CrowdStrike + Jamf Mac Fleet EDR Validation

Overview

Mac-heavy organizations rely on Jamf as the source of truth for device inventory. This playbook pulls the full list of Jamf-enrolled computers and their serial numbers, checks them against CrowdStrike Falcon's enrollment list, and reports any Macs without a running EDR agent. Ideal for Mac-first startups and design-led companies.

Who this is for: Mac-first security teams using Jamf Pro for device management

Why automate this

Jamf-managed Mac fleets often end up with drift: agents uninstalled, devices reimaged, or users who never completed setup. Without a daily check, these gaps accumulate silently until an audit. This playbook catches them while they're still easy to fix.

How it works

1. 01

   Scheduled daily run

2. 02

   Set the Slack compliance channel from a playbook variable

3. 03

   Query Jamf for all enrolled computers and their serial numbers

4. 04

   Fetch the CrowdStrike Falcon device inventory

5. 05

   Identify Macs present in Jamf but missing from CrowdStrike

6. 06

   Build a compliance report with computer names, users, and last-seen dates

7. 07

   Notify the compliance channel in Slack with the findings

Impact

• Daily visibility into Mac EDR coverage

• Integrates directly with Jamf as the source of truth

• Enables Mac-first organizations to maintain enterprise-grade security

• Reduces drift between MDM and EDR inventories