Description

With the release of Jamf Protect's Advanced Threat Controls feature, some administrators may wish to report in Jamf Pro whether or not it is enabled on computers. We can use an Extension Attribute to report on the status.

Reporting Threat Controls in Jamf Protect

Add the script below as an extension attribute in Jamf Pro.

In Jamf Pro, click Settings in the sidebar.
In the Computer Management section, click Extension Attributes.
Click New.
Configure the following settings:
1. Name your extension attribute.
2. (Optional) Enter a description.
3. Choose the type of data being collected from the Data Type pop-up menu.
4. Choose a category in which to display the extension attribute in Jamf Pro from the Inventory Display pop-up menu.
5. Input Type: Script.
Click Save.

#!/bin/bash
# This Extension Attribute will report on the mode of Advanced Threat Controls.
#
# Data Type: String
# Input Type: Script
#
##### Script starts here #####

#Jamf Protect Location
jamfProtectBinaryLocation="/usr/local/bin/protectctl"

if [ -f "$jamfProtectBinaryLocation" ]; then
  plist=$($jamfProtectBinaryLocation info --plist)
  jamfProtectItemName=$(/usr/libexec/PlistBuddy -c "Print :Plan:Configuration:0:Name" /dev/stdin <<<"$plist")
  if [[ $jamfProtectItemName == "Advanced Threat Controls" ]]; then
    jamfProtectAdavancedThreatControls=$(/usr/libexec/PlistBuddy -c "Print :Plan:Configuration:0:Mode" /dev/stdin <<<"$plist")
  else
    jamfProtectAdavancedThreatControls=$(/usr/libexec/PlistBuddy -c "Print :Plan:Configuration:1:Mode" /dev/stdin <<<"$plist")
  fi
else
  jamfProtectAdavancedThreatControls="Protect binary not found"
fi

echo "<result>$jamfProtectAdavancedThreatControls</result>"

Report if Jamf Protect's Advanced Threat Controls is enabled with an Extension Attribute

Description

Reporting Threat Controls in Jamf Protect