Jamf Protect (macOS portal) comes with a multitude of Jamf-managed analytics. However, there are times when customers need to monitor activity that is specific to their security requirements or individual circumstances.

This talk aims to demystify how to create, test and deploy custom analytics. In this session, we will:
• Understand what an analytic is by looking at some existing ones
• Look at event types and their capabilities, including attributes available
• Look at analytic chains
• Deep dive into predicates, using various examples
• Look at some of the tools we can use to get information that the predicate may require
• Go over examples of using ‘and’ and ‘or’ boolean logic in the predicate