Sagan critical stable other

[JAMF-PROTECT] File System Event Detected (high)

[JAMF-PROTECT] File System Event Detected (high)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[JAMF-PROTECT] File System Event Detected (high)"; program:jamf_protect; json_content:".input.eventType","GPFSEvent"; json_content:".input.match.severity","3"; parse_src_ip:1; content:!"threat_prevention_file_quarantine"; reference:url,https://learn.jamf.com/bundle/jamf-protect-documentation/page/Analytic_Descriptions.html; reference:url,https://learn.jamf.com/bundle/jamf-protect-documentation/page/Telemetry_Log_Data_Examples.html; classtype:trojan-activity; sid:5014267; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...