Before You Begin

Jamf Protect Offline Deployment Documentation

Solution
Application
Content Type: Technical Documentation
Utilities & Services
ft:locale: en-US

Jamf Protect Offline Deployment Mode Documentation
Overview of Technologies
Offline Deployment Mode
General Requirements
Unified Logging for macOS
Telemetry
Getting Started with Telemetry in Jamf Protect
Migrating from Jamf Protect's Deprecated Telemetry
Telemetry Event Categories
Telemetry Exception Rules
Telemetry Optimization
Summarization for Telemetry Events
Simple Log File Collection
(Deprecated) Creating a Telemetry Configuration
(Deprecated) Telemetry Log Levels
(Deprecated) Telemetry Log Data Examples
AUE_add_to_group
AUE_AUDITCTL
AUE_AUDITON_SPOLICY
AUE_auth_user
AUE_BIND
AUE_BIOS_FIRMWARE_VERSIONS
AUE_CHROOT
AUE_CONNECT
AUE_create_group
AUE_create_user
AUE_delete_user
AUE_EXECVE
AUE_FORK
AUE_GETAUID
AUE_LISTEN
AUE_logout
AUE_lw_login
AUE_MAC_SET_PROC
AUE_modify_group
AUE_modify_password
AUE_modify_user
AUE_mount
AUE_openssh
AUE_POSIX_SPAWN
AUE_PTRACE
AUE_remove_from_group
AUE_SESSION_CLOSE
AUE_SESSION_END
AUE_SESSION_START
AUE_SESSION_UPDATE
AUE_SETTIMEOFDAY
AUE_SHUTDOWN
AUE_ssauthint
AUE_ssauthmech
AUE_ssauthorize
AUE_UNMOUNT
Audit Logs
Exporting Audit Logs
Security Standards in the macOS Security Portal
Authentication
System Integrity Protection
Before You Begin
Setting Up a Jamf Protect Offline Deployment Mode Tenant
Creating Users in Jamf Protect Offline Deployment Mode
Updating Your Jamf Protect Offline Deployment Mode License
Single Sign-On (SSO) in Jamf Account
macOS Security Data Integrations by Vendor
Splunk
macOS Security and Splunk Integration Requirements
Installing the Jamf Protect Add-on for Splunk
Creating HTTP Event Collectors and Tokens in Splunk
Creating an Event Collector for Unified Logs
Modifying Unified Log Event Types
Creating an Event Collector for Telemetry Data
Testing Your Splunk Event Collector Token
Creating an Jamf Protect Action Configuration for Splunk
Searching macOS Security Data in Splunk
Datadog
Installing the Jamf Protect Integration for Datadog
Creating a Jamf Protect Action Configuration for Datadog
Testing your Datadog Integration
Migrating from Compliance Reporter to Jamf Protect Offline Deployment Mode
Compliance Reporter Feature Deprecations
Compliance Reporter Feature Parity
Configuring Offline Deployment Mode
Creating an Offline Deployment Mode Action Configuration
macOS Security Data Batching for HTTP Endpoints
Using HTTP to Integrate SIEMs
Using Log Files to Collect Data Locally
Using Syslog for Log Files
Using Kafka for Log Files
Creating a Telemetry Configuration
Configuring Network Telemetry
Network Telemetry Known Limitations
Creating a Unified Log Filter
Adding Unified Log Filters to Jamf Protect
Creating Unified Log Filter Sets
Adding Unified Log Filter Sets to Plans
Creating an Offline Deployment Mode Exception Set
Creating an Offline Deployment Mode Plan
Creating Offline Deployment Mode Configuration Profiles Using Jamf Pro
Offline Deployment Mode Settings Reference
General Configuration Settings
Unified Logging Management Settings
Telemetry Settings
Data Endpoint Settings
(Deprecated) Offline Deployment Mode Preference Keys
General Configuration Preference Keys
Unified Logging Management Preference Keys
HTTP Data Endpoint Preference Keys
Log File Data Endpoint Preference Keys
Syslog Data Endpoint Preference Keys
Kafka Data Endpoint Preference Keys
Telemetry Exception Sets Preference Keys
Sample Preference Key List
Deploying Offline Deployment Mode
Downloading the Jamf Protect Package and Plans for Deployment
Confirming Offline Deployment Mode Installation
Uninstalling Jamf Protect Offline Deployment Mode
Copyright and Trademarks

Back to home page