JumpCloud

Alerts

JumpCloud - Login Failure Events: This alert is generated when any login failure is detected on JumpCloud user portal, LDAP directory server, SSO application, system (Mac, Linux, Windows), RADIUS server.
JumpCloud - User Granted Admin Privilege: This alert is generated when any user is granted admin sudo privileges on devices by admin. This action will give the user access to create accounts and amend system settings.
JumpCloud - Active Directory Deleted: This alert is generated when an active directory is deleted.
JumpCloud - Admin Created: This alert is generated when an admin is created. Admin account has privilege to amend setting affecting the whole organization and should be monitoring closely.
JumpCloud - System Deleted: This alert is generated when any system is deleted.
JumpCloud - User Account Deleted: This alert is generated when any user is deleted.
JumpCloud - User Account Locked or Suspended: This alert is generated when any user account is locked or suspended. Lockout or account suspension should be monitored as it can be a result of brute force attack.

Reports

JumpCloud - Login Failure Detected Report: This report gives information about all the login failure events to user portal, systems (Mac, OS, Linux), RADIUS server, LDAP and SSO application. Reports contain IP address, username, event_type, auth method, user_agent, information regarding user location, organization id and other useful information.
JumpCloud - Directory Command and Policy Event Report: This report gives the information about command management events, policy management events, file management events, IP list management events.
JumpCloud - Directory Object Event Report: This report gives information about directory application, group, translation rule, system, organization, notification and RADIUS server management events.
JumpCloud - Directory Integration Event Report: This report gives information about active directory events, ids resource events, samba domain events, workday, and integration events.

JumpCloud - Directory User and Admin Event Report: This report provides information related to all user and admin management events such as user/admin create update, delete create. password change, password reset, user account lockout etc.

JumpCloud - System Event Report: This category provides information related to user lockout, password change and other system (Mac, Linux, Windows) events.

Reports

JumpCloud - LDAP and MDM Events Report: This report gives information about LDAP search events and MDM command result. Report contains username who initiated the event, organization, changes, search result and other relevant information.

Reports

JumpCloud: Login Success Detected Report- This report gives information about all the successful login events to user portal, systems (Mac, OS, Linux), RADIUS server, LDAP and SSO application. Report contains IP address, username, event_type, auth method, user_agent, info regarding user location, organization id and other useful information.

The configuration details are consistent with EventTracker version 9.x and later, and JumpCloud.

Download JumpCloud Integrator for Integrating JumpCloud with EventTracker.

To configure JumpCloud to send logs to EventTracker, refer to the How-to Guide.

For more information please refer to the Integration Guide.