Sagan critical stable other

[JAMF-PROTECT] Process Monitoring Event Detected (medium)

[JAMF-PROTECT] Process Monitoring Event Detected (medium)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[JAMF-PROTECT] Process Monitoring Event Detected (medium)"; program:jamf_protect; json_content:".input.eventType","GPProcessEvent"; json_content:".input.match.severity","2"; parse_src_ip:1; reference:url,https://learn.jamf.com/bundle/jamf-protect-documentation/page/Analytic_Descriptions.html; reference:url,https://learn.jamf.com/bundle/jamf-protect-documentation/page/Telemetry_Log_Data_Examples.html; classtype:trojan-activity; sid:5014270; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...