Splunk

You can send macOS Security data to Splunk by setting up an HTTP event collectors and tokens in Splunk, and then adding your Splunk endpoint to the macOS Security portal in an action configuration.

This integration involves:

1. Installing the Jamf Protect Add-on for Splunk
2. Creating HTTP Event Collectors and Tokens in Splunk
3. Creating an Jamf Protect Action Configuration for Splunk
4. Searching macOS Security Data in Splunk

This is an example of the Jamf Protect add-on configured within Splunk.