jamf_connect_monitor_schema.json

{
  "title": "Jamf Connect Monitor Configuration",
  "description": "Enterprise security monitoring settings for Jamf Connect privilege elevation detection with legitimate elevation tracking. SMTP SETUP: 1) Select provider type, 2) Leave server/port blank for auto-config, 3) Enter username/password/from-address based on provider requirements.",
  "version": "2.4.0",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "NotificationSettings": {
      "title": "📢 Notification Settings",
      "description": "Configure how security violations are reported",
      "type": "object",
      "properties": {
        "WebhookType": {
          "title": "Webhook Platform",
          "description": "Select your webhook platform for proper message formatting",
          "type": "string",
          "enum": ["none", "slack", "teams"],
          "enum_titles": ["None", "Slack", "Microsoft Teams"],
          "default": "none",
          "property_order": 10,
          "options": {
            "infoText": "Teams recommended (Slack webhooks are being deprecated)"
          }
        },
        "WebhookURL": {
          "title": "Webhook URL",
          "description": "Complete webhook URL for real-time security alerts",
          "type": "string",
          "format": "uri",
          "property_order": 11,
          "options": {
            "infoText": "Teams: https://outlook.office.com/webhook/... | Slack: https://hooks.slack.com/..."
          }
        },
        "EmailRecipient": {
          "title": "Security Team Email",
          "description": "Email address for violation reports and alerts",
          "type": "string",
          "format": "email",
          "property_order": 20,
          "options": {
            "infoText": "Example: security@yourcompany.com"
          }
        },
        "SMTPProvider": {
          "title": "SMTP Provider Type",
          "description": "Select your SMTP provider for configuration guidance",
          "type": "string",
          "enum": ["gmail", "office365", "sendgrid", "aws_ses", "smtp2go", "mailgun", "custom"],
          "enum_titles": [
            "Gmail (requires App Password)",
            "Office 365 / Exchange Online", 
            "SendGrid (use 'apikey' as username)",
            "AWS SES",
            "SMTP2GO (requires domain verification)",
            "Mailgun (requires domain verification)",
            "Custom / Other SMTP Server"
          ],
          "default": "custom",
          "property_order": 25,
          "options": {
            "infoText": "If server/port fields are left blank, these defaults apply: Gmail→smtp.gmail.com:587, Office365→smtp.office365.com:587, SendGrid→smtp.sendgrid.net:587, SMTP2GO→mail.smtp2go.com:587"
          }
        },
        "SMTPServer": {
          "title": "SMTP Server Address",
          "description": "SMTP server hostname (leave blank to use provider defaults)",
          "type": "string",
          "property_order": 26,
          "placeholder": "Leave blank for auto-config",
          "options": {
            "infoText": "Defaults: Gmail=smtp.gmail.com, Office365=smtp.office365.com, SendGrid=smtp.sendgrid.net, SMTP2GO=mail.smtp2go.com"
          }
        },
        "SMTPPort": {
          "title": "SMTP Port",
          "description": "SMTP server port (leave blank for 587)",
          "type": "integer",
          "minimum": 1,
          "maximum": 65535,
          "property_order": 27,
          "placeholder": 587,
          "options": {
            "infoText": "Default 587 works for Gmail, Office365, SendGrid, SMTP2GO, Mailgun. Use 465 for SSL/TLS."
          }
        },
        "SMTPUsername": {
          "title": "SMTP Username",
          "description": "Username for SMTP authentication",
          "type": "string",
          "property_order": 28,
          "options": {
            "infoText": "Gmail: your email, SendGrid: 'apikey', SMTP2GO: your username"
          }
        },
        "SMTPPassword": {
          "title": "SMTP Password",
          "description": "Password for SMTP authentication",
          "type": "string",
          "format": "password",
          "property_order": 29,
          "options": {
            "infoText": "Gmail: 16-char App Password, SendGrid: API key, SMTP2GO: account password",
            "inputAttributes": {
              "type": "password"
            }
          }
        },
        "SMTPFromAddress": {
          "title": "From Email Address (Required)",
          "description": "Email address shown as sender - must be verified with your SMTP provider",
          "type": "string",
          "format": "email",
          "property_order": 30,
          "options": {
            "infoText": "Must be a verified sender address for your SMTP provider (e.g., verified domain for SMTP2GO)",
            "required": true
          }
        },
        "NotificationTemplate": {
          "title": "Notification Style",
          "description": "Choose notification detail level",
          "type": "string",
          "enum": ["simple", "detailed", "security_report"],
          "enum_titles": ["Simple Alert", "Detailed Report", "Full Security Report"],
          "default": "detailed",
          "property_order": 30,
          "options": {
            "infoText": "Detailed includes hostname, user, timing. Security Report includes full system context."
          }
        },
        "NotificationCooldownMinutes": {
          "title": "Notification Cooldown (Minutes)",
          "description": "Prevent spam by limiting notification frequency per device",
          "type": "integer",
          "minimum": 1,
          "maximum": 60,
          "default": 15,
          "property_order": 40,
          "options": {
            "infoText": "Prevents notification spam during repeated violations"
          }
        }
      },
      "property_order": 10
    },
    "MonitoringBehavior": {
      "title": "🔍 Monitoring Behavior",
      "description": "Configure how monitoring operates",
      "type": "object",
      "properties": {
        "MonitoringMode": {
          "title": "Monitoring Mode",
          "description": "Choose between periodic checks or real-time monitoring",
          "type": "string",
          "enum": ["periodic", "realtime", "hybrid"],
          "enum_titles": ["Periodic (5 min)", "Real-time", "Hybrid (Both)"],
          "default": "realtime",
          "property_order": 10,
          "options": {
            "infoText": "Real-time provides immediate detection but uses more resources"
          }
        },
        "AutoRemediation": {
          "title": "Automatic Admin Removal",
          "description": "Automatically remove unauthorized admin privileges",
          "type": "boolean",
          "default": true,
          "property_order": 20,
          "options": {
            "infoText": "When enabled, unauthorized admin accounts are immediately demoted"
          }
        },
        "GracePeriodMinutes": {
          "title": "Grace Period (Minutes)",
          "description": "Wait time before removing admin privileges",
          "type": "integer",
          "minimum": 0,
          "maximum": 30,
          "default": 5,
          "property_order": 30,
          "options": {
            "infoText": "Allows brief admin access for legitimate elevation before removal"
          }
        },
        "MonitorJamfConnectOnly": {
          "title": "Require Jamf Connect Event for Monitoring",
          "description": "Only check for violations when Jamf Connect elevation is detected",
          "type": "boolean",
          "default": true,
          "property_order": 40,
          "options": {
            "infoText": "When TRUE: Only checks admins after Jamf Connect elevation. When FALSE: Always checks for unauthorized admins regardless of Jamf Connect activity."
          }
        }
      },
      "property_order": 20
    },
    "SecuritySettings": {
      "title": "🔐 Security Settings",
      "description": "Advanced security and compliance options",
      "type": "object", 
      "properties": {
        "RequireConfirmation": {
          "title": "Require Confirmation Before Removal",
          "description": "Prompt before removing admin privileges (disables auto-remediation)",
          "type": "boolean",
          "default": false,
          "property_order": 10,
          "options": {
            "infoText": "Only enable for testing - disables automatic security response"
          }
        },
        "ViolationReporting": {
          "title": "Enable Violation Reporting",
          "description": "Create detailed logs and reports for security violations",
          "type": "boolean",
          "default": true,
          "property_order": 20
        },
        "LogRetentionDays": {
          "title": "Log Retention (Days)",
          "description": "How long to keep monitoring and violation logs",
          "type": "integer",
          "minimum": 7,
          "maximum": 365,
          "default": 30,
          "property_order": 30,
          "options": {
            "infoText": "Longer retention helpful for security audits and compliance"
          }
        },
        "ExcludeSystemAccounts": {
          "title": "Excluded System Accounts",
          "description": "System accounts to ignore during monitoring",
          "type": "array",
          "items": {
            "type": "string"
          },
          "default": ["_mbsetupuser", "root", "daemon"],
          "property_order": 40,
          "options": {
            "infoText": "Default exclusions prevent false alerts for system accounts"
          }
        }
      },
      "property_order": 30
    },
    "JamfProIntegration": {
      "title": "☁️ Jamf Pro Integration",
      "description": "Configure integration with Jamf Pro services",
      "type": "object",
      "properties": {
        "UpdateInventoryOnViolation": {
          "title": "Update Inventory on Violations",
          "description": "Automatically update Jamf Pro inventory when violations occur",
          "type": "boolean",
          "default": true,
          "property_order": 10,
          "options": {
            "infoText": "Ensures Extension Attributes reflect current violation status"
          }
        },
        "TriggerPolicyOnViolation": {
          "title": "Policy Trigger for Violations",
          "description": "Custom trigger to execute additional policies during violations",
          "type": "string",
          "property_order": 20,
          "options": {
            "infoText": "Example: security_incident_response"
          }
        },
        "CompanyName": {
          "title": "Company Name",
          "description": "Organization name for branding in reports and notifications",
          "type": "string",
          "default": "Your Company",
          "property_order": 30,
          "options": {
            "infoText": "Appears in security reports and notification messages"
          }
        },
        "ITContactEmail": {
          "title": "IT Support Email", 
          "description": "IT contact information for user notifications",
          "type": "string",
          "format": "email",
          "property_order": 40,
          "options": {
            "infoText": "Included in user-facing security messages"
          }
        }
      },
      "property_order": 40
    },
    "AdvancedSettings": {
      "title": "⚙️ Advanced Settings",
      "description": "Expert configuration options",
      "type": "object",
      "properties": {
        "DebugLogging": {
          "title": "Enable Debug Logging",
          "description": "Verbose logging for troubleshooting (increases log size)",
          "type": "boolean",
          "default": false,
          "property_order": 10,
          "options": {
            "infoText": "Only enable during troubleshooting - significantly increases log volume"
          }
        },
        "MonitoringInterval": {
          "title": "Periodic Check Interval (Seconds)",
          "description": "How often to check for violations in periodic mode",
          "type": "integer",
          "minimum": 60,
          "maximum": 3600,
          "default": 300,
          "property_order": 20,
          "options": {
            "infoText": "Only applies when Monitoring Mode is Periodic or Hybrid"
          }
        },
        "MaxNotificationsPerHour": {
          "title": "Max Notifications Per Hour",
          "description": "Rate limit to prevent notification flooding",
          "type": "integer",
          "minimum": 1,
          "maximum": 60,
          "default": 10,
          "property_order": 30,
          "options": {
            "infoText": "Prevents overwhelming security team during major incidents"
          }
        },
        "AutoPopulateApprovedAdmins": {
          "title": "Auto-populate Approved Admin List",
          "description": "Automatically create approved admin list from current administrators during installation",
          "type": "boolean",
          "default": true,
          "property_order": 40,
          "options": {
            "infoText": "Recommended: Creates baseline from current admin accounts"
          }
        }
      },
      "property_order": 50
    }
  }
}