Description
Jamf Protect includes a Threat Prevention feature, which uses a database of known-bad software. This database is updated extremely frequently (sometimes several times per day), and Jamf protect will warn if this database is out-of-date on computers.
Checking the Threat Prevention Database Version
Inside Jamf Protect/macOS Security Portal
You can see the latest version of the Threat Prevention database, as well as what updates have been sent out recently, by clicking on Threat Prevention on the left sidebar of Jamf Protect.
On the device itself
You can see the Threat Prevention Version by running the following command in Terminal:sudo protectctl info -v
Warning Causes
The Threat Prevention database updates are pushed down to client devices in real-time on update, but if a device is turned off or offline when a new version of the database is released, those devices will receive the update as soon as they check in for the first time.
If the computer checks in and the warning does not go away, it could be caused by a communication issue or a problem with Jamf Protect which is not allowing the Threat Prevention database to be updated properly.
Troubleshooting Steps
If you see a device that is showing a Threat Prevention warning, ensure the device is turned on and connected to a network.
Force a checkin by running the command below and give the device a few seconds to check in and update:
sudo protectctl checkinPerform a full-page refresh of the Jamf Protect Dashboard with Command+R, F5, or a similar refresh hotkey.
If the device still does not show the latest version of Protect Threat Database on the dashboard, you can attempt a self-repair of the Jamf Protect Agent by running:
sudo protectctl repair
sudo protectctl checkinPerform another full-page refresh of the Jamf Protect Dashboard.
This was article KB0030131 in ServiceNow. It was originally authored by Mike Levenick and was copied into Intercom and updated for formatting by TSOPs.