Jamf Pro: add support for entity fields

[chemamartinez]

With the addition of the entity fieldset to ECS, the following fields need to be mapped for the Jamf Pro integration:

• host.entity.attributes.managed

Populate from jamf_pro.inventory.general.remote_management.managed.

• host.os.version
  Populate from jamf_pro.events.event.computer.os_version. It is being mapped to os.version at the moment. It requires to enable operating system section in integration's config.

• host.entity.lifecycle.last_activity

Events data stream: jamf_pro.events.webhook.event_timestamp is the timestamp of real-time webhook events.

Inventory data stream: jamf_pro.inventory.general.last_contact_time is the most recent MDM communication recorded by the server.

• user.entity.relationships.owns

Populated from jamf_pro.inventory.user_and_location.*.

No dedicated "ownership" endpoint exists in the v1 API. The device-user assignment is exclusively surfaced through the USER_AND_LOCATION section of /api/v1/computers-inventory.

With the proposed assigment, it reflects that the device is assigned to/owned by this user (Jamf's asset assignment model).

USER_AND_LOCATION section is opt-in (enable_section_user_and_location: false by default).

Update: As recently discussed this field only reflects the direction owner -> owned, so this will remain unpopulated from the integration as the user_and_location section for devices entities show the opposite way. It reflects the owners for each device, instead of the owned devices. It should be correlated in later steps of the processing.

• user.group

It is not being populated user.group in Jamf Pro integration. Populate from jamf_pro.inventory.group_memberships.group_name. Document that it requires Enable Group membership data in the integration config.

• user.entity.attributes.administered_by

Combined from jamf_pro.inventory.local_user_accounts[*].username (when admin ==true). LOCAL_USER_ACCOUNTS section is opt-in (enable_section_local_user_accounts: false by default).

Apart from local admin accounts, it is recommended to add a new API call to get LAPS-managed admin accounts. It requires a new API call per device to https://developer.jamf.com/jamf-pro/reference/get_v2-local-admin-password-clientmanagementid-accounts.

Add a per-device second request using general.management_id as clientManagementId. Not recommended as default, add a new option flag.

For documentation: additional required privilege "Read Local Admin Password".

Update: this endpoint https://developer.jamf.com/jamf-pro/reference/get_v2-local-admin-password-clientmanagementid-accounts provides the admin accounts for a device that are LAPS capable. This is a subgroup of admin accounts that are already located at jamf_pro.inventory.local_user_accounts[*]. Therefore, we are not adding that extra API call.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

tl;dr: The strongest, code-backed gap is that Jamf Pro events do not populate related.ip, even though the pipeline extracts IP observables into ECS (host.ip/source.ip), so entity correlation is incomplete for the events data stream.

Recommendation
Add related.ip population in packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml (mirroring inventory behavior), using host.ip and/or source.ip with null/empty guards and allow_duplicates: false.

Findings

1. Events pipeline sets IPs but never sets related.ip:
   • packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml:81-95 (host.ip from webhook IP fields)
   • packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml:181-184 (source.ip from event.computer.ip_address)
   • packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml:161-169 appends only related.user (no related.ip block)
2. Inventory pipeline already supports related.ip:
   • packages/jamf_pro/data_stream/inventory/elasticsearch/ingest_pipeline/default.yml:233-235
3. Events expected fixture reflects missing entity-IP enrichment (has related.user, no related.ip):
   • packages/jamf_pro/data_stream/events/_dev/test/pipeline/test-computer-added.json-expected.json:67-72

Verification

I validated with repository commands:

$ grep -nE "related\.user|related\.ip|field: host\.ip|target_field: source\.ip|jamf_pro\.events\.event\.ip_address|jamf_pro\.events\.event\.computer\.ip_address" packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml
82:    if: "ctx.jamf_pro.events.event.ip_address != null && ctx.jamf_pro.events.event.ip_address != ''"
83:    field: host.ip
85:     - '{{{jamf_pro.events.event.ip_address}}}'
92:    field: host.ip
157:    field: host.ip
162:    field: related.user
167:    field: related.user
181:    target_field: source.ip
183:    field: jamf_pro.events.event.computer.ip_address

$ grep -nE "related\.user|related\.ip|field: host\.ip" packages/jamf_pro/data_stream/inventory/elasticsearch/ingest_pipeline/default.yml
80:    field: host.ip
228:    field: related.user
233:    field: related.ip

Detailed Action Plan

1. In packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml, add append processors for related.ip after IP normalization:
   • append from host.ip when present
   • append from source.ip when present
   • set allow_duplicates: false
2. Keep existing related.user logic unchanged.
3. Update relevant expected fixtures under packages/jamf_pro/data_stream/events/_dev/test/pipeline/*-expected.json to include related.ip where IP is present.
4. Run the existing pipeline tests for jamf_pro/events to confirm expected outputs.
5. Add a packages/jamf_pro/changelog.yml entry describing entity-field support for events (related.ip).

Related Items

Type	Link / File	Relevance
Issue	#18293	Tracking request for Jamf Pro entity-field support
PR	#14660	Prior Jamf Pro ECS mapping enhancement for inventory
File	packages/jamf_pro/data_stream/events/elasticsearch/ingest_pipeline/default.yml	Current events entity-field mapping behavior
File	packages/jamf_pro/data_stream/inventory/elasticsearch/ingest_pipeline/default.yml	Existing inventory related.ip behavior to mirror
ECS docs	https://www.elastic.co/guide/en/ecs/current/ecs-related.html	related.* usage for pivot/correlation

Note

🔒 Integrity filtering filtered 12 items

Integrity filtering activated and filtered the following items during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• issue:Jamf Pro: add support for entity fields #18293 (issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #18293 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #14659 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #10026 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #10470 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #17560 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #15587 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #15594 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #14701 (search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• pr:Add Ingest Pipeline Mapping for Asset Inventory to Jamf Pro Integration #14660 (pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Add Ingest Pipeline Mapping for Asset Inventory to Jamf Pro Integration #14659 (issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[New Integration] Jamf Pro #10026 (issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.