Collects JumpCloud identity, access, and device posture metrics
epack install collector jumpcloud
Adds to epack.yaml, resolves dependencies, downloads binary.
Run all configured collectors and build a pack:
epack collect
Runs all collectors in epack.yaml and outputs an evidence pack.
Or add manually to epack.yaml:
collectors:
jumpcloud:
source: https://github.com/locktivity/epack-collector-jumpcloud
Then run epack install to lock and sync.
Full Changelog: https://github.com/locktivity/epack-collector-jumpcloud/compare/v0.1.1...v0.2.0
322 fields. No test account checks this collector yet.
Every field this collector can write, each tagged with the lowest level that collects it. Each level includes everything in the level before it.
No fields match these filters.
The values Foundational Controls and other profiles read.
The provider's organization identifier
unsupported when the vendor never reports the metric, and not_read when the vendor reports it but the collector does not read it
Percentage of devices where the provider's or a baseline's compliance verdict passes, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["compliance.compliant_pct"] counts the devices by outcome
Devices in scope
Devices in scope by operating system family
Whether the fleet has any devices in scope. When false, the percentages have no devices to count
Devices in scope that the provider manages
Devices in scope with affirmative evidence of MDM enrollment
Percentage of devices in scope with affirmative evidence of MDM enrollment. Null when there are no devices
Percentage of devices where every volume is encrypted at rest, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["hardening.disk_encryption_pct"] counts the devices by outcome
Percentage of devices where the host firewall is on, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["hardening.firewall_enabled_pct"] counts the devices by outcome
Percentage of devices where the screen lock setting meets policy, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["hardening.screen_lock_compliant_pct"] counts the devices by outcome
Percentage of devices where the operating system meets the named baseline, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["patching.os_baseline_compliant_pct"] counts the devices by outcome
Percentage of devices where the operating system version still gets security updates, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["patching.os_supported_pct"] counts the devices by outcome
Devices whose operating system version no longer gets security updates
Percentage of devices where anti-malware is installed, running, and current, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["protection.antimalware_healthy_pct"] counts the devices by outcome
Percentage of devices where anti-malware is installed, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["protection.antimalware_installed_pct"] counts the devices by outcome
Percentage of devices where an EDR agent is installed, running, and reporting, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["protection.edr_healthy_pct"] counts the devices by outcome
Percentage of devices where an EDR agent is installed, out of the devices whose reading passed or failed. Devices that are unknown or not applicable are left out. At the audit level, metric_coverage["protection.edr_installed_pct"] counts the devices by outcome
A fixed name for the scope, such as managed_devices
Whether every device the provider lists was read. When false or null, fleet totals and percentages are left out. Null when the collector could not tell
How recently a device must have reported to count
Devices observed within max_observation_age_seconds
The values Foundational Controls and other profiles read.
ISO 8601 timestamp when data was collected
Organization domain or tenant identifier
Identity provider vendor
Version of this schema, always 1.0.0.
Applications the app_security percentages count
Whether the provider has any applications the app_security percentages count. When false, those percentages are null
Count of authorized third-party applications or OAuth integrations
Applications with automated deprovisioning
Percentage of applications with automated deprovisioning
Applications with automated provisioning
Percentage of applications with automated provisioning
Applications using federated SSO (SAML or OIDC)
Percentage of applications using federated SSO (SAML/OIDC)
Whether access to core corporate resources requires a managed or compliant device
Whether privileged access requires a managed or compliant device
Accounts in every state, including suspended and archived accounts. The lifecycle percentages count these
Whether the provider has any accounts, in any state. When false, the lifecycle percentages are null
Accounts in an archived, retained, or soft-deleted state
Percentage of accounts in archived, retained, or soft-deleted state
Accounts in a suspended or disabled state
Percentage of accounts in suspended or disabled state
Maximum idle timeout across all policies (minutes)
Whether legacy authentication protocols are blocked
Whether the tenant enforces MFA for all covered users
Percentage of users covered by policies that require MFA
Users covered by policies that require MFA, out of user_security.user_count
Whether phishing-resistant authentication is required for privileged users
Maximum session lifetime across all policies (minutes)
Percentage of privileged users with MFA enabled or enforced
Privileged users with MFA enabled or enforced
Percentage of privileged users with phishing-resistant MFA
Privileged users with phishing-resistant MFA
Count of users with privileged administrative access
Whether the provider has any users with privileged administrative access. When false, the privileged percentages are null
Count of users with standing privileged access instead of just-in-time or eligible access
Whether any user holds standing privileged access, as standing_privileged_users_count defines it
Count of highest-privilege administrative accounts (for example Global Admin or Super Admin)
Percentage of users inactive for 90+ days
Users inactive for 90 days or more
Percentage of users currently locked out
Users currently locked out
Percentage of users with any MFA factor enrolled
Percentage of users with phishing-resistant MFA (WebAuthn/FIDO2)
Users with any MFA factor enrolled
Percentage of users whose passwords do not meet current password policy requirements
Users whose passwords do not meet current password policy requirements
Users with phishing-resistant MFA (WebAuthn or FIDO2) enrolled
Accounts that can sign in. The user_security percentages and policy.mfa_required_coverage_pct count these
Whether the provider has any users the user_security percentages count. When false, those percentages are null
Percentage of users with weak passwords
Users with weak passwords
Everything this collector reads, grouped by area. Each field lists the lowest level that collects it.
The organization's ID from /api/organizations. Left out, with a gap, when the organization list could not be read, as for a service account
Administrators who are not suspended and whose account requires MFA at sign-in
True when fewer administrators were read than the totalCount JumpCloud reports. Left out when every one was read.
Administrators with the Administrator With Billing role who are not suspended
Admin Portal administrators listed who are not suspended
Administrators who are not suspended and have TOTP enrolled. JumpCloud reports no other administrator factor
Percentage of the administrators who are not suspended that have TOTP enrolled. Null when there are none
Whether the application has an SSO type set
The application's SSO type, such as saml or oidc
True when fewer applications were read than the totalCount JumpCloud reports. Left out when every one was read.
Percentage of applications with an SSO type set. Null when there are no applications
Applications with an SSO type set
Applications listed, with or without an SSO type
Events by Directory Insights event type, over the events read
Email of whoever initiated the event, when JumpCloud reports one
True when more events were read than the 5,000 the collector keeps. Left out otherwise
Events the 5,000-row limit left out
How many days of events were requested
Percentage of active users with any MFA method enrolled. Active users are those neither suspended nor staged
Active users with no MFA method enrolled
Active users whose account requires MFA for the User Portal
Percentage of active users with push MFA enrolled
Percentage of active users with a TOTP authenticator enrolled
Percentage of active users with a WebAuthn or FIDO2 key enrolled
Devices whose antimalware healthy reading failed
Devices the antimalware healthy control does not apply to
Devices whose antimalware healthy reading passed
Percentage of the devices whose antimalware healthy reading passed, out of those whose reading passed or failed. Null when no device's reading passed or failed
Devices with no usable antimalware healthy reading
Devices whose antimalware installed reading failed
Devices the antimalware installed control does not apply to
Devices whose antimalware installed reading passed
Percentage of the devices whose antimalware installed reading passed, out of those whose reading passed or failed. Null when no device's reading passed or failed
Devices with no usable antimalware installed reading
Whether every device JumpCloud reports was listed. When false or null, the control summaries are left out. Null when the systems list leaves it unknown
Devices whose disk encryption reading failed
Devices the disk encryption control does not apply to
Devices whose disk encryption reading passed
Percentage of the devices whose disk encryption reading passed, out of those whose reading passed or failed. Null when no device's reading passed or failed
Devices with no usable disk encryption reading
Devices whose firewall reading failed
Devices the firewall control does not apply to
Devices whose firewall reading passed
Percentage of the devices whose firewall reading passed, out of those whose reading passed or failed. Null when no device's reading passed or failed
Devices with no usable firewall reading
How old, in seconds, a device reading may be and still count
Whether the system's active flag is true
When the device reported the reading. Absent when the source gives no time
The device's antimalware healthy reading. Unknown means no usable reading
When the device reported the reading. Absent when the source gives no time
The device's antimalware installed reading. Unknown means no usable reading
When the device reported the reading. Absent when the source gives no time
The device's disk encryption reading. Unknown means no usable reading
When the device reported the reading. Absent when the source gives no time
The device's firewall reading. Unknown means no usable reading
Whether the system shows evidence of MDM enrollment
True when the rows stopped at 20,000. Left out otherwise
Device rows the 20,000-row limit left out
Systems whose active flag is true
Systems with evidence of MDM enrollment
Systems by operating system, grouped into macOS, Windows, and Linux where the OS name matches
True when fewer distinct systems were read than the totalCount JumpCloud reports. Left out when every one was read.
Distinct systems listed, one per device ID
Surfaces skipped because the API key was refused
Other problems during collection
Whether any enabled policy has a managed-device condition
Whether any enabled policy requires MFA. It does not show which users or sign-ins the policy covers
Whether an enabled Admin Portal policy requires MFA and allows only WebAuthn or FIDO2 factors
Enabled policies that require MFA
Authentication policies listed, enabled or not
The MFA factors the policy accepts. Absent when it accepts any factor
Whether the policy has a deviceManaged condition
Whether the policy is turned off
Whether the policy's effect requires MFA
What sign-in the policy governs, such as user_portal or admin_portal
Whether the account is locked
When the user was created
Whether the user has any MFA method enrolled
Account state, such as ACTIVATED, STAGED, or SUSPENDED
Whether the user has a TOTP authenticator enrolled
Whether the user has a WebAuthn or FIDO2 key enrolled
True when the rows stopped at 20,000. Left out otherwise
User rows the 20,000-row limit left out
Users whose state is ACTIVATED
Users whose account is locked, in any state
True when fewer users were read than the totalCount JumpCloud reports. Left out when every one was read.
Users whose state is STAGED
Users whose state is SUSPENDED
Directory users listed
The status of each run, and any value it couldn't read and why.
Number of findings left out after the first 100.
Number of requests sent, including retries. Present at the audit and internal levels only.
Number of times the collector made the call, not counting retries. Present at the audit and internal levels only.
The Deprecation header from the vendor's most recent response that carried one.
The codes of the operation's failed attempts, without their counts.
Number of failed attempts per code. Present at the audit and internal levels only.
The operation's name, such as okta.users.list.
The permission the call needs, in the vendor's terms. The collector declares it with Operation.Permission. A permission_denied gap from the call records it as its missing_permission.
True when a request for the operation was a retry.
Number of requests that were retries. Present at the audit and internal levels only.
The HTTP status codes, or DNS response codes for a lookup, that the operation's responses had, without their counts.
Number of responses per HTTP status code, or per DNS response code for a lookup. Present at the audit and internal levels only.
The Sunset header from the vendor's most recent response that carried one.
Number of the rows left out whose attempt failed or was a retry. Present wherever the rows are; 0 means every failed or retried request has a row.
Which attempt the request was: 1 for the first, higher for a retry.
The call's number in the run, counting from 1 in the order calls start. Every attempt of one call has the same number.
How long the request took, in milliseconds.
The code for a request that failed. Absent when it succeeded.
The request's host, the name a DNS lookup queried, or the host dialed.
The HTTP method, DNS and the record type looked up, such as DNS TXT, or DIAL.
The operation the request belongs to.
Names of the request's query parameters. Their values are not recorded.
DNS lookups only: the response code. A lookup that got no response has none.
The vendor's request ID from the response headers, when it sent one.
HTTP requests only.
When the attempt was sent, in milliseconds after the run's started_at.
The response's HTTP status code. Absent when no response arrived.
The step the call was made in. Absent for a call made outside every step.
The vendor's own error code from a failed response, such as E0000047. Never the vendor's message. Absent for collectors that do not read one.
On a retry, how long the SDK waited before sending it: the Retry-After value, the rate limit reset, or its own backoff. Absent on a first attempt and on a retry sent at once.
Number of request rows left out.
schema, schema_unusable, population, nulls, rollups, ratios, guidance, or levels.
What the check found.
The artifact the finding is about. A schema_unusable finding has none.
JSON pointer to the value the finding is about.
What happens if the customer picks the option, including its cost and what stays Not collected.
What happens if the customer picks the option, including its cost and what stays Not collected.
Each kind the collector could write that the key left out. Each has a not_shared gap.
The kinds of evidence the collect config key listed, such as cloud-posture.
Each kind the key listed that the run never wrote, such as a misspelled one.
The source commit the collector was built from. Absent when the build set none.
The collector's name, as its spec declares it.
The collector's version, such as v0.3.0. Absent when the build set none.
The number of that call, matching the call on its request rows. A partial gap names the first failed call among those it counts. Present at the audit and internal levels only.
Why the value was left out: auth_failed, permission_denied, config_invalid, not_licensed, unsupported, not_read, rate_limited, vendor_error, timeout, invalid_response, too_large, internal, or not_shared. unsupported means the vendor does not report the value. too_large means the vendor holds more than the collector reads. not_shared means the customer left it out of this pack with the collect config key.
Present at the audit and internal levels only.
The one instruction that fixes collection. It uses fixed wording plus permission, plan, and region names. A gap has at most one of fix, no_action, and choice.
For a permission_denied gap, the permission to grant, in the vendor's own terms, such as okta.logs.read.
True when nothing needs changing now. It does not clear the gap.
The operation whose failed call left the value out. Absent when no call's error caused the gap, such as for a feature the plan lacks.
Who can act on the code: customer, nobody for an expected gap such as a feature the plan lacks, vendor, vendor_or_runner, or publisher.
The artifact the value belongs in. Absent when the run wrote no such artifact, in which case schema names it.
JSON pointer to the value within the artifact. Items are addressed by array index.
The schema of the artifact the value belongs in, when the run wrote no such artifact.
The account, tenant, or region affected. Present at the audit and internal levels only.
The file and line in the collector's own source that recorded the gap, relative to its module root, such as internal/collector/system_log.go:155.
not_collected when the collector could not read the value. partial when a rollup was left out because some of the items it covers could not be read, or when a list or object holds only the items that could be.
For a partial gap, the number of items that could not be read. Present at the audit and internal levels only.
The vendor's own error code, when its response included one.
The collector's message to the operator about the gap, redacted. Present at the audit and internal levels only.
Its calls in the step. Present at the audit and internal levels only.
The operation.
For a partial run, the code of the first gap other than a not_shared, unsupported, or not_read one, saying why its value was left out.
For a partial run, who can act on that code.
collected when the run read every value its level collects, or partial when it left values out. gaps lists each one. A not_shared or unsupported gap does not make a run partial.
True when SSL_CERT_FILE or SSL_CERT_DIR was set for the run.
When the run finished, in RFC 3339 UTC.
The level the run collected at, at every level. A reader uses it to tell a value the level left out from one the collector could not read. Absent from results of older SDKs.
True when a proxy variable such as HTTPS_PROXY was set for the run.
The run ID the runner passed in EPACK_RUN_ID. Absent when it passed none.
When the run started, in RFC 3339 UTC.
How the collector proved its identity, such as private_key_jwt for OAuth 2.0 client credentials with a signed key assertion or api_token for an API token.
Present at the audit and internal levels only.
The kind of principal, such as service_app, service_principal, or user.
The identity system, such as okta or microsoft-entra.
Present when the collector can show that its credential could only read.
The scopes the collector asked for. A scope here and missing from scopes was not granted.
The permissions the sign-in carried.
The tenant, account, or organization signed in to. Present at the audit and internal levels only.
True when an attempt in the step failed: one with an error code or a status of 400 or more.
The calls those requests belong to. Present at the audit and internal levels only.
When the step ended, in milliseconds after the run's started_at. A step still open when the collector emitted ended then. Present at the audit and internal levels only.
The attempts that failed: those with an error code or a status of 400 or more. Present at the audit and internal levels only.
The step's name, such as people. Step names are part of the collector's contract, like operation names.
The requests sent in the step, including rows left out of calls.requests. Present at the audit and internal levels only.
The requests that were retries. Present at the audit and internal levels only.
When the step started, in milliseconds after the run's started_at. Present at the audit and internal levels only.
The step's title, such as People and sign-in methods.
How many distinct values the run read that the vocabulary lacks.
The first 50 of those values, sorted. Present at the audit and internal levels only.
The vocabulary's name, such as okta.event_types.
The one instruction that fixes collection. A warning has at most one of fix, no_action, and choice.
The collector's message about what happened. Present at the audit and internal levels only.
The permission to grant, in the vendor's own terms.
True when nothing needs changing now.
The account, tenant, or region affected. Present at the audit and internal levels only.