Before
Security or IT staff would likely run or review monthly scans for scoped Mac devices, identify the associated employee, and inspect each result category manually. They would then copy item details into a spreadsheet, organize different persistence types, and send the completed report link to the responsible team.
How it works
- Receive the monthly macOS scan and match the reported device serial number to its associated employee.
- Classify each persistence finding and append the relevant details to the appropriate spreadsheet report.
- Publish the completed report link to the responsible team through Slack for review.
Workflow details
- Scan ingestion: A monthly device scan sends JSON results to the workflow through a webhook, including the device serial number and discovered persistent items.
- Device and employee matching: The workflow creates an authenticated Jamf Pro session and uses the reported serial number to retrieve the associated employee email address and device information.
- Item classification: Each reported item is evaluated by type, including browser extensions, login items, periodic scripts, background managed tasks, and other item categories.
- Structured reporting: Relevant fields such as item name, type, path, plist information, browser, identifier, hash, signature identifier, and signature authority are appended to the appropriate Google Sheets report. Items outside the predefined categories are processed through an AI-assisted step that prepares their spreadsheet entry.
- Team notification: After the scan results are written to the spreadsheet, the workflow posts a Slack message containing the monthly report link so the responsible team can review the findings.
What changed
Monthly scan results now arrive through a webhook and are automatically matched to an employee, categorized, written to a structured spreadsheet, and shared with the responsible team. Human effort shifts from collecting and formatting findings to reviewing the completed report and deciding what action, if any, is needed.
Work removed
Running or reviewing scan results one device at a time, looking up the employee associated with each serial number, classifying findings by persistence type, copying item details into spreadsheet rows, formatting category-specific entries, and manually notifying the responsible team with the report link.
Expected outcome
For each monthly scan, the workflow can remove at least one manual collection, reporting, and notification cycle per scanned device; actual time savings depend on the number of findings.
