Access Events Detected from Jamf Security Cloud - Jamf Connect Documentation 2.45.0

Threat event and network traffic streams protected with Transport Layer Security (TLS) are sent in real-time as either Common Event Format (CEF)-encoded syslog or JSON-encoded HTTP events to your chosen destination such as your Security Information and Event Management (SIEM) solution.

#	CEF Name	JSON Name	Description	Data Type	Example Value
1	<CEF header>	version	CEF version	Integer	0
2	<CEF header>	metadata.vendor	Vendor identification	String	Jamf
3	<CEF header>	metadata.product	Product identification	String	ZTNA Events Stream
4	<CEF header>	metadata.schemaVersion	Formatted message version	String	1.0
5	<CEF header>	signatureId.Id	Signature identification	Integer	3
6	<CEF header>	signatureId.name	Signature identification name	String	ZTNA Event
7	<CEF header>	<CEF header> only	Log severity	Integer	1
8	CustomerId	account.customerId	Customer identifier	String	4444defa-1042-4a85-9fff-763ae00c8354
9	ParentId	account.parentId	Customer global account ID	String	5555defa-1042-4a85-9fff-763ae00c8354
10	AccountName	account.name	Customer account name	String	Megacorp GB
11	GUID	device.deviceId	Device identifier	String	a111111a-11a1-4266-9609-fbee82a8a4f9
12	DeviceName	device.deviceName	Human-readable device name	String, Null	Apple iPhone 11 (11.2.5) null (if device name is unavailable)
13	DeviceId	device.externalId	UEM device identifier or device unique device identifier (UDID)	String	59fa173f6c7ca6e7516fa27632f0fa14aaaaaaaa
14	OS	device.os	Device OS and version	String	IOS 11.2.5
15	OsType	device.osType	OS type	String	IOS
16	UserEmail	user.email	User email address	String	user@work.com
17	UserName	user.name	User name	String	Mr. User
18	App	application	App name	String	Outlook
19	DestinationIP	destinationIp	Request destination server IP address	String	123.45.6.78
20	RouteName	routeName	Request route name	String	Nearest Data Center
21	ACT	action	Policy action taken	String	DENY ALLOW
22	DeviceRiskIndex	riskDetails.deviceRiskIndex	Device risk index	String	0.5
23	AppRiskIndexThreshold	riskDetails.appRiskIndexThreshold	Access policy risk index threshold	String	0.6
24	BlockReason	blockReason	Reason for blocked request	String	RISK_BASED_ACCESS_APP_BLOCKED CONTINUOUS_ACCESS_APP_BLOCKED DEVICE_MANAGEMENT_BASED_ACCESS_APP_BLOCKED
25	Timestamp	timestamp	Unix to ISO timestamp conversion	String	2024-01-30T17:47:41.767Z