How to Use Jamf Mac Telemetry for Threat Hunting
Summary
A practical guide to Jamf macOS telemetry explains event fields, process roles, audit tokens and code-signing data, with threat-hunting patterns for spotting unusual process relationships, privilege elevation and suspicious binaries.
Key points
- Telemetry messages use a consistent JSON structure for macOS events, including host, process, event, action and timing data.
- The guide distinguishes source, target and instigator processes and explains how parent and responsible process references reveal execution lineage.
- Audit-token UUIDs support cross-event correlation for a process instance; PIDs can be reused.
- Code-signing fields such as team_id, signing_id, cdhash and is_platform_binary help assess executable identity and integrity.
- Suggested hunting patterns include unusual parent-child process relationships, unexpected effective root privileges and non-platform binaries in system paths.
- Unsigned or ad-hoc-signed binaries are not automatically malicious, but the article recommends additional scrutiny in suspicious contexts.
Article Details
- Defense Focus
- Use Jamf Mac telemetry to investigate and hunt for suspicious activity on macOS endpoints by correlating event details with process identity, ancestry, execution context, and code-signing information.
- Detection Methods
- Correlate events from a device using its serial number or provisioningUDID; use global_seq_num to order events and identify possible gaps.
- Use audit-token uuid values to correlate events for a specific process instance and trace parent, responsible, target, and instigator process relationships.
- Hunt for unexpected parent-child or responsible-child relationships, such as a productivity application spawning a shell or download utility.
- Look for processes with euid 0 and a non-root ruid, especially when the process is not a recognized system utility.
- Compare executable.path with is_platform_binary to identify non-platform binaries located in system paths.
- Investigate processes with null team_id and signing_id and is_platform_binary false, particularly when they make network connections or write files.
- Review unexpected processes with is_es_client set to true.
- Data Sources
- Jamf Mac telemetry JSON events collected through Apple's Endpoint Security API
- Process execution events and process audit tokens
- Process executable paths, SHA-1 and SHA-256 hashes when hash collection is enabled, and code-signing fields
- Host identity, operating system, and IP address fields
- Event timestamps, sequence counters, and action results
- Rule Types
- JSON telemetry queries
- Correlation rules
- Detection logic
- Platforms
- macOS
- Defensive Actions
- Use serial or provisioningUDID as a stable device-level correlation anchor rather than relying on a changeable hostname.
- Sort by global_seq_num to reconstruct event order; investigate sequence gaps because events may have been dropped or the extension restarted.
- Use process uuid rather than PID for cross-event process correlation because PIDs can be reused.
- Inspect code-signing identity fields, including signing_id, is_platform_binary, team_id, and cdhash, rather than relying on executable paths alone.
- Use cdhash values to identify specific signed executable versions for blocking with Jamf's custom threat prevention feature.
- Treat signing IDs as developer-controlled values, not proof of legitimacy.
Vendors
AppleMessages are generated by the Jamf extension running on each device. The extension uses Apple's Endpoint Security API under the hood. This means the data is authoritative because it comes directly from the operatingJamfJamf’s Mac platform collects a rich stream of behavioral telemetry from macOS endpoints. Each time something happens on a device, whether a process launches, a filesystem mounts or a user logs in, Jamf packages that