Data Endpoint Settings

Jamf Protect Offline Deployment Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
reportClients
array (dictionary)
Required but array can be empty.
Array for data endpoint transport used to collect telemetry and unified logging. Valid keys include:
  • http
  • logfile
  • kafka
  • syslog

Syslog

Syslog server configuration
reportClients[].syslog
array (dictionary)
Required but array can be empty.
Array for syslog server configuration
reportClients[].syslog[].host
string
Syslog endpoint hostname or IP address to which you send log data
reportClients[].syslog[].port
integer
The syslog endpoint port number that corresponds to its transport protocol. For example, the default port number used for TCP is 601, and the default for TLS is 6514
reportClients[].syslog[].protocol
string (enum)
Syslog endpoint communication protocol used for transmitting log messages. Protocols include:
  • TCP
  • TLS
reportClients[].syslog[].supportedReports
array (dictionary)
Send audit (telemetry) and/or unified log data. Options include:

  • Audit

  • UnifiedLogging

Kafka

Kafka broker transport configuration.
reportClients[].Kafka
array (dictionary)
Required but array can be empty.
Kafka broker configuration array
reportClients[].kafka[].host
string
Kafka broker hostname or IP address to which you subscribe and send log data
reportClients[].kafka[].port
integer
Port that the Kafka broker uses. Default: 9093
reportClients[].kafka[].topic
string
Category name of the Kafka broker data stream to which you want to send data
reportClients[].kafka[].serverCN
string
The common name of the x.509 certificate used to connect the Kafka broker
You can override server certificate verification by inputting no_verify as the server certificate common name.
reportClients[].kafka[].clientCN
string
The common name of the x.509 certificate used by the client that is connecting to the Kafka broker
reportClients[].kafka[].supportedReports
array (dictionary)
Send audit (telemetry) and/or unified log data. Options include:
  • Audit
  • UnifiedLogging

HTTP

HTTP endpoints used for SIEM integrations.
reportClients[].http[].url
String
URL that communicates with a SIEM's API to access its services
reportClients[].http[].method
string
Method used by API to send data. Methods include:

  • POST

  • PUT

  • PATCH

reportClients[].http[].headers
array (dictionary)
Array contains HTTP headers and values
reportClients[].http[].headers[].header
string
HTTP header used to pass additional information during a request
reportClients[].http[].headers[].value
string
HTTP value containing information associated with the header
reportClients[].http[].supportedReports
array (dictionary)
Send audit (telemetry) and/or unified log data. Options include:
  • Audit
  • UnifiedLogging

Log file

Log files collected to a local directory.
reportClients[].logfile
array (dictionary)
Log file array
reportClients[].logfile[].path
string
The location in which to store the log file
reportClients[].logfile[].ownership
string
The user and group who own the log file. Permitted format: user:group
reportClients[].logfile[].permissions
string
Numerical POSIX file permissions. For example, 0640
reportClients[].logfile[].size
integer
Set the maximum log file size in bytes before rotation to another log file. A value of 0 keeps file size unbound
reportClients[].logfile[].backups
integer
Default: 0
Set how many historical log files to retain during rotation before their deletion
reportClients[].logfile[].supportedReports
array (dictionary)
Send audit (telemetry) and/or unified log data. Options include:
  • Audit
  • UnifiedLogging