Jamf

Use Jamf data with Cortex XSIAM.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

Enterprise Mobility Management (EMM) for Apple devices (Mac, iPhone, Apple TV, iPad) with Jamf Pro, used to control configurations via policies, install and uninstall applications, lock devices, run smart group searches, and more. Also fetches audit logs, alert events, and computer assets from Jamf Protect.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Jamf Protect Event Collector: Use this integration to fetch audit logs events, alerts events and computer assets from Jamf Protect to Cortex XSIAM. This sub-capability is available with any active Cortex XSIAM license.

• jamf v2: Enterprise Mobility Management (EMM) for Apple devices (Mac, iPhone, Apple TV, iPad). Can be used to control various configurations via different policies, install and uninstall applications, lock devices, smart groups searches, and more. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

To configure this connector, follow the steps outlined in the configuration wizard.