Elevate24 Security Logging

com.jigsaw24.Elevate24SecurityExtension

Monitoring Extension for Elevate24 by Jigsaw24

macOS

exclusive

Configuration Keys (21)

Showing 21 of 21 keys

Key	Type	Description	Default	Range
`PFC_SegmentedControl_0`string required	string	—	Default: —	Range: —
`siemUploadURL`string Upload URL	string	Events will be uploaded to the supplied url via HTTP POST. Note that events can be uploaded to the supplied URL or to sentinel not both.	Default: —	Range: —
`siemUploadHeaders`array Request Headers	array	Headers to be included in the HTTP request.	Default: —	Range: —
`headers`dict Request Headers	dict	Headers to be included in the HTTP request.	Default: —	Range: —
`Header`string Header	string	—	Default: —	Range: —
`Value`string Value	string	—	Default: —	Range: —
`siemNewLineSeperated`boolean Seperate Events with New Line	boolean	By default events are uploaded in JSON format as an array of events. Some systems require events to be seperated with a new line.	Default: false	Range: —
`formatLogMessageSplunk`boolean Format Log Message for Splunk	boolean	Enable to ensure correct formatting of logs when using Splunk as the endpoint. Available in Elevate24 2.6.0 and later.	Default: false	Range: —
`SentinelTennantId`string Sentinel Tennant ID	string	Tennant ID	Default: —	Range: —
`SentinelClientId`string Sentinel Client ID	string	Client ID	Default: —	Range: —
`SentinelClientSecret`string Sentinel Client Secret	string	Client Secret	Default: —	Range: —
`SentinelUploadURL`string Sentinel Upload URL	string	URL to upload events to Microsoft Sentinel	Default: —	Range: —
`MaxDataUploadSize`integer Max HTTP Request Size	integer	Max size of single HTTP request uploading data. (Uncompressed size in bytes default size is 1,000,000 bytes)	Default: 1000000	Range: —
`DefaultFilterRules`boolean Add Default Filter Rules	boolean	Deploys default rules to discard some events which can be considered noise.	Default: false	Range: —
`SelfProtectionRules`boolean Add Self Protection Auth Rules	boolean	Deploys authorisation rules to attempt to stop the user making changes to Elevate24 database.	Default: false	Range: —
`DisableAll`boolean Disable all operations performed by the daemon	boolean	Stops all blocking/logging operations. Effectively a switch to disable this tool.	Default: false	Range: —
`UploadEventsToJigsaw`boolean Upload events to Jigsaw24 portal	boolean	Enable the security monitoring to be sent to the Jigsaw24 Portal.	Default: false	Range: —
`UploadOnHotspot`boolean Allow Upload Data on Hotspot connection	boolean	Upload Events when connected to iPhone personal hotspot.	Default: false	Range: —
`HideBlockedEventHistory`boolean Hide Blocked Event History	boolean	When enabled, hides the blocked events history from the Elevate24 UI.	Default: false	Range: —
`FileOperationRules`array File Operation Rules	array	Rules to restrict file operations. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. File open operations can be restricted to read only access where required.	Default: —	Range: —
`FileOperationRules`dict File Operation Rules	dict	—	Default: —	Range: —
`fileOperation`string File Operation	string	—	Default: —	Range: File Open (file:open), File Delete (file:unlink)
`action`string Action	string	—	Default: "block"	Range: Allow (allow), Block (block), Read Only (File Open Only) (readOnly)
`fileTargetPath`string File Target Path	string	—	Default: —	Range: —
`signingID`string Signing ID	string	—	Default: —	Range: —
`username`string Username	string	—	Default: —	Range: —
`alwaysActive`boolean Always Active	boolean	—	Default: —	Range: —
`ExecuteProcessRules`array Execute Process Rules	array	Rules to restrict execution of processes. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. Multiple arguments can be specified by seperating them with a comma.	Default: [{}]	Range: —
`ExecuteProcessRules`dict Execute Process Rules	dict	—	Default: —	Range: —
`action`string Action	string	—	Default: "block"	Range: Allow (allow), Block (block)
`processPath`string Process Path	string	—	Default: —	Range: —
`signingID`string Signing ID	string	—	Default: —	Range: —
`sourceSigningID`string Parent Signing ID	string	—	Default: —	Range: —
`sourceSigningID`string Parent Signing ID	string	—	Default: —	Range: —
`matchingArgumentsContaining`string Match Arguments Containing	string	—	Default: —	Range: —
`alwaysActive`boolean Always Active	boolean	—	Default: —	Range: —
`silentBlock`boolean Silent Block	boolean	—	Default: —	Range: —
`logAllEventTypes`boolean Log All Event Types	boolean	Set all event types to be logged. Use with caution, as this could produce a lot of data entries.	Default: false	Range: —
`EventsToLog`array Event Types to Log	array	Define which event types to log. Depends on: logAllEvents ∈ [true]	Default: [{}]	Range: —
`EventType`dict Event Type	dict	—	Default: —	Range: —
`eventType`string Event Type	string	—	Default: "All"	Range: File Write (File:Write), File Delete (File:Unlink), File Clone (File:Clone), File Copy (File:CopyFile), File Create (File:Create), File Rename (File:Rename), User Create (User:Create), User Delete (User:Delete), Profile Add (Profile:Add), Profile Remove (Profile:Remove), Launch Item Add (LaunchItem:Add), Launch Item Remove (LaunchItem:Remove), Sudo Command (Sudo), Execute Process (Process:Exec)
`filterRules`array Filter Rules	array	Define rules to not store events matching the following rules.	Default: [{}]	Range: —
`filterRules`dict Filter Rules	dict	—	Default: —	Range: —
`eventType`string Event Type	string	—	Default: —	Range: All (All), File Write (File:Write), File Delete (File:Unlink), File Clone (File:Clone), File Copy (File:CopyFile), File Create (File:Create), File Rename (File:Rename), User Create (User:Create), User Delete (User:Delete), Profile Add (Profile:Add), Profile Remove (Profile:Remove), Launch Item Add (LaunchItem:Add), Launch Item Remove (LaunchItem:Remove), Sudo Command (Sudo), Execute Process (Process:Exec)
`path`string File Path	string	—	Default: —	Range: —
`signingId`string Signing ID	string	—	Default: —	Range: —