category: Analytics & SIEM
provider: Jamf
sectionorder:
- Connect
- Collect
commonfields:
  id: Jamf Protect Event Collector
  version: -1
configuration:
- name: base_url
  display: Server URL (e.g., https://example.protect.jamfcloud.com)
  required: true
  defaultvalue:
  type: 0
  additionalinfo: REST API Endpoint of Jamf Protect server.
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- additionalinfo: The password for the client application. This is used to authenticate the client with the Jamf Protect server.
  displaypassword: Password
  name: client
  display: Client ID
  required: true
  type: 9
  section: Connect
- additionalinfo: Maximum number of alert events to fetch at a time.
  defaultvalue: '1000'
  display: Max alert events per fetch
  name: max_fetch_alerts
  required: false
  type: 0
  advanced: true
  section: Collect
- additionalinfo: Maximum number of audit events to fetch at a time.
  defaultvalue: '20000'
  display: Max audit events per fetch
  name: max_fetch_audits
  required: false
  type: 0
  advanced: true
  section: Collect
- additionalinfo: The fetch interval. It is recommended to set it to 12 hours. The minimum interval is 1 hour.
  defaultvalue: 720
  display: Fetch Computer Assets Interval
  name: assetsFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Fetch Events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
- display: Fetch Assets
  name: isFetchAssets
  type: 8
  required: false
  section: Collect
description: Use this integration to fetch audit logs events, alerts events and computer assets from Jamf Protect to Cortex XSIAM.
display: Jamf Protect Event Collector
name: Jamf Protect Event Collector
script:
  commands:
  - arguments:
    - description: The number of events to return.
      name: limit
      defaultValue: 10
    - description: The start date from which to filter events.
      name: start_date
    - description: The end date to which to filter events.
      name: end_date
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: false
    description: Gets events from Jamf Protect.
    name: jamf-protect-get-events
  - arguments:
    - description: The number of computer assets to return.
      name: limit
      defaultValue: 10
    description: Gets computer assets from Jamf Protect.
    name: jamf-protect-get-computer-assets
  runonce: false
  script: "-"
  type: python
  subtype: python3
  isfetchevents: true
  isfetchassets: true
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 6.9.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam