Are you already using Jamf Protect on your macOS devices or considering deploying it? If you want to enhance your macOS endpoint security with your own expertise or threat research, this session is perfect for you.

In this session, we’ll explore how to implement behavioral baselines to detect threats or unwanted activity in an early stage. To achieve tailored event monitoring on macOS, we’ll also demonstrate how to craft custom analytics to identify activities that deviate from your organization’s typical user behavior or leverage telemetry data at scale using an SIEM solution.

If you are an experienced researcher, security analyst or device administrator or this is all new to you, don’t worry — we’ve got you covered. We’ll be sharing resources after the session to help you get started.

This session will cover:

• The importance of implementing behavioral baselines.
  • Monitoring your organization’s use of native binaries or third-party software for notifications and reporting unexpected activity
  • Tracking user privilege elevations and filtering out suspicious activity
• The differences between custom analytics, unified logging and telemetry data
  • Determining the best method for gathering specific activities or data
• Building custom analytics based on real-life scenarios
  • Tools that help you build predicate filters
  • Tips and tricks to preserve system performance and how to best write predicates
• Insights into using Jamf Protect’s new telemetry data for macOS and its relevance
  • How to integrate this Apple-specific telemetry data within a SIEM solution
  • The importance of consuming Apple-specific telemetry data