Confirm CrowdStrike coverage on new Jamf-enrolled Macs
Build a workflow triggered when a new device is enrolled in Jamf Pro, capturing the device name/serial. Query CrowdStrike to see whether the host exists and is reporting. Post the result to a Slack channel/thread; if missing, flag it for remediation. Handle devices that haven't checked in yet with a retry window, and avoid duplicate notifications. Output the coverage finding per device.
What this prompt builds
When a Mac enrolls in Jamf, check whether CrowdStrike sees it and report the result in Slack.
The problem
Macs enrolled in Jamf don't always have the EDR agent deployed and reporting, leaving unmonitored endpoints. The gap usually goes unnoticed until an incident.
Solution and impact
This workflow reacts to new Jamf enrollments, cross-checks CrowdStrike for the device, and posts the finding to a Slack thread. Coverage gaps surface immediately at enrollment.