Skip to main content

Jamf Protect Event Collector

This Integration is part of the JamfProtect Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.9.0 and later.

Use this integration to fetch audits and alerts from Jamf Protect as events in Cortex XSIAM.

Configure Jamf Protect Event Collector on Cortex XSIAM#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Jamf Protect Event Collector.

  3. Click Add instance to create and configure a new integration instance.

    Server URL (e.g., API Endpoint of Jamf Protect server.True
    Trust any certificate (not secure)False
    Use system proxy settingsFalse
    Client IDThe unique identifier for the client application, provided by Jamf when the application is registered. This is used to authenticate the client with the Jamf Protect server.True
    PasswordThe password for the client application. This is used to authenticate the client with the Jamf Protect server.True
    Max events per fetchMaximum number of events to fetch at a time.False
  4. Click Test to validate the URLs, token, and connection.


You can execute these commands from the Cortex XSIAM CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.


Gets events from Jamf Protect.

Base Command#



Argument NameDescriptionRequired
limitThe number of events to return. Default is 10.Optional
start_dateThe start date from which to filter events.Optional
end_dateThe end date to which to filter events.Optional
should_push_eventsSet this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.Optional

Context Output#

There is no context output for this command.