Description

In Jamf Protect we can add exception sets that support wildcards using the * character. This can produce confusion around what is considered valid and what is not considered a valid directory for an exception.

Understanding Jamf Protect Exception Set Wildcard and Directory Behavior

Using the following analytic:

(($event.isModified == 1 OR $event.type == 1) AND
($event.path == "/Users/Shared/Resources/testfile.txt" OR 
$event.prevFile == "/Users/Shared/Resources/testfile.txt"))

We added the Employee Handbook.pdf file to the /Users/Shared/Resources directory for each of the tests.

Each of these is a valid exception for the Employee Handbook.pdf file:	None of these are valid exception for the Employee Handbook.pdf file:
/Users/Shared/Resources/Employee Handbook.pdf /Users/* /Users/Shared/* /Users/Shared/Resources/* /Users//Resources/Employee Handbook.pdf /Users//Resources/* In certain scenarios: /Users// is also a valid wildcard directory	/Users /Users/Shared /Users/Shared/Resources /Users/*/Resources

Next Steps

While the results are somewhat expected, we can now go forward with adding exceptions for exactly what we want with confidence that they will work.

Jamf Protect Exception Set Wildcard & Directory Behavior

Description

Understanding Jamf Protect Exception Set Wildcard and Directory Behavior

Next Steps