Elevate24 Security Logging

com.jigsaw24.Elevate24SecurityExtension

Monitoring Extension for Elevate24 by Jigsaw24

macOS

exclusive

Configuration Keys (21)

Key	Type	Title	Description	Default	Range
`PFC_SegmentedControl_0`required	string	—	—	—	—
`siemUploadURL`	string	Upload URL	Events will be uploaded to the supplied url via HTTP POST. Note that events can be uploaded to the supplied URL or to sentinel not both.	—	—
`siemUploadHeaders`	array	Request Headers	Headers to be included in the HTTP request.	—	—
`headers`	dict	Request Headers	Headers to be included in the HTTP request.	—	—
`Header`	string	Header	—	—	—
`Value`	string	Value	—	—	—
`Header`	string	Header	—	—	—
`Value`	string	Value	—	—	—
`siemNewLineSeperated`	boolean	Seperate Events with New Line	By default events are uploaded in JSON format as an array of events. Some systems require events to be seperated with a new line.	false	—
`SentinelTennantId`	string	Sentinel Tennant ID	Tennant ID	—	—
`SentinelClientId`	string	Sentinel Client ID	Client ID	—	—
`SentinelClientSecret`	string	Sentinel Client Secret	Client Secret	—	—
`SentinelUploadURL`	string	Sentinel Upload URL	URL to upload events to Microsoft Sentinel	—	—
`MaxDataUploadSize`	integer	Max HTTP Request Size	Max size of single HTTP request uploading data. (Uncompressed size in bytes default size is 1,000,000 bytes)	1000000	—
`DefaultFilterRules`	boolean	Add Default Filter Rules	Deploys default rules to discard some events which can be considered noise.	false	—
`SelfProtectionRules`	boolean	Add Self Protection Auth Rules	Deploys authorisation rules to attempt to stop the user making changes to Elevate24 database.	false	—
`DisableAll`	boolean	Disable all operations performed by the daemon	Stops all blocking/logging operations. Effectively a switch to disable this tool.	false	—
`UploadEventsToJigsaw`	boolean	Upload events to Jigsaw24 portal	Enable the security monitoring to be sent to the Jigsaw24 Portal.	false	—
`EnableArchive`	boolean	Enable Local Retention of Events	Enables the local retention of Events after they have been uploaded to Jigsaw24/SIEM.	false	—
`MaxArchiveAge`	integer	Maximum Age of Retained Events (Days)	Sets maximum age of events retained locally.	7	—
`UploadOnHotspot`	boolean	Allow Upload Data on Hotspot connection	Upload Events when connected to iPhone personal hotspot.	false	—
`FileOperationRules`	array	File Operation Rules	Rules to restrict file operations. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. File open operations can be restricted to read only access where required.	—	—
`FileOperationRules`	dict	File Operation Rules	—	—	—
`fileOperation`	string	File Operation	—	—
`action`	string	Action	—	"block"
`fileTargetPath`	string	File Target Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`username`	string	Username	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`fileOperation`	string	File Operation	—	—
`action`	string	Action	—	"block"
`fileTargetPath`	string	File Target Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`username`	string	Username	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`ExecuteProcessRules`	array	Execute Process Rules	Rules to restrict execution of processes. Allow rules can be used in conjunction with block rules to allow a process to execute under the specified conditions. Multiple arguments can be specified by seperating them with a comma.	[{}]	—
`ExecuteProcessRules`	dict	Execute Process Rules	—	—	—
`action`	string	Action	—	"block"
`processPath`	string	Process Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`matchingArgumentsContaining`	string	Match Arguments Containing	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`action`	string	Action	—	"block"
`processPath`	string	Process Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`matchingArgumentsContaining`	string	Match Arguments Containing	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`logAllEventTypes`	boolean	Log All Event Types	Set all event types to be logged. Use with caution, as this could produce a lot of data entries.	false	—
`EventsToLog`	array	Event Types to Log	Define which event types to log. Depends on: logAllEvents ∈ [true]	[{}]	—
`EventType`	dict	Event Type	—	—	—
`eventType`	string	Event Type	—	"All"
`eventType`	string	Event Type	—	"All"
`filterRules`	array	Filter Rules	Define rules to not store events matching the following rules.	[{}]	—
`filterRules`	dict	Filter Rules	—	—	—
`eventType`	string	Event Type	—	—
`path`	string	File Path	—	—	—
`signingId`	string	Signing ID	—	—	—
`eventType`	string	Event Type	—	—
`path`	string	File Path	—	—	—
`signingId`	string	Signing ID	—	—	—
`headers`	dict	Request Headers	Headers to be included in the HTTP request.	—	—
`Header`	string	Header	—	—	—
`Value`	string	Value	—	—	—
`Header`	string	Header	—	—	—
`Value`	string	Value	—	—	—
`FileOperationRules`	dict	File Operation Rules	—	—	—
`fileOperation`	string	File Operation	—	—
`action`	string	Action	—	"block"
`fileTargetPath`	string	File Target Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`username`	string	Username	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`fileOperation`	string	File Operation	—	—
`action`	string	Action	—	"block"
`fileTargetPath`	string	File Target Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`username`	string	Username	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`ExecuteProcessRules`	dict	Execute Process Rules	—	—	—
`action`	string	Action	—	"block"
`processPath`	string	Process Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`matchingArgumentsContaining`	string	Match Arguments Containing	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`action`	string	Action	—	"block"
`processPath`	string	Process Path	—	—	—
`signingID`	string	Signing ID	—	—	—
`matchingArgumentsContaining`	string	Match Arguments Containing	—	—	—
`alwaysActive`	boolean	Always Active	—	—	—
`EventType`	dict	Event Type	—	—	—
`eventType`	string	Event Type	—	"All"
`eventType`	string	Event Type	—	"All"
`filterRules`	dict	Filter Rules	—	—	—
`eventType`	string	Event Type	—	—
`path`	string	File Path	—	—	—
`signingId`	string	Signing ID	—	—	—
`eventType`	string	Event Type	—	—
`path`	string	File Path	—	—	—
`signingId`	string	Signing ID	—	—	—