Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleInformational

Jamf Protect - Network Threats

View on GitHub ↗Original file ↗

Description

'Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts.'
Rule type
NRT
Version
1.0.5
Declared status
Available

Declared MITRE coverage

InitialAccessT1133

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

JamfProtect

Data types

jamfprotect_CL

KQL query

Original query, unchanged.

JamfProtectThreatEvents
| where EventResult == "Blocked"
    and isnotempty(EventSeverity)
| extend Tactics = "Initial Access"
| extend Techniques = "T1566"

Declared entities

HostIPAccountURL

Related content

Links established from declared identifiers and solution manifests.

Solutions1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
44da53c3-f3b0-4b70-afff-f79275cb9442
Additional source files 2Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yamlsource ↗Solutions/Jamf Protect/Data/Solution_JamfProtect.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.