[JAMF-PROTECT] High Severity File System Event Detected And Quarantined

alert any $HOME_NET any -> $HOME_NET any (msg:"[JAMF-PROTECT] High Severity File System Event Detected And Quarantined"; program:jamf_protect; json_content:".input.eventType","GPFSEvent"; json_content:".input.match.severity","3"; content:"threat_prevention_file_quarantine"; parse_src_ip:1; reference:url,https://learn.jamf.com/bundle/jamf-protect-documentation/page/Analytic_Descriptions.html; reference:url,https://learn.jamf.com/bundle/jamf-protect-documentation/page/Telemetry_Log_Data_Examples.html; classtype:trojan-activity; sid:5017455; rev:1;)