Adding Unified Log Filters to Jamf Protect

Jamf Protect Offline Deployment Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
Requirements
To access unified log filter data collected by Jamf Protect, you must do one of the following:

  • Collect unified logs in a local log file

  • Send unified logs to a Kafka broker

  • Send unified logs to a syslog server

  • Integrate Jamf Protect with a security information and events management (SIEM) solution.

    For more information, see macOS Security Data Integrations by Vendor.

  1. In Jamf Protect, click Unified Logging in the sidebar.
  2. On the Filters tab, click Create Filter.
  3. Give your filter a name.
  4. (Optional) Add tags to your filter.
  5. Enter your previously created predicate-based filter.
    Note:

    Only enter the predicate filter between the quotations.The log command and --predicate flag you used to test your filter should not be included.

  6. Click Save.

All computers will now send logs that match your filter to your security information and event management (SIEM) solution, or a local log file depending on your action configuration.