Jamf Security Cloud SIEM Integration: How to Configure Data Streams

Security teams live and die by visibility. If your SIEM doesn’t see it, your team can’t act on it. Jamf Security Cloud generates a steady stream of mobile security signal, network traffic, access events, threat detections, app insights, vulnerability data and device data, and that signal is only valuable once it lands in the platform your analysts already use every day.

The good news: Jamf Security Cloud makes getting that data out straightforward. This post walks through how data streams work, the setup steps, and how to configure the four paths available today: direct integrations with Microsoft Sentinel and Splunk, generic setups for any other SIEM using Generic HTTP or Generic Syslog, and routing everything through an Amazon S3 bucket for your SIEM to ingest.

Topics

What a data stream actually sends
The four ways to get data into your SIEM
Configuring a data stream, step by step
Troubleshooting common configuration errors
Choosing the right path for your team
Sources

What a data stream actually sends

A data stream is a real-time export of security events from Jamf Security Cloud to a destination you control. Only new events are exported once a stream is enabled; historical events aren’t backfilled, so it’s worth turning on streams before you need them, not after an incident.

Jamf Security Cloud supports six data stream types:

Network traffic: network traffic logs for your security or business intelligence tools. Requires Super Admin to enable.
Access events: allowed and denied requests from Jamf Connect Zero Trust Network Access (ZTNA) policies.
Threat events: detected threats for your security operations workflows.
App insights: information about applications installed on devices. Requires Super Admin to enable.
Vulnerability data: new, ongoing and remediated vulnerabilities, sent automatically whenever Jamf Security Cloud syncs device data with your UEM or Jamf Trust. Apple devices only, and requires Jamf Trust or a configured UEM integration.
Device data: device information for your security or business intelligence tools. Requires Super Admin to enable.

Each stream sends events in one of two formats:

Common Event Format (CEF): a standardized log format supported broadly across security tools. CEF streams travel over TLS, and you can choose which fields are included in each event.
JSON: the format expected by many modern analytics platforms.

One operational note worth planning around: streams with consistently high failure rates are automatically disabled to protect streaming efficiency across the platform. If a destination goes offline for an extended period, check the stream status rather than assuming it’s still running.

The four ways to get data into your SIEM

Once you know which stream types you need, you choose a target for each one. Jamf Security Cloud supports five targets, which really break down into four setup paths.

1. Microsoft Sentinel (direct integration)

If your organization already standardizes on Microsoft Sentinel, this is the most direct path. You’ll need an active Microsoft Sentinel subscription and the relevant account details on hand before you start configuring the stream in Jamf Security Cloud.

2. Splunk (direct integration)

Splunk is supported as a first-class target alongside Sentinel. As with Sentinel, gather your Splunk connection details and credentials ahead of time so the configuration step goes smoothly.

3. Generic HTTP and Generic Syslog (any other SIEM)

Not every organization runs Sentinel or Splunk, so Jamf Security Cloud also supports two vendor-agnostic targets:

Generic HTTP works with platforms like Datadog or Sumo Logic. Because the field values differ by vendor, plan on a short setup on the vendor side first. For Datadog, that means installing the Jamf Protect integration from the Datadog Integrations page and collecting the intake URL, API key and application key. For Sumo Logic, install the Jamf Protect app from the Sumo Logic App Catalog and generate an HTTP event source URL. Datadog customers should also note that threat events and network traffic use different endpoint paths, so each needs its own data stream configuration in Jamf Security Cloud.
Generic syslog works with platforms like Microsoft Defender for Cloud Apps or Omnissa Intelligence. Microsoft Defender for Cloud Apps needs a configured cloud app security log collector on the Microsoft side. Omnissa Intelligence needs Omnissa Network Partner credentials. Either way, the receiving server needs to accept syslog over TLS with a certificate signed by an authority in the Common CA Database, and if you’re using client authentication, you’ll add the Wandera CA as a trusted source.

4. Amazon S3 (bring your own ingestion)

For teams that want full control over retention and downstream processing, Jamf Security Cloud can write CEF-formatted events directly to an AWS S3 bucket, which your SIEM then ingests on its own schedule. This path needs an IAM role with permission to upload Jamf Protect data to the bucket, with Jamf’s AWS account listed as a trusted entity. Jamf provides a ready-made AWS CloudFormation template (JamfDataCloudFormation.prod.yaml) that creates both the S3 bucket and the IAM role in one pass, which is the fastest way to stand this up.

Configuring a data stream, step by step

Before you touch the Jamf Security Cloud portal, make sure you have:

A provisioned destination already in place: the Sentinel workspace, Splunk instance, HTTP endpoint, syslog server or S3 bucket you’re sending data to.
All the connection details and credentials that destination requires.
Any target-specific prerequisites from the section above already handled on the vendor side.

With that in hand, the configuration itself is a short sequence:

In Jamf Security Cloud, go to Integrations > Data Streams.
Click Add new.
Select a data stream type (network traffic, access events, threat events, app insights, vulnerability data or device data).
Select a target for that stream (Microsoft Sentinel, Splunk, Generic HTTP, Generic syslog or S3) and click Next.
Complete the configuration fields. These fields change depending on the stream type and target you picked, so double-check them against your vendor’s specific field values before saving.
Click Save.

The new stream appears in your data streams list. It won’t start sending events until you switch on Configuration mode for that stream, so that’s the last step before data starts flowing.

Access to data streams requires either SSO or a Jamf ID, and Jamf Security Cloud recommends signing in through Jamf Account for setup and support.

Troubleshooting common configuration errors

Most data stream failures trace back to one of three issues:

Problem	How to confirm and fix it
TLS/SSL isn’t configured correctly on the receiving server	Run `openssl s_client -connect {hostname}:{port} -tls1_2` from a terminal. You should see the full certificate chain and a `Verify return code: 0 (ok)`. If not, fix the TLS configuration on the destination server.
The receiving firewall is blocking Jamf Security Cloud’s IP addresses	Add Jamf Security Cloud’s IP addresses to your firewall or access control allowlist. Jamf publishes the full list in its network communication documentation.
Splunk logs show “Can’t read key file”	Combine the certificate and the key into a single PEM file.

If a stream still won’t connect after checking these, it’s worth confirming the destination is actually reachable from the public internet on the expected port, since that’s the most common root cause hiding behind all three symptoms above.

Choosing the right path for your team

If you’re already standardized on Microsoft Sentinel or Splunk, the direct integrations are the least amount of setup for the most reliability. If you’re running something else, whether that’s Datadog, Sumo Logic, Microsoft Defender for Cloud Apps or another platform entirely, Generic HTTP and Generic Syslog cover most modern SIEMs without requiring a custom integration from Jamf. And if your team wants a durable, replayable copy of the raw event data outside of any single tool, routing everything through an S3 bucket first gives you that flexibility while still letting your SIEM pull the data in on its own terms.

Whichever path fits your environment, the setup pattern is the same: confirm the destination is provisioned, gather the credentials, configure the stream in Jamf Security Cloud, and switch on Configuration mode. From there, your security events start flowing where your team already works.

For field-level detail on what each stream sends, see the Jamf Security Cloud data stream dictionaries, which cover network traffic, access events, threat events, app insights, vulnerability data and device data.

Sources

All information in this post is based on Jamf’s official documentation. For the most current and detailed guidance, refer directly to the URLs below.

How to set up a SIEM with Jamf Security Cloud