[Jamf Protect 3.2.0] Enhancements to process mapping

[txhaflaire]

Type of change:

• enhancement

Proposed commit message

• The Jamf Protect Telemetry data stream got enhancements in it's process audit tokens
  • The audit token now contains a effective username (e_username)
  • The audit token now contains a executable path for the process (exec_path)

Check Jamf's release notes here

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

elastic-package test system

2025/08/26 10:33:53  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/integrations/build/container-logs/elastic-agent-1756197233255878000.log
--- Test results for package: jamf_protect - START ---
╭──────────────┬────────────────────┬───────────┬───────────────┬────────┬───────────────╮
│ PACKAGE      │ DATA STREAM        │ TEST TYPE │ TEST NAME     │ RESULT │  TIME ELAPSED │
├──────────────┼────────────────────┼───────────┼───────────────┼────────┼───────────────┤
│ jamf_protect │ alerts             │ system    │ http-endpoint │ PASS   │  37.43365875s │
│ jamf_protect │ telemetry          │ system    │ http-endpoint │ PASS   │ 41.959942917s │
│ jamf_protect │ telemetry_legacy   │ system    │ http-endpoint │ PASS   │ 43.874400084s │
│ jamf_protect │ web_threat_events  │ system    │ http-endpoint │ PASS   │ 44.194318834s │
│ jamf_protect │ web_traffic_events │ system    │ http-endpoint │ PASS   │ 42.502668709s │
╰──────────────┴────────────────────┴───────────┴───────────────┴────────┴───────────────╯
--- Test results for package: jamf_protect - END   ---
Done

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[kcreddy]

/test

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[txhaflaire]

@kcreddy Thanks for the review - i've implemented the minor changes and those are ready to be reviewed.

[kcreddy]

/test

[kcreddy]

LGTM

[txhaflaire]

@kcreddy i saw in SQ that the readme file was out of date - fixed that.

[kcreddy]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 37d21ff

History

• 💔 Build #30565 failed 90f4ad2
• 💚 Build #30555 succeeded 70d770b

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
80.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package jamf_protect - 3.2.0 containing this change is available at https://epr.elastic.co/package/jamf_protect/3.2.0/