Description
If your organization uses Altair, you can run queries against Jamf Protect GraphQL API to get the most recent alerts from Jamf Protect. This is a simpler method to get a quick snapshot of recent activity compared to the script out on the Jamf Protect Github.
GraphQL Query
After following the Jamf documentation on setting up Altair for Jamf Protect, we can use this GraphQL query:
query listAlerts(
$min_severity: SEVERITY
$max_severity: SEVERITY
$page_size: Int
$next: String
) {
listAlerts(
input: {
filter: {
severity: { greaterThanOrEqual: $min_severity }
and: { severity: { lessThanOrEqual: $max_severity } }
}
pageSize: $page_size
next: $next
}
) {
items {
json
severity
computer {
hostName
}
created
}
pageInfo {
next
}
}
}At the bottom of the page in the variables section (you may need to drag the window upwards to see the option to input), we can paste in this JSON:
{
"min_severity":"Informational",
"max_severity":"Low",
"page_size":1
}
The variables can be adjusted to fit the needs of your environment. The table below outlines valid inputs for the variables. Page size should be the number of alerts, from most recent, that you would like to collect.
min_severity | "Informational", "Low", "Medium","High" |
max_severity | "Informational", "Low", "Medium", "High" |
page_size | *Any Integer |
*Note: It is not recommended to set the page_size value extremely high, this should be used for smaller sets of data. If you need all alerts, we need to use a script that can loop through several pages of data such as the script linked in the introduction.