...
Introduction
The tags beginning with mdm.jamfidentify events generated by Jamf.
...
The full tag must have four levels. The first two are fixed as mdm.jamfand represent technology and brand. The third level corresponds to the service while the fourth identifies the type of events sent.
...
Technology
...
Brand
...
Service
...
Type
...
mdm
...
jamf
...
pro
These are the valid tags and corresponding data tables that will receive the parsers' data:
Product / Service | Tags | Data tables |
|---|
Jamf Pro Mobile Device Management (MDM) | mdm.jamf.events
| mdm.jamf.events
|
mdm.jamf.pro.rest_api_operation
mdm.jamf.pro.mobile_device_push_sent
mdm.jamf.pro.mobile_device_command_completed
mdm.jamf.pro.mobile_device_unenrolled
|
device_added_to_dep
computer_checkin
mobile_device_enrolled
jss_startup
computer_policy_finished
computer_added
jss_shutdown
| mdm.jamf.pro
|
mdm.jamf.pro.computer_added
| mdm.jamf.pro.computer_added
|
mdm.jamf.pro.computer_checkin
| mdm.jamf.pro.computer_checkin
|
mdm.jamf.pro.computer_inventory_completed
| mdm.jamf.pro.computer_inventory_completed
|
mdm.jamf.pro.computer_patch_policy_completed
| mdm.jamf.pro.computer_patch_policy_completed
|
push_sent
rest_api_operation
patch_software_title_updated
mdm.jamf.pro.computer_policy_finished
| mdm.jamf.pro.computer_policy_finished
|
mdm.jamf.pro.computer_push_capability_changed
| mdm.jamf.pro.computer_push_capability_changed
|
scep_challenge
mobile_device_checkin
mobile_device_command_completed
computer_inventory_completed
computer_inventory_completed
These are the valid tags and corresponding data tables that will receive the parsers' data:
Tag | Data table |
|---|
mdm.jamf.pro.device_added_to_dep
| mdm.jamf.pro.device_added_to_dep
|
mdm.jamf.pro.jss_shutdown
| mdm.jamf.pro.jss_shutdown
|
mdm.jamf.pro.jss_startup
| mdm.jamf.pro.jss_startup
|
mdm.jamf.pro.mobile_device_push_sentcheckin
| mdm.jamf.pro.mobile_device_push_sentcheckin
|
mdm.jamf.pro.mobile_device_command_completed
| mdm.jamf.pro.mobile_device_command_completed
|
mdm.jamf.pro.mobile_device_unenrolled enrolled
| mdm.jamf.pro.mobile_device_unenrolledenrolled
|
mdm.jamf.pro.devicepatch_addedsoftware_totitle_depupdated
| mdm.jamf.pro.devicepatch_addedsoftware_totitle_depupdated
|
mdm.jamf.pro.computerpush_checkinsent
| mdm.jamf.pro.computerpush_checkinsent
|
mdm.jamf.pro.mobilerest_deviceapi_enrolledoperation
| mdm.jamf.pro.mobilerest_deviceapi_enrolledoperation
|
mdm.jamf.pro.jssscep_startupchallenge
| mdm.jamf.pro.jss_startupscep_challenge
|
How is the data sent to Devo?
You can use the HTTP endpoint to ingest data into these tables.
Table structure
These are the fields displayed in these tables:
...
...
...
...
mdm.jamf.eventsField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | at_timestamp | timestamp
| | host | ip4
| | certid | str
| | headers__request_method | str
| | headers__content_length | str
| | headers__http_user_agent | str
| | headers__accept_encoding | str
| | headers__request_path | str
| | headers__connection | str
| | headers__content_type | str
| | headers__accept_language | str
| | headers__http_accept | str
| | headers__http_version | str
| | headers__http_host | str
| | at_version | str
| | caid | str
| | input__match__event__timestamp | timestamp
| | input__match__event__type | int4
| | input__match__event__dev | int8
| | input__match__event__gid | int4
| | input__match__event__path | str
| | input__match__event__pid | int4
| | input__match__event__eventID | int4
| | input__match__event__uuid | str
| | input__match__event__prevFile | str
| | input__match__event__iNode | int8
| | input__match__event__uid | int8
| | input__match__context | str
| | input__match__actions | str
| | input__match__uuid | str
| | input__match__facts | str
| | input__match__severity | int4
| | input__match__tags | str
| | input__host__provisioningUDID | str
| | input__host__hostname | str
| | input__host__serial | str
| | input__host__ips | str
| | input__eventType | str
| | input__related__processes | str
| | input__related__binaries | str
| | input__related__files | str
| | input__related__groups | str
| | input__related__users | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
Field | Type | Source field name | Extra fields |
|---|
eventdate | timestamp
| | | hostname | str
| | | subtype | str
| vsubtype | | alternateMacAddress | str
| | | bluetoothMacAddress | str
| | | building | str
| | | department | str
| | | deviceName | str
| | | emailAddress | str
| | | event | json
| | | icciID | str
| | | imei | str
| | | ipAddress | str
| | | jssID | int4
| | | macAddress | str
| | | model | str
| | | modelDisplay | str
| | | osBuild | str
| | | osVersion | str
| | | phone | str
| | | position | str
| | | product | str
| | | realName | str
| | | realname | str
| | | reportedIpAddress | str
| | | room | str
| | | serialNumber | str
| | | udid | str
| | | userDirectoryID | str
| | | username | str
| | | version | str
| | | wifiMacAddress | str
| | | hostchain | str
| | ✓ | tag | str
| | ✓ | rawMessage | str
| | ✓ |
Field | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | udid | str
| | deviceName | str
| | model | str
| | macAddress | str
| | alternateMacAddress | str
| | serialNumber | str
| | osVersion | str
| | osBuild | str
| | userDirectoryID | str
| | username | str
| | realName | str
| | emailAddress | str
| | phone | str
| | position | str
| | department | str
| | building | str
| | room | str
| | ipAddress | str
| | reportedIpAddress | str
| | jssID | int4
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
computer_checkinField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | computer__alternateMacAddress | str
| | computer__building | str
| | computer__department | str
| | computer__deviceName | str
| | computer__emailAddress | str
| | computer__ipAddress | str
| | computer__jssID | int4
| | computer__macAddress | str
| | computer__model | str
| | computer__osBuild | str
| | computer__osVersion | str
| | computer__phone | str
| | computer__position | str
| | computer__realName | str
| | computer__reportedIpAddress | str
| | computer__room | str
| | computer__serialNumber | str
| | computer__udid | str
| | computer__userDirectoryID | str
| | computer__username | str
| | trigger | str
| | username | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
computer_inventory_completedField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | udid | str
| | deviceName | str
| | model | str
| | macAddress | str
| | alternateMacAddress | str
| | serialNumber | str
| | osVersion | str
| | osBuild | str
| | userDirectoryID | str
| | username | str
| | realName | str
| | emailAddress | str
| | phone | str
| | position | str
| | department | str
| | building | str
| | room | str
| | ipAddress | str
| | reportedIpAddress | str
| | jssID | int4
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
Field | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | computer__alternateMacAddress | str
| | computer__building | str
| | computer__department | str
| | computer__deviceName | str
| | computer__emailAddress | str
| | computer__ipAddress | str
| | computer__jssID | int4
| | computer__macAddress | str
| | computer__model | str
| | computer__osBuild | str
| | computer__osVersion | str
| | computer__phone | str
| | computer__position | str
| | computer__realName | str
| | computer__reportedIpAddress | str
| | computer__room | str
| | computer__serialNumber | str
| | computer__udid | str
| | computer__userDirectoryID | str
| | computer__username | str
| | deployedVersion | str
| | eventActions__action | str
| | patchPolicyId | int4
| | patchPolicyName | str
| | softwareTitleId | int4
| | successful | bool
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
...
...
...
...
...
...
...
...
...
...
computer_policy_finishedField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | computer__alternateMacAddress | str
| | computer__building | str
| | computer__department | str
| | computer__deviceName | str
| | computer__emailAddress | str
| | computer__ipAddress | str
| | computer__jssID | int4
| | computer__macAddress | str
| | computer__model | str
| | computer__osBuild | str
| | computer__osVersion | str
| | computer__phone | str
| | computer__position | str
| | computer__realName | str
| | computer__reportedIpAddress | str
| | computer__room | str
| | computer__serialNumber | str
| | computer__udid | str
| | computer__userDirectoryID | str
| | computer__username | str
| | policyId | int4
| | successful | bool
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
Field | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | udid | str
| | deviceName | str
| | model | str
| | macAddress | str
| | alternateMacAddress | str
| | serialNumber | str
| | osVersion | str
| | osBuild | str
| | userDirectoryID | str
| | username | str
| | realName | str
| | emailAddress | str
| | phone | str
| | position | str
| | department | str
| | building | str
| | room | str
| | ipAddress | str
| | reportedIpAddress | str
| | jssID | int4
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
...
...
to_depField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | assetTag | str
| | description | str
| | deviceAssignedDate | int4
| | deviceEnrollmentProgramInstanceId | int4
| | model | str
| | serialNumber | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
jss_shutdownField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | hostAddress | str
| | institution | str
| | isClusterMaster | bool
| | jssUrl | str
| | webApplicationPath | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
jss_startupField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | hostAddress | str
| | institution | str
| | isClusterMaster | bool
| | jssUrl | str
| | webApplicationPath | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
Field | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | bluetoothMacAddress | str
| | deviceName | str
| | icciID | str
| | imei | str
| | ipAddress | str
| | jssID | int4
| | model | str
| | modelDisplay | str
| | osBuild | str
| | osVersion | str
| | product | str
| | room | str
| | serialNumber | str
| | udid | str
| | userDirectoryID | str
| | username | str
| | version | str
| | wifiMacAddress | str
| | hostchain | str
| | tag | str
| | rawMessage | str
| |
|
...
...
mdm.jamf.pro.mobile_device_command_completedField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | bluetoothMacAddress | str
| | deviceName | str
| | icciID | str
| | imei | str
| | ipAddress | str
| | jssID | int4
| | model | str
| | modelDisplay | str
| | osBuild | str
| | osVersion | str
| | product | str
| | room | str
| | serialNumber | str
| | udid | str
| | userDirectoryID | str
| | username | str
| | version | str
| | wifiMacAddress | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
mobile_device_enrolledField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | bluetoothMacAddress | str
| | deviceName | str
| | icciID | str
| | imei | str
| | ipAddress | str
| | jssID | int4
| | model | str
| | modelDisplay | str
| | osBuild | str
| | osVersion | str
| | product | str
| | room | str
| | serialNumber | str
| | udid | str
| | userDirectoryID | str
| | username | str
| | version | str
| | wifiMacAddress | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
Field | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | name | str
| | latestVersion | str
| | lastUpdate | timestamp
| | jssID | int4
| | reportUrls | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
Field | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | type | str
| | managementId | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
...
| Info |
|---|
How to ingest data? To ingest data you can use the HTTP endpoint.api_operationField | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | operationSuccessful | bool
| | objectID | int4
| | objectName | str
| | objectTypeName | str
| | authorizedUsername | str
| | restAPIOperationType | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
Field | Type | Extra fields |
|---|
eventdate | timestamp
| | hostname | str
| | targetUser__dn | str
| | targetUser__username | str
| | targetUser__uid | str
| | targetUser__room | str
| | targetUser__uuid | str
| | targetUser__buildingID | int4
| | targetUser__phone | str
| | targetUser__departmentID | int4
| | targetUser__position | str
| | targetUser__password | str
| | targetUser__email | str
| | targetUser__realname | str
| | targetDevice__osBuild | str
| | targetDevice__bluetoothMacAddress | str
| | targetDevice__room | str
| | targetDevice__deviceName | str
| | targetDevice__udid | str
| | targetDevice__serialNumber | str
| | targetDevice__product | str
| | targetDevice__icciID | str
| | targetDevice__modelDisplay | str
| | targetDevice__version | str
| | targetDevice__imei | str
| | targetDevice__userDirectoryID | str
| | targetDevice__osVersion | str
| | targetDevice__model | str
| | targetDevice__wifiMacAddress | str
| | scepServerUrl | str
| | payloadIdentifier | str
| | payloadTypes | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
