{ "name": "jamf_pro", "title": "Jamf Pro", "version": "1.2.0", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs and inventory data from Jamf Pro with Elastic Agent", "type": "integration", "download": "/epr/jamf_pro/jamf_pro-1.2.0.zip", "path": "/package/jamf_pro/1.2.0", "icons": [ { "src": "/img/logo.png", "path": "/package/jamf_pro/1.2.0/img/logo.png", "title": "Jamf Pro logo", "size": "128x128", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.15.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "cloud", "custom" ], "signature_path": "/epr/jamf_pro/jamf_pro-1.2.0.zip.sig", "format_version": "3.1.5", "readme": "/package/jamf_pro/1.2.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/image.png", "path": "/package/jamf_pro/1.2.0/img/image.png", "title": "Overview", "size": "3010x1764", "type": "image/png" }, { "src": "/img/image_1.png", "path": "/package/jamf_pro/1.2.0/img/image_1.png", "title": "Remote", "size": "3024x1402", "type": "image/png" }, { "src": "/img/image_2.png", "path": "/package/jamf_pro/1.2.0/img/image_2.png", "title": "Hardware", "size": "3018x1434", "type": "image/png" }, { "src": "/img/image_3.png", "path": "/package/jamf_pro/1.2.0/img/image_3.png", "title": "Map", "size": "3012x1360", "type": "image/png" }, { "src": "/img/jamf_pro_real_time_dashboard.png", "path": "/package/jamf_pro/1.2.0/img/jamf_pro_real_time_dashboard.png", "title": "Real time dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/jamf_pro/1.2.0/LICENSE.txt", "/package/jamf_pro/1.2.0/changelog.yml", "/package/jamf_pro/1.2.0/manifest.yml", "/package/jamf_pro/1.2.0/docs/README.md", "/package/jamf_pro/1.2.0/img/image.png", "/package/jamf_pro/1.2.0/img/image_1.png", "/package/jamf_pro/1.2.0/img/image_2.png", "/package/jamf_pro/1.2.0/img/image_3.png", "/package/jamf_pro/1.2.0/img/jamf_pro_real_time_dashboard.png", "/package/jamf_pro/1.2.0/img/logo.png", "/package/jamf_pro/1.2.0/data_stream/events/manifest.yml", "/package/jamf_pro/1.2.0/data_stream/events/sample_event.json", "/package/jamf_pro/1.2.0/data_stream/inventory/manifest.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/sample_event.json", "/package/jamf_pro/1.2.0/kibana/dashboard/jamf_pro-31386f22-bc6a-49da-8d55-ec33cb0ad728.json", "/package/jamf_pro/1.2.0/kibana/dashboard/jamf_pro-81cc13af-7134-45d3-b43f-d50f63071759.json", "/package/jamf_pro/1.2.0/kibana/dashboard/jamf_pro-90cf12f3-9a11-466b-8c28-5a07a85bc038.json", "/package/jamf_pro/1.2.0/kibana/dashboard/jamf_pro-a6cf6d1d-b2a7-4a59-9fdf-51d1c7b1706e.json", "/package/jamf_pro/1.2.0/kibana/dashboard/jamf_pro-dce729cf-07cc-4e62-a3e3-bc6e233c3ad1.json", "/package/jamf_pro/1.2.0/data_stream/events/fields/base-fields.yml", "/package/jamf_pro/1.2.0/data_stream/events/fields/ecs.yml", "/package/jamf_pro/1.2.0/data_stream/events/fields/fields.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/base-fields.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/ecs.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/fields-disk-encryption.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/fields-general.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/fields-operating-system.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/fields-purchasing.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/fields-user-and-location.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/fields.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/fields/fileds-hardware.yml", "/package/jamf_pro/1.2.0/data_stream/events/agent/stream/http_endpoint.yml.hbs", "/package/jamf_pro/1.2.0/data_stream/events/elasticsearch/ingest_pipeline/default.yml", "/package/jamf_pro/1.2.0/data_stream/inventory/agent/stream/cel.yml.hbs", "/package/jamf_pro/1.2.0/data_stream/inventory/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "general_settings", "title": "Jamf Pro settings", "description": "Jamf Pro related settings", "inputs": [ { "type": "cel", "vars": [ { "name": "api_host", "type": "text", "title": "Jamf Pro instance URL", "description": "Jamf Pro instance URL in the format `https://yourinstancename.jamfcloud.com`", "multi": false, "required": true, "show_user": false }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "Jamf Pro Client ID in the format `48e2543c-69c4-4333-b3af-345298187a35`", "multi": false, "required": true, "show_user": false }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "A secret code taken from Jamf Pro in the format `2BftX05NhhS21NXCvZlCvzCJTNM54xEgi8ixaaxC_GkND-8udzaz27kr1TuWeKzX`", "multi": false, "required": true, "show_user": false } ], "title": "Inventory Settings", "description": "Jamf Pro related settings" }, { "type": "http_endpoint", "vars": [ { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Events", "description": "Receiving Jamf Pro events." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "jamf_pro.events", "title": "Jamf Pro Events", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "http_endpoint", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for http endpoint connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "0.0.0.0" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number the listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9202 }, { "name": "url", "type": "text", "title": "URL", "description": "This option specifies which URL path to accept requests on. Defaults to /jamf-pro-events.", "multi": false, "required": false, "show_user": false, "default": "/jamf-pro-events" }, { "name": "secret_header", "type": "text", "title": "Secret Header", "description": "The header to check for a specific value specified by `secret.value`.", "multi": false, "required": false, "show_user": false }, { "name": "secret_value", "type": "password", "title": "Secret Value", "description": "The secret stored in the header name specified by `secret.header`.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "jamf_pro-events" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve custom fields for all ECS mappings.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "events", "description": "Catches jamf pro events via webhook\n", "enabled": true, "ingestion_method": "Webhook" } ], "package": "jamf_pro", "path": "events" }, { "type": "logs", "dataset": "jamf_pro.inventory", "title": "Inventory data", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval of fetching metrics, i.e. 1s/1m/1h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Inventory request page size", "description": "Set page size for computers-inventory API Call. Its value must be within the range of 2 to 1000.", "multi": false, "required": false, "show_user": false, "default": 100 }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original inventory data, added to the field `event.original`.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded" ] }, { "name": "enable_section_hardware", "type": "bool", "title": "Hardware", "description": "Enable Hardware block", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "enable_section_operating_system", "type": "bool", "title": "Operating System", "description": "Enable OperatingSystem sections", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "enable_section_user_and_location", "type": "bool", "title": "User and Location", "description": "Enable general information on users", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_disk_encryption", "type": "bool", "title": "Disk Encryption", "description": "Enable Disk Encryption section", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_purchasing", "type": "bool", "title": "Purchasing", "description": "Enable or disable purchasing settings", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_applications", "type": "bool", "title": "Applications", "description": "Enable applications list", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_storage", "type": "bool", "title": "Storage", "description": "Enable Storage section in request", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_configuration_profiles", "type": "bool", "title": "Configuration Profiles", "description": "Enable Configuration profiles retrieval", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_printers", "type": "bool", "title": "Printers", "description": "Enable printerSettings to control hardware access and usages information", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_security", "type": "bool", "title": "Security", "description": "Enable Security settings for the request", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_services", "type": "bool", "title": "Services", "description": "Enable Services section", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_local_user_accounts", "type": "bool", "title": "Local User Accounts", "description": "Enable Local Users section", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_certificates", "type": "bool", "title": "Certificates", "description": "Enable certificates retrieval", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_attachments", "type": "bool", "title": "Attachments", "description": "Enable Attachment block", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_plugins", "type": "bool", "title": "Plugins", "description": "Enable plugins retrieval", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_package_receipts", "type": "bool", "title": "Package Receipts", "description": "Enable Package Receipts block", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_fonts", "type": "bool", "title": "Fonts", "description": "Enable installed fonts data retrieval", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_licensed_software", "type": "bool", "title": "Licensed Software", "description": "Enable Licensed software block", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_ibeacons", "type": "bool", "title": "iBeacons", "description": "Enable iBeacons block", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_software_updates", "type": "bool", "title": "Software Updates", "description": "Enable SofwareUpdates block", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_extension_attributes", "type": "bool", "title": "Extension Attributes", "description": "Enable block with Extension Attributes", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_content_caching", "type": "bool", "title": "Content Caching", "description": "Enable Content Caching data retrieval", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "enable_section_group_memberships", "type": "bool", "title": "Group Membership", "description": "Enable Group membership data", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "cel.yml.hbs", "title": "Inventory data", "description": "Settings for inventory requests. \n*NOTE* Enabling many sections may impact query processing.\nIt is recommended to only enable sections of interest.\nThe General section is always included.\n", "enabled": true, "ingestion_method": "API" } ], "package": "jamf_pro", "path": "inventory" } ] }