피드 유형의 요구사항은 유형별 피드 구성을 참조하세요.

피드를 만들 때 문제가 발생하면 Google Security Operations 지원팀에 문의하세요.

지원되는 Jamf Protect 로그 유형

다음 표에는 Jamf Protect 파서에서 지원하는 로그 유형이 나와 있습니다.

이벤트 유형 표시 이름
GPClickEvent 합성 클릭 이벤트
GPDownloadEvent 다운로드 이벤트
GPFSEvent 파일 시스템 이벤트
GPGatekeeperEvent 게이트키퍼 이벤트
GPKeylogRegisterEvent 키로거 이벤트
GPMRTEvent 모니터링 이벤트
GPPreventedExecutionEvent 커스텀 방지 목록 이벤트
GPProcessEvent 처리 이벤트
GPThreatMatchExecEvent 위협 방지 이벤트
GPUSBEvent USB 이벤트
GPUnifiedLogEvent 통합 로그 이벤트
Auth-mount 기기 제어 이벤트

필드 매핑 참조

이 섹션에서는 Google Security Operations 파서에서 Jamf Protect 필드를 Google Security Operations 통합 데이터 모델(UDM) 필드에 매핑하는 방법을 설명합니다.

필드 매핑 참조: 이벤트 식별자에서 이벤트 유형으로

다음 표에는 JAMF_PROTECT 로그 유형과 해당 UDM 이벤트 유형이 나와 있습니다.

Event Identifier Event Type
GPClickEvent SCAN_UNCATEGORIZED
GPDownloadEvent SCAN_FILE
GPFSEvent SCAN_FILE
GPGatekeeperEvent SCAN_UNCATEGORIZED
GPKeylogRegisterEvent SCAN_UNCATEGORIZED
GPMRTEvent SCAN_UNCATEGORIZED
GPPreventedExecutionEvent SCAN_UNCATEGORIZED
GPProcessEvent SCAN_PROCESS
GPThreatMatchExecEvent SCAN_UNCATEGORIZED
GPUSBEvent SCAN_UNCATEGORIZED
GPUnifiedLogEvent SCAN_UNCATEGORIZED
Auth-mount SCAN_UNCATEGORIZED

필드 매핑 참조: JAMF_PROTECT

다음 표에는 JAMF_PROTECT 로그 유형의 로그 필드와 해당 UDM 필드가 나와 있습니다.
Log field UDM mapping Logic
about.platform The about.platform UDM field is set to MAC.
caid about.labels[caid] (deprecated)
caid additional.fields[caid]
certid principal.asset.attribute.labels [certid]
context.identity.claims.certid principal.user.attribute.permissions.description
context.identity.claims.clientid principal.user.attribute.labels [context_identity_claims_clientid]
input.eventType metadata.product_event_type
input.host.hostname principal.hostname
input.host.ips principal.ip
input.host.provisioningUDID principal.asset.product_object_id
input.host.serial principal.asset.hardware.serial_number
input.match.actions.name security_result.outcomes [input_match_actions_name]
input.match.actions.parameters.message security_result.summary If the index value is equal to 0, then the input.match.actions.parameters.message log field is mapped to the security_result.summary UDM field.

Else, the input.match.actions.parameters.message log field is mapped to the security_result.detection_fields.value UDM field.
input.match.actions.parameters.title security_result.description If the index value is equal to 0, then the input.match.actions.parameters.title log field is mapped to the security_result.description UDM field.

Else, the input.match.actions.parameters.title log field is mapped to the security_result.detection_fields.value UDM field.
input.match.context.name security_result.detection_fields.key
input.match.context.value security_result.detection_fields.value [Name]
input.match.context.valueType
input.match.custom security_result.detection_fields [input_match_custom]
input.match.event.blocked security_result.action If the input.match.event.blocked log field value is not empty, then the security_result.action UDM field is set to BLOCK.
context.identity.claims.hd, input.match.uuid security_result.url_back_to_product The security_result.url_back_to_product UDM field is set to https://context.identity.claims.hd.jamfcloud.com/Alerts/input.match.uuid.
input.match.event.category security_result.category_details
input.match.event.clickType principal.labels[input_match_event_click_type] (deprecated) If the input.match.event.clickType log field value is equal to 0, then the principal.labels.value UDM field is set to 0 - Other.

Else, if the input.match.event.clickType log field value is equal to 1, then the principal.labels.value UDM field is set to 1 - Left Down.

Else, if the input.match.event.clickType log field value is equal to 2, then the principal.labels.value UDM field is set to 2 - Left Up.

Else, if the input.match.event.clickType log field value is equal to 3, then the principal.labels.value UDM field is set to 3 - Right Down.

Else, if the input.match.event.clickType log field value is equal to 4, then the principal.labels.value UDM field is set to 4 - Right Up.
input.match.event.clickType additional.fields[input_match_event_click_type] If the input.match.event.clickType log field value is equal to 0, then the additional.fields.value.string_value UDM field is set to 0 - Other.

Else, if the input.match.event.clickType log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Left Down.

Else, if the input.match.event.clickType log field value is equal to 2, then the additional.fields.value.string_value UDM field is set to 2 - Left Up.

Else, if the input.match.event.clickType log field value is equal to 3, then the additional.fields.value.string_value UDM field is set to 3 - Right Down.

Else, if the input.match.event.clickType log field value is equal to 4, then the additional.fields.value.string_value UDM field is set to 4 - Right Up.
input.match.event.composedMessage principal.labels[input_match_event_composed_message] (deprecated)
input.match.event.composedMessage additional.fields[input_match_event_composed_message]
input.match.event.dev principal.labels[input_match_event_dev] (deprecated)
input.match.event.dev additional.fields[input_match_event_dev]
input.match.event.eventID principal.labels[input_match_event_eventID] (deprecated)
input.match.event.eventID additional.fields[input_match_event_eventID]
input.match.event.gid principal.user.group_identifiers
input.match.event.iNode target.file.stat_inode
input.match.event.matchType principal.labels[input_match_event_match_type] (deprecated)
input.match.event.matchType additional.fields[input_match_event_match_type]
input.match.event.matchValue security_result.threat_name If the input.match.event.matchType log field value is not empty, then the input.match.event.matchValue log field is mapped to the security_result.threat_name UDM field.
input.match.event.name about.labels[input_match_event_name] (deprecated)
input.match.event.name additional.fields[input_match_event_name]
input.match.facts.name metadata.description If the index value is equal to 0, then the input.match.facts.name log field is mapped to the metadata.description UDM field.
input.match.event.path target.process.file.full_path
input.match.event.pid principal.process.pid
input.match.event.prevFile src.file.full_path If the input.match.event.prevFile log field value is not empty, then the input.match.event.prevFile log field is mapped to the src.file.full_path UDM field.
input.match.event.process principal.process.file.names
input.match.event.process.args target.process.command_line_history
input.match.event.process.gid target.group.product_object_id
input.match.event.process.name target.process.file.names
input.match.event.process.originalParentPID target.process.parent_process.pid
input.match.event.process.path target.process.file.full_path
input.match.event.process.pgid target.labels[input_match_event_processes_pgid] (deprecated)
input.match.event.process.pgid additional.fields[input_match_event_processes_pgid]
input.match.event.process.pid target.process.pid
input.match.event.process.ppid target.labels[input_match_event_process_ppid] (deprecated)
input.match.event.process.ppid additional.fields[input_match_event_process_ppid]
input.match.event.process.responsiblePID target.labels[input_match_event_process_responsible_pid] (deprecated)
input.match.event.process.responsiblePID additional.fields[input_match_event_process_responsible_pid]
input.match.event.process.rgid target.labels[input_match_event_process_rgid] (deprecated)
input.match.event.process.rgid additional.fields[input_match_event_process_rgid]
input.match.event.process.ruid target.labels[input_match_event_process_ruid] (deprecated)
input.match.event.process.ruid additional.fields[input_match_event_process_ruid]
input.match.event.process.signingInfo.appid target.user.attribute.labels [input_match_event_process_sign_appid]
input.match.event.process.signingInfo.authorities target.user.attribute.permissions
input.match.event.process.signingInfo.cdhash target.user.attribute.labels [input_match_event_process_sign_cdhash]
input.match.event.process.signingInfo.entitlements target.user.attributes.permissions
input.match.event.process.signingInfo.signerType target.user.attribute.labels [input_match_event_process_sign_signer_type] If the input.related.process.signingInfo.signerType log field value is equal to 0, then the target.user.attribute.labels.value UDM field is set to 0 - Apple.

Else, if the input.related.process.signingInfo.signerType log field value is equal to 1, then the target.user.attribute.labels.value UDM field is set to 1 - App Store.

Else, if the input.related.process.signingInfo.signerType log field value is equal to 2, then the target.user.attribute.labels.value UDM field is set to 2 - Developer.

Else, if the input.related.process.signingInfo.signerType log field value is equal to 3, then the target.user.attribute.labels.value UDM field is set to 3 - Ad Hoc.

Else, if the input.related.process.signingInfo.signerType log field value is equal to 4, then the target.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.match.event.process.signingInfo.status target.user.attribute.labels [input_match_event_process_sign_status]
input.match.event.process.signingInfo.statusMessage target.labels[input_match_event_process_sign_status_message] (deprecated)
input.match.event.process.signingInfo.statusMessage additional.fields[input_match_event_process_sign_status_message]
input.match.event.process.signingInfo.teamid target.user.group_identifiers
input.match.event.process.startTimestamp target.labels[input_match_event_process_start_time_stamp] (deprecated)
input.match.event.process.startTimestamp additional.fields[input_match_event_process_start_time_stamp]
input.match.event.process.uid target.labels[input_match_event_process_uid] (deprecated)
input.match.event.process.uid additional.fields[input_match_event_process_uid]
input.match.event.process.uuid target.process.product_specific_process_id The Process Uuid: input.match.event.process.uuid log field is mapped to the target.process.product_specific_process_id UDM field.
input.match.event.processIdentifier target.process.pid
input.match.event.processImagePath target.process.file.full_path
input.match.event.rateLimitingSecs principal.labels[input_match_event_rate_limiting_secs] (deprecated)
input.match.event.rateLimitingSecs additional.fields[input_match_event_rate_limiting_secs]
input.match.event.scriptPath principal.labels[input_match_event_script_path] (deprecated)
input.match.event.scriptPath additional.fields[input_match_event_script_path]
input.match.event.sender principal.labels[input_match_event_sender] (deprecated)
input.match.event.sender additional.fields[input_match_event_sender]
input.match.event.senderImagePath principal.labels[input_match_event_sender_image_path] (deprecated)
input.match.event.senderImagePath additional.fields[input_match_event_sender_image_path]
input.match.event.subsystem principal.labels[input_match_event_subsystem] (deprecated)
input.match.event.subsystem additional.fields[input_match_event_subsystem]
input.match.event.subType principal.labels[input_match_event_sub_type] (deprecated) If the input.match.event.subType log field value is equal to 7, then the principal.labels.value UDM field is set to 7 - Exec.

Else, if the input.match.event.subType log field value is equal to 2, then the principal.labels.value UDM field is set to 2 - Fork.

Else, if the input.match.event.subType log field value is equal to 1, then the principal.labels.value UDM field is set to 1 - Exit.

Else, if the input.match.event.subType log field value is equal to 23, then the principal.labels.value UDM field is set to 23 - Execve.

Else, if the input.match.event.subType log field value is equal to 43190, then the principal.labels.value UDM field is set to 43190 - Posix Spawn.
input.match.event.subType additional.fields[input_match_event_sub_type] If the input.match.event.subType log field value is equal to 7, then the additional.fields.value.string_value UDM field is set to 7 - Exec.

Else, if the input.match.event.subType log field value is equal to 2, then the additional.fields.value.string_value UDM field is set to 2 - Fork.

Else, if the input.match.event.subType log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Exit.

Else, if the input.match.event.subType log field value is equal to 23, then the additional.fields.value.string_value UDM field is set to 23 - Execve.

Else, if the input.match.event.subType log field value is equal to 43190, then the additional.fields.value.string_value UDM field is set to 43190 - Posix Spawn.
input.match.event.tags security_result.rule_labels [input_match_event_tags]
input.match.event.targetpid target.process.pid
input.match.event.timestamp metadata.event_timestamp
input.match.event.type target.labels[input_match_event_type] (deprecated) If the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 0, then the target.labels.value UDM field is set to 0 - Created.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 1, then the target.labels.value UDM field is set to 1 - Deleted.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 3, then the target.labels.value UDM field is set to 3 - Renamed.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 4, then the target.labels.value UDM field is set to 4 - Modified.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 7, then the target.labels.value UDM field is set to 7 - Created Dir.

Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 0, then the target.labels.value UDM field is set to 0 - None.

Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 1, then the target.labels.value UDM field is set to 1 - Create.

Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 2, then the target.labels.value UDM field is set to 0 - Exit.
input.match.event.type additional.fields[input_match_event_type] If the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 0, then the additional.fields.value.string_value UDM field is set to 0 - Created.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Deleted.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 3, then the additional.fields.value.string_value UDM field is set to 3 - Renamed.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 4, then the additional.fields.value.string_value UDM field is set to 4 - Modified.

Else, if the input.eventType log field value is equal to GPFSEvent and the input.match.event.type log field value is equal to 7, then the additional.fields.value.string_value UDM field is set to 7 - Created Dir.

Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 0, then the additional.fields.value.string_value UDM field is set to 0 - None.

Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 1, then the additional.fields.value.string_value UDM field is set to 1 - Create.

Else, if the input.eventType log field value is equal to GPProcessEvent and the input.match.event.type log field value is equal to 2, then the additional.fields.value.string_value UDM field is set to 0 - Exit.
input.match.event.uid principal.user.userid
input.match.event.uuid about.labels[input_match_event_uuid] (deprecated)
input.match.event.uuid additional.fields[input_match_event_uuid]
input.match.facts.actions.name security_result.action_details If the index value is equal to 0, then the input.match.facts.actions.name log field is mapped to the security_result.action_details UDM field.

Else, the input.match.facts.actions.name log field is mapped to the security_result.about.labels.value UDM field.
input.match.facts.actions.parameters.id security_result.detection_fields [input_match_facts_actions_parameters_id]
input.match.facts.actions.parameters.message security_result.detection_fields [input_match_facts_actions_parameters_message]
input.match.facts.actions.parameters.title security_result.detection_fields [input_match_facts_actions_parameters_title]
input.match.facts.context.name security_result.detection_fields.key
input.match.facts.context.value security_result.detection_fields.value [Name]
input.match.facts.context.valueType
input.match.facts.human security_result.action If the input.match.facts.human log field value is matched with regex (?i)blocked, then the security_result.action UDM field is set to BLOCK.
input.match.facts.human security_result.description If the index value is equal to 0, then the input.match.facts.human log field is mapped to the security_result.description UDM field.

Else, the input.match.facts.human log field is mapped to the security_result.detection_fields.value UDM field.
input.match.facts.name security_result.summary If the index value is equal to 0, then the input.match.facts.name log field is mapped to the security_result.summary UDM field.

Else, the input.match.facts.name log field is mapped to the security_result.detection_fields.value UDM field.
input.match.facts.severity security_result.detection_fields [input_match_facts_severity]
input.match.facts.tags security_result.rule_labels [input_match_facts_tags]
input.match.facts.uuid about.labels [input_match_facts_uuid]
input.match.facts.version about.labels [input_match_facts_version]
input.match.severity security_result.severity If the severity log field value is equal to 0, then the security_result.severity UDM field is set to INFORMATIONAL.

Else, if the severity log field value is equal to 1, then the security_result.severity UDM field is set to LOW.

Else, if the severity log field value is equal to 2, then the security_result.severity UDM field is set to MEDIUM.

Else, if the severity log field value is equal to 3, then the security_result.severity UDM field is set to HIGH.
input.match.tags security_result.rule_labels [input_match_tags]
input.match.uuid metadata.product_log_id
input.related.binaries.accessed security_result.about.labels [input_related_binaries_accessed]
input.related.binaries.changed security_result.about.labels [input_related_binaries_changed]
input.related.binaries.created security_result.about.file.first_seen_time If the index value is equal to 0, then the input.related.binaries.created log field is mapped to the security_result.about.file.first_seen_time UDM field.

Else, the input.related.binaries.created log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.fsid security_result.about.labels [input_related_binaries_fsid]
input.related.binaries.gid security_result.about.labels [input_related_binaries_gid]
input.related.binaries.inode security_result.about.file.stat_inode If the index value is equal to 0, then the input.related.binaries.inode log field is mapped to the security_result.about.file.stat_inode UDM field.

Else, the input.related.binaries.inode log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.isAppBundle security_result.about.labels [isAppBundle]
input.related.binaries.isDirectory security_result.about.labels [isDirectory]
input.related.binaries.isDownload security_result.about.labels [isDownload]
input.related.binaries.isScreenShot security_result.about.labels [isScreenShot]
input.related.binaries.mode security_result.about.file.stat_mode If the index value is equal to 0, then the input.related.binaries.mode log field is mapped to the security_result.about.file.stat_mode UDM field.

Else, the input.related.binaries.mode log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.modified security_result.about.file.last_modification_time If the index value is equal to 0, then the input.related.binaries.modified log field is mapped to the security_result.about.file.last_modification_time UDM field.

Else, the input.related.binaries.modified log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.path security_result.about.file.full_path If the index value is equal to 0, then the input.related.binaries.path log field is mapped to the security_result.about.file.full_path UDM field.

Else, the input.related.binaries.path log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.sha1hex security_result.about.file.sha1 If the index value is equal to 0, then the input.related.binaries.sha1hex log field is mapped to the security_result.about.file.sha1 UDM field.

Else, the input.related.binaries.sha1hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.sha256hex security_result.about.file.sha256 If the index value is equal to 0, then the input.related.binaries.sha256hex log field is mapped to the security_result.about.file.sha256 UDM field.

Else, the input.related.binaries.sha256hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.signingInfo.appid security_result.about.application If the index value is equal to 0, then the input.related.binaries.signingInfo.appid log field is mapped to the security_result.about.application UDM field.

Else, the input.related.binaries.signingInfo.appid log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.signingInfo.authorities security_result.about.user.attribute.permissions
input.related.binaries.signingInfo.cdhash security_result.about.labels [input_related_binaries_sign_cdhash]
input.related.binaries.signingInfo.entitlements security_result.about.user.attribute.permisisons
input.related.binaries.signingInfo.signerType security_result.about.user.attribute.labels [input_related_binaries_sign_signer_type] If the input.related.binaries.signingInfo.signerType log field value is equal to 0, then the security_result.about.user.attribute.labels.value UDM field is set to 0 - Apple.

Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 1, then the security_result.about.user.attribute.labels.value UDM field is set to 1 - App Store.

Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 2, then the security_result.about.user.attribute.labels.value UDM field is set to 2 - Developer.

Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 3, then the security_result.about.user.attribute.labels.value UDM field is set to 3 - Ad Hoc.

Else, if the input.related.binaries.signingInfo.signerType log field value is equal to 4, then the security_result.about.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.related.binaries.signingInfo.status security_result.about.user.attribute.labels [input_related_binaries_sign_status]
input.related.binaries.signingInfo.statusMessage security_result.about.user.attribute.labels [input_related_processes_sign_status_message]
input.related.binaries.signingInfo.teamid security_result.about.user.group_identifiers If the index value is equal to 0, then the input.related.binaries.signingInfo.teamid log field is mapped to the security_result.about.user.group_identifiers UDM field.

Else, the input.related.binaries.signingInfo.teamid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.binaries.size security_result.about.file.size If the index value is equal to 0, then the input.related.binaries.size log field is mapped to the security_result.about.file.size UDM field.

Else, the input.related.binaries.size log field is mapped to the security_result.about.labels.value UDM field.
input.related.binaries.uid security_result.about.user.userid If the index value is equal to 0, then the input.related.binaries.uid log field is mapped to the security_result.about.user.userid UDM field.

Else, the input.related.binaries.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.binaries.xattrs security_result.about.user.attribute.labels [input_related_binaries_xattrs]
input.related.files.accessed security_result.about.labels [input_related_files_accessed]
input.related.files.changed security_result.about.labels [input_related_files_changed]
input.related.files.created security_result.about.labels [input_related_files_created]
input.related.files.downloadedFrom security_result.about.labels [input_related_files_downloaded_from]
input.related.files.fsid security_result.about.labels [input_related_files_downloaded_fsid]
input.related.files.gid security_result.about.group.product_object_id If the index value is equal to 0, then the input.related.files.gid log field is mapped to the security_result.about.group.product_object_id UDM field.

Else, the input.related.files.gid log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.inode security_result.about.file.stat_inode If the index value is equal to 0, then the input.related.files.inode log field is mapped to the security_result.about.file.stat_inode UDM field.

Else, the input.related.files.inode log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.isAppBundle security_result.about.labels [input_related_files_downloaded_is_app_bundle]
input.related.files.isDirectory security_result.about.labels [input_related_files_is_directory]
input.related.files.isDownload security_result.about.labels [input_related_files_is_download]
input.related.files.isScreenShot security_result.about.labels [input_related_files_is_screenshot]
input.related.files.mode security_result.about.file.stat_mode If the index value is equal to 0, then the input.related.files.mode log field is mapped to the security_result.about.file.stat_mode UDM field.

Else, the input.related.files.mode log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.modified security_result.about.file.last_modification_time If the index value is equal to 0, then the input.related.files.modified log field is mapped to the security_result.about.file.last_modification_time UDM field.

Else, the input.related.files.modified log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.path security_result.about.file.full_path If the index value is equal to 0, then the input.related.files.path log field is mapped to the security_result.about.file.full_path UDM field.

Else, the input.related.files.path log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.sha1hex security_result.about.file.sha1 If the index value is equal to 0, then the input.related.files.sha1hex log field is mapped to the security_result.about.file.sha1 UDM field.

Else, the input.related.files.sha1hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.sha256hex security_result.about.file.sha256 If the index value is equal to 0, then the input.related.files.sha256hex log field is mapped to the security_result.about.file.sha256 UDM field.

Else, the input.related.files.sha256hex log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.signingInfo.appid security_result.about.application If the index value is equal to 0, then the input.related.files.signingInfo.appid log field is mapped to the security_result.about.application UDM field.

Else, the input.related.files.signingInfo.appid log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.signingInfo.authorities security_result.about.user.attribute.permissions
input.related.files.signingInfo.cdhash security_result.about.labels [[input_related_files_sign_cdhash]
input.related.files.signingInfo.entitlements security_result.about.user.attribute.permissions
input.related.files.signingInfo.signerType security_result.about.user.attribute.labels [input_related_files_signing_info_signer_type] If the input.related.files.signingInfo.signerType log field value is equal to 0, then the security_result.about.user.attribute.labels.value UDM field is set to 0 - Apple.

Else, if the input.related.files.signingInfo.signerType log field value is equal to 1, then the security_result.about.user.attribute.labels.value UDM field is set to 1 - App Store.

Else, if the input.related.files.signingInfo.signerType log field value is equal to 2, then the security_result.about.user.attribute.labels.value UDM field is set to 2 - Developer.

Else, if the input.related.files.signingInfo.signerType log field value is equal to 3, then the security_result.about.user.attribute.labels.value UDM field is set to 3 - Ad Hoc.

Else, if the input.related.files.signingInfo.signerType log field value is equal to 4, then the security_result.about.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.related.files.signingInfo.status security_result.about.user.attribute.labels [input_related_files_signing_info_status]
input.related.files.signingInfo.statusMessage security_result.about.user.attribute.labels [input_related_files_signing_info_status_message]
input.related.files.signingInfo.teamid security_result.about.user.group_identifiers If the index value is equal to 0, then the input.related.files.signingInfo.teamid log field is mapped to the security_result.about.user.group_identifiers UDM field.

Else, the input.related.files.signingInfo.teamid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.files.size security_result.about.file.size If the index value is equal to 0, then if the input.related.files.size log field value is not equal to 0, then the input.related.files.size log field is mapped to the security_result.about.file.size UDM field.

Else, the input.related.files.size log field is mapped to the security_result.about.labels.value UDM field.
input.related.files.uid security_result.about.user.userid If the index value is equal to 0, then the input.related.files.uid log field is mapped to the security_result.about.user.userid UDM field.

Else, the input.related.files.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.files.xattrs security_result.about.labels [input_related_files_xattrs]
input.related.groups.gid security_result.about.group.attribute.labels [input_related_groups_gid]
input.related.groups.name security_result.about.group.group_display_name If the index value is equal to 0, then the input.related.groups.name log field is mapped to the security_result.about.group.group_display_name UDM field.

Else, the input.related.groups.name log field is mapped to the security_result.about.group.attribute.labels.value UDM field.
input.related.groups.uuid security_result.about.group.product_object_id If the index value is equal to 0, then the input.related.groups.uuid log field is mapped to the security_result.about.group.product_object_id UDM field.

Else, the input.related.groups.uuid log field is mapped to the security_result.about.group.attribute.labels.value UDM field.
input.related.processes.appPath security_result.about.labels [input_related_processes_app_path]
input.related.processes.args security_result.about.process.command_line_history
input.related.processes.exitCode security_result.about.labels [input_related_processes_exit_code]
input.related.processes.gid security_result.about.group.product_object_id If the index value is equal to 0, then the input.related.processes.gid log field is mapped to the security_result.about.group.product_object_id UDM field.

Else, the input.related.processes.gid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.name security_result.about.process.file.names
input.related.processes.originalParentPID security_result.about.process.parent_process.pid If the index value is equal to 0, then the input.related.processes.originalParentPID log field is mapped to the security_result.about.process.parent_process.pid UDM field.

Else, the input.related.processes.originalParentPID log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.path security_result.about.process.file.full_path If the index value is equal to 0, then the input.related.processes.path log field is mapped to the security_result.about.process.file.full_path UDM field.

Else, the input.related.processes.path log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.pgid security_result.about.labels [input_related_process_pgid]
input.related.processes.pid security_result.about.process.pid If the index value is equal to 0, then the input.related.processes.pid log field is mapped to the security_result.about.process.pid UDM field.

Else, the input.related.processes.pid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.ppid security_result.about.labels [input_related_processes_ppid]
input.related.processes.responsiblePID security_result.about.labels [input_related_processes_responsible_pid]
input.related.processes.rgid security_result.about.labels [input_related_processes_rgid]
input.related.processes.ruid security_result.about.labels [input_related_processes_ruid]
input.related.processes.signingInfo.appid security_result.about.application If the index value is equal to 0, then the input.related.processes.signingInfo.appid log field is mapped to the security_result.about.application UDM field.

Else, the input.related.processes.signingInfo.appid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.signingInfo.authorities security_result.about.user.attributes.permission
input.related.processes.signingInfo.cdhash security_result.about.user.attribute.labels [input_related_processes_sign_cdhash]
input.related.processes.signingInfo.entitlements security_result.about.user.attributes.permission
input.related.processes.signingInfo.signerType security_result.about.user.attribute.labels [input_related_processes_sign_signer_type] If the input.related.processes.signingInfo.signerType log field value is equal to 0, then the security_result.about.user.attribute.labels.value UDM field is set to 0 - Apple.

Else, if the input.related.processes.signingInfo.signerType log field value is equal to 1, then the security_result.about.user.attribute.labels.value UDM field is set to 1 - App Store.

Else, if the input.related.processes.signingInfo.signerType log field value is equal to 2, then the security_result.about.user.attribute.labels.value UDM field is set to 2 - Developer.

Else, if the input.related.processes.signingInfo.signerType log field value is equal to 3, then the security_result.about.user.attribute.labels.value UDM field is set to 3 - Ad Hoc.

Else, if the input.related.processes .signingInfo.signerType log field value is equal to 4, then the security_result.about.user.attribute.labels.value UDM field is set to 4 - Unsigned.
input.related.processes.signingInfo.status security_result.about.user.attribute.labels [input_related_processes_sign_status]
input.related.processes.signingInfo.statusMessage security_result.about.user.attribute.labels [input_related_processes_sign_status_message]
input.related.processes.signingInfo.teamid security_result.about.user.group_identifiers If the index value is equal to 0, then the input.related.processes.signingInfo.teamid log field is mapped to the security_result.about.user.group_identifiers UDM field.

Else, the input.related.processes.signingInfo.teamid log field is mapped to the security_result.about.labels.value UDM field.
input.related.processes.startTimestamp security_result.about.labels [input_related_processes_start_time_stamp]
input.related.processes.tty security_result.about.labels [input_related_processes_tty]
input.related.processes.uid security_result.about.user.userid If the index value is equal to 0, then the input.related.processes.uid log field is mapped to the security_result.about.user.userid UDM field.

Else, the input.related.processes.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.processes.uuid security_result.about.process.product_specific_process_id If the index value is equal to 0, then the Process Uuid: input.related.processes.uuid log field is mapped to the security_result.about.process.product_specific_process_id UDM field.

Else, the input.related.processes.uuid log field is mapped to the security_result.about.labels.value UDM field.
input.related.users.name security_result.about.user.user_display_name If the index value is equal to 0, then the input.related.users.name log field is mapped to the security_result.about.user.user_display_name UDM field.

Else, the input.related.users.name log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.users.uid security_result.about.user.userid If the index value is equal to 0, then the input.related.users.uid log field is mapped to the security_result.about.user.userid UDM field.

Else, the input.related.users.uid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
input.related.users.uuid security_result.about.user.product_object_id If the index value is equal to 0, then the input.related.users.uuid log field is mapped to the security_result.about.user.product_object_id UDM field.

Else, the input.related.users.uuid log field is mapped to the security_result.about.user.attribute.labels.value UDM field.
key about.labels[key] (deprecated)
key additional.fields[key]
path target.file.full_path If the index value is equal to 0, then the path log field is mapped to the target.file.full_path UDM field.

Else, the path log field is mapped to the target.labels.value UDM field.
queue principal.labels[queue] (deprecated)
queue additional.fields[queue]
region principal.location.name
timestamp metadata.creation_timestamp
topic about.labels[topic] (deprecated)
topic additional.fields[topic]
topicType about.labels[topicType] (deprecated)
topicType additional.fields[topicType]
version metadata.product_version
is_alert The is_alert UDM field is set to TRUE.
is_significant The is_significant UDM field is set to TRUE.
input.eventType metadata.event_type
metadata.product_name The metadata.product_name UDM field is set to JAMF_PROTECT.
metadata.vendor_name The metadata.vendor_name UDM field is set to JAMF.
principal.resource.resource_type The principal.resource.resource_type UDM field is set to STORAGE_BUCKET.
target.resource.resource_type The target.resource.resource_type UDM field is set to STORAGE_BUCKET.
input.match.event.options about.labels[input_match_event_options] (deprecated)
input.match.event.options additional.fields[input_match_event_options]
input.match.event.sourcePID principal.process.pid
input.match.event.destinationPID target.process.pid
image.match.event.detection security_result.detection_fields [image_match_event_detection]
input.match.type target.asset.attribute.labels [input_match_type] If the input.match.type log field value is equal to 0, then the target.asset.attribute.labels.value UDM field is set to 0 - Device Inserted.

Else, if the input.match.type log field value is equal to 1, then the target.asset.attribute.labels.value UDM field is set to 1 - Device Removed.
input.match.usbAddress target.asset.attribute.labels [input_match_usb_address]
input.match.event.device.mediaPath target.asset.attribute.labels [input_match_device_media_path]
input.match.event.device.protocol target.asset.attribute.labels [input_match_device_protocol]
input.match.event.device.deviceModel target.asset.hardware.model
input.match.event.device.isRemovable target.asset.attribute.labels [input_match_device_is_removable]
input.match.event.device.mediaName target.asset.attribute.labels [input_match_device_media_name]
input.match.event.device.bsdMinor target.asset.attribute.labels [input_match_device_bsd_minor]
input.match.event.device.vendorName target.asset.software.vendor_name
input.match.event.device.isWhole target.asset.attribute.labels [input_match_device_is_whole]
input.match.event.device.unit target.asset.attribute.labels [input_match_device_unit]
input.match.event.device.deviceSubclass target.asset.attribute.labels [input_match_device_subclass]
input.match.event.device.serialNumber target.asset.hardware.serial
input.match.event.device.bsdUnit target.asset.attribute.labels [input_match_device_bsd_unit]
input.match.event.device.busPath target.asset.attribute.labels [input_match_device_bus_path]
input.match.event.device.isLeaf target.asset.attribute.labels [input_match_device_is_leaf]
input.match.event.device.isInternal target.asset.attribute.labels [input_match_device_is_internal]
input.match.event.device.busName target.asset.attribute.labels [input_match_device_bus_name]
input.match.event.device.bsdMajor target.asset.attribute.labels [input_match_device_bsd_major]
input.match.event.device.isEjectable target.asset.attribute.labels [input_match_device_is_ejectable]
input.match.event.device.isEncrypted target.asset.attribute.labels [input_match_device_is_encrypted]
input.match.event.device.isEncryptable target.asset.attribute.labels [input_match_device_is_encryptable]
input.match.event.device.devicePath target.asset.attribute.labels [input_match_device_path]
input.match.event.device.bsdName target.asset.attribute.labels [input_match_device_bsd_name]
input.match.event.device.vendorId target.asset.attribute.labels [input_match_device_vendor_id]
input.match.event.device.content target.asset.attribute.labels [input_match_device_content]
input.match.event.device.revision target.asset.attribute.labels [input_match_device_revision]
input.match.event.device.size target.asset.attribute.labels [input_match_device_size]
input.match.event.device.isNetworkVolume target.asset.attribute.labels [input_match_device_is_network_volume]
input.match.event.device.blocksize target.asset.attribute.labels [input_match_device_block_size]
input.match.event.device.productName target.asset.attribute.labels [input_match_device_product_name]
input.match.event.device.mediaKind target.asset.attribute.labels [input_match_device_media_kind]
input.match.event.device.isWritable target.asset.attribute.labels [input_match_device_is_writable]
input.match.event.device.productId target.asset.product_object_id
input.match.event.device.productId target.asset.asset_id The Asset Id: input.match.event.device.productId log field is mapped to the target.asset.asset_id UDM field.
input.match.event.device.deviceClass target.asset.category
input.match.event.device.encryptionDetail target.asset.attribute.labels [input_match_device_encryption_detail]
input.match.event.device.volumeKind target.asset.attribute.labels [input_match_event_device_volume_kind]
input.match.event.device.volumeName target.asset.attribute.labels [input_match_event_device_volume_name]
input.match.event.device.volumeType target.asset.attribute.labels [input_match_event_device_volume_type]
input.match.event.device.isMountable target.asset.attribute.labels [input_match_event_device_is_mountable]
input.match.event.device.encryptionDetail target.asset.attribute.labels [input_match_event_device_encryption_detail]
input.match.event.fsid principal.labels [input_match_event_fsid]
input.match.event.bfree principal.labels[input_match_event_bfree] (deprecated)
input.match.event.bfree additional.fields[input_match_event_bfree]
input.match.event.bsize principal.labels[input_match_event_bsize] (deprecated)
input.match.event.bsize additional.fields[input_match_event_bsize]
input.match.event.ffree principal.labels[input_match_event_ffree] (deprecated)
input.match.event.ffree additional.fields[input_match_event_ffree]
input.match.event.files principal.labels[input_match_event_files] (deprecated)
input.match.event.files additional.fields[input_match_event_files]
input.match.event.flags principal.labels[input_match_event_flags] (deprecated)
input.match.event.flags additional.fields[input_match_event_flags]
input.match.event.owner principal.user.user_display_name
input.match.event.bavail principal.labels[input_match_event_bvail] (deprecated)
input.match.event.bavail additional.fields[input_match_event_bvail]
input.match.event.blocks principal.labels[input_match_event_blocks] (deprecated)
input.match.event.blocks additional.fields[input_match_event_blocks]
input.match.event.iosize principal.labels[input_match_event_iosize] (deprecated)
input.match.event.iosize additional.fields[input_match_event_iosize]
input.match.event.version principal.labels[input_match_event_version] (deprecated)
input.match.event.version additional.fields[input_match_event_version]
input.match.event.deadline principal.labels[input_match_event_deadline] (deprecated)
input.match.event.deadline additional.fields[input_match_event_deadline]
input.match.event.flagsExt principal.labels[input_match_event_flags_ext] (deprecated)
input.match.event.flagsExt additional.fields[input_match_event_flags_ext]
input.match.event.fsSubType principal.labels[input_match_event_fs_subtype] (deprecated)
input.match.event.fsSubType additional.fields[input_match_event_fs_subtype]
input.match.event.mntOnName principal.labels[input_match_event_mnt_on_name] (deprecated)
input.match.event.mntOnName additional.fields[input_match_event_mnt_on_name]
input.match.event.fsTypeName principal.labels[input_match_event_fs_type_name] (deprecated)
input.match.event.fsTypeName additional.fields[input_match_event_fs_type_name]
input.match.event.isReadOnly principal.labels[input_match_event_is_read_only] (deprecated)
input.match.event.isReadOnly additional.fields[input_match_event_is_read_only]
input.match.event.mntFromName principal.labels[input_match_event_mnt_from_name] (deprecated)
input.match.event.mntFromName additional.fields[input_match_event_mnt_from_name]
input.match.event.machTimestamp principal.labels[input_match_event_mach_timestamp] (deprecated)
input.match.event.machTimestamp additional.fields[input_match_event_mach_timestamp]
input.match.event.sequenceNumber principal.labels[input_match_event_seq_number] (deprecated)
input.match.event.sequenceNumber additional.fields[input_match_event_seq_number]
input.match.event.globalSequenceNumber principal.labels[input_match_event_global_seq_number] (deprecated)
input.match.event.globalSequenceNumber additional.fields[input_match_event_global_seq_number]

다음 단계