...
Valid tags and data tables
...
Technology
...
Brand
...
Service
...
Type
...
mdm
...
jamf
...
pro
The full tag must have four levels. The first two are fixed as mdm.jamf
and represent technology and brand. The third level corresponds to the service while the fourth identifies the type of events sent.
These are the valid tags and corresponding data tables that will receive the parsers' data:
Product / Service | Tags | Data tables |
---|
Jamf Pro Mobile Device Management (MDM) | mdm.jamf.events
| mdm.jamf.events
|
mdm.jamf.pro.rest_api_operation
mdm.jamf.pro.mobile_device_push_sent
mdm.jamf.pro.mobile_device_command_
|
unenrolleddevice_added_to_dep
computer_checkin
mobile_device_enrolled
jss_startup
computer_policy_finished
computer_added
jss_shutdown
completed
mdm.jamf.pro.mobile_device_unenrolled
mdm.jamf.pro.scep_challenge
mdm.jamf.pro.computer_patch_policy_completed
| mdm.jamf.pro
|
mdm.jamf.pro.computer_added
| mdm.jamf.pro.computer_added
|
mdm.jamf.pro.computer_checkin
| mdm.jamf.pro.computer_checkin
|
mdm.jamf.pro.computer_inventory_completed
| mdm.jamf.pro.computer_inventory_completed
|
mdm.jamf.pro.computer_patch_policy_completed
| mdm.jamf.pro.computer_patch_policy_completed
|
push_sent
rest_api_operation
patch_software_title_updated
mdm.jamf.pro.computer_policy_finished
| mdm.jamf.pro.computer_policy_finished
|
mdm.jamf.pro.computer_push_capability_changed
| mdm.jamf.pro.computer_push_capability_changed
|
scep_challenge
mobile_device_checkin
mobile_device_command_completed
computer_inventory_completed
computer_inventory_completed
These are the valid tags and corresponding data tables that will receive the parsers' data:
Tag | Data table |
---|
mdm.jamf.pro.device_added_to_dep
| mdm.jamf.pro.device_added_to_dep
|
mdm.jamf.pro.jss_shutdown
| mdm.jamf.pro.jss_shutdown
|
mdm.jamf.pro.jss_startup
| mdm.jamf.pro.jss_startup
|
mdm.jamf.pro.mobile_device_ push_sentcheckin
| mdm.jamf.pro.mobile_device_ push_sentcheckin
|
mdm.jamf.pro.mobile_device_command_completed
| mdm.jamf.pro.mobile_device_command_completed
|
mdm.jamf.pro.mobile_device_ unenrolled enrolled
| mdm.jamf.pro.mobile_device_ unenrolledenrolled
|
mdm.jamf.pro. devicepatch_ addedsoftware_ totitle_ depupdated
| mdm.jamf.pro. devicepatch_ addedsoftware_ totitle_ depupdated
|
mdm.jamf.pro. computerpush_ checkinsent
| mdm.jamf.pro. computerpush_ checkinsent
|
mdm.jamf.pro. mobilerest_ deviceapi_ enrolledoperation
| mdm.jamf.pro. mobilerest_ deviceapi_ enrolledoperation
|
mdm.jamf.pro. jssscep_ startupchallenge
| mdm.jamf.pro. jss_startupscep_challenge
|
How is the data sent to Devo?
You can use the HTTP endpoint to ingest data into these tables.
Table structure
These are the fields displayed in these tables:
...
...
...
...
mdm.jamf.eventsField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | at_timestamp | timestamp
| | host | ip4
| | certid | str
| | headers__request_method | str
| | headers__content_length | str
| | headers__http_user_agent | str
| | headers__accept_encoding | str
| | headers__request_path | str
| | headers__connection | str
| | headers__content_type | str
| | headers__accept_language | str
| | headers__http_accept | str
| | headers__http_version | str
| | headers__http_host | str
| | at_version | str
| | caid | str
| | input__match__event__timestamp | timestamp
| | input__match__event__type | int4
| | input__match__event__dev | int8
| | input__match__event__gid | int4
| | input__match__event__path | str
| | input__match__event__pid | int4
| | input__match__event__eventID | int4
| | input__match__event__uuid | str
| | input__match__event__prevFile | str
| | input__match__event__iNode | int8
| | input__match__event__uid | int8
| | input__match__context | str
| | input__match__actions | str
| | input__match__uuid | str
| | input__match__facts | str
| | input__match__severity | int4
| | input__match__tags | str
| | input__host__provisioningUDID | str
| | input__host__hostname | str
| | input__host__serial | str
| | input__host__ips | str
| | input__eventType | str
| | input__related__processes | str
| | input__related__binaries | str
| | input__related__files | str
| | input__related__groups | str
| | input__related__users | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro Field | Type | Source field name | Extra fields |
---|
eventdate | timestamp
| | | hostname | str
| | | subtype | str
| vsubtype | | alternateMacAddress | str
| | | bluetoothMacAddress | str
| | | building | str
| | | department | str
| | | deviceName | str
| | | emailAddress | str
| | | event | json
| | | icciID | str
| | | imei | str
| | | ipAddress | str
| | | jssID | int4
| | | macAddress | str
| | | model | str
| | | modelDisplay | str
| | | osBuild | str
| | | osVersion | str
| | | phone | str
| | | position | str
| | | product | str
| | | realName | str
| | | realname | str
| | | reportedIpAddress | str
| | | room | str
| | | serialNumber | str
| | | udid | str
| | | userDirectoryID | str
| | | username | str
| | | version | str
| | | wifiMacAddress | str
| | | hostchain | str
| | ✓ | tag | str
| | ✓ | rawMessage | str
| | ✓ |
mdm.jamf.pro.computer_addedField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | udid | str
| | deviceName | str
| | model | str
| | macAddress | str
| | alternateMacAddress | str
| | serialNumber | str
| | osVersion | str
| | osBuild | str
| | userDirectoryID | str
| | username | str
| | realName | str
| | emailAddress | str
| | phone | str
| | position | str
| | department | str
| | building | str
| | room | str
| | ipAddress | str
| | reportedIpAddress | str
| | jssID | int4
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro. |
...
computer_checkinField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | computer__alternateMacAddress | str
| | computer__building | str
| | computer__department | str
| | computer__deviceName | str
| | computer__emailAddress | str
| | computer__ipAddress | str
| | computer__jssID | int4
| | computer__macAddress | str
| | computer__model | str
| | computer__osBuild | str
| | computer__osVersion | str
| | computer__phone | str
| | computer__position | str
| | computer__realName | str
| | computer__reportedIpAddress | str
| | computer__room | str
| | computer__serialNumber | str
| | computer__udid | str
| | computer__userDirectoryID | str
| | computer__username | str
| | trigger | str
| | username | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro. |
...
computer_inventory_completedField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | udid | str
| | deviceName | str
| | model | str
| | macAddress | str
| | alternateMacAddress | str
| | serialNumber | str
| | osVersion | str
| | osBuild | str
| | userDirectoryID | str
| | username | str
| | realName | str
| | emailAddress | str
| | phone | str
| | position | str
| | department | str
| | building | str
| | room | str
| | ipAddress | str
| | reportedIpAddress | str
| | jssID | int4
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro.computer_patch_policy_completedField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | computer__alternateMacAddress | str
| | computer__building | str
| | computer__department | str
| | computer__deviceName | str
| | computer__emailAddress | str
| | computer__ipAddress | str
| | computer__jssID | int4
| | computer__macAddress | str
| | computer__model | str
| | computer__osBuild | str
| | computer__osVersion | str
| | computer__phone | str
| | computer__position | str
| | computer__realName | str
| | computer__reportedIpAddress | str
| | computer__room | str
| | computer__serialNumber | str
| | computer__udid | str
| | computer__userDirectoryID | str
| | computer__username | str
| | deployedVersion | str
| | eventActions__action | str
| | patchPolicyId | int4
| | patchPolicyName | str
| | softwareTitleId | int4
| | successful | bool
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|
...
...
...
...
...
...
...
...
...
...
...
computer_policy_finishedField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | computer__alternateMacAddress | str
| | computer__building | str
| | computer__department | str
| | computer__deviceName | str
| | computer__emailAddress | str
| | computer__ipAddress | str
| | computer__jssID | int4
| | computer__macAddress | str
| | computer__model | str
| | computer__osBuild | str
| | computer__osVersion | str
| | computer__phone | str
| | computer__position | str
| | computer__realName | str
| | computer__reportedIpAddress | str
| | computer__room | str
| | computer__serialNumber | str
| | computer__udid | str
| | computer__userDirectoryID | str
| | computer__username | str
| | policyId | int4
| | successful | bool
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro.computer_push_capability_changedField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | udid | str
| | deviceName | str
| | model | str
| | macAddress | str
| | alternateMacAddress | str
| | serialNumber | str
| | osVersion | str
| | osBuild | str
| | userDirectoryID | str
| | username | str
| | realName | str
| | emailAddress | str
| | phone | str
| | position | str
| | department | str
| | building | str
| | room | str
| | ipAddress | str
| | reportedIpAddress | str
| | jssID | int4
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro. |
...
...
...
to_depField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | assetTag | str
| | description | str
| | deviceAssignedDate | int4
| | deviceEnrollmentProgramInstanceId | int4
| | model | str
| | serialNumber | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro. |
...
jss_shutdownField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | hostAddress | str
| | institution | str
| | isClusterMaster | bool
| | jssUrl | str
| | webApplicationPath | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro. |
...
jss_startupField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | hostAddress | str
| | institution | str
| | isClusterMaster | bool
| | jssUrl | str
| | webApplicationPath | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro.mobile_device_checkinField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | bluetoothMacAddress | str
| | deviceName | str
| | icciID | str
| | imei | str
| | ipAddress | str
| | jssID | int4
| | model | str
| | modelDisplay | str
| | osBuild | str
| | osVersion | str
| | product | str
| | room | str
| | serialNumber | str
| | udid | str
| | userDirectoryID | str
| | username | str
| | version | str
| | wifiMacAddress | str
| | hostchain | str
| | tag | str
| | rawMessage | str
| |
|
...
mdm.jamf.pro.mobile_device_command_completedField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | bluetoothMacAddress | str
| | deviceName | str
| | icciID | str
| | imei | str
| | ipAddress | str
| | jssID | int4
| | model | str
| | modelDisplay | str
| | osBuild | str
| | osVersion | str
| | product | str
| | room | str
| | serialNumber | str
| | udid | str
| | userDirectoryID | str
| | username | str
| | version | str
| | wifiMacAddress | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro.mobile_device |
...
_enrolledField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | bluetoothMacAddress | str
| | deviceName | str
| | icciID | str
| | imei | str
| | ipAddress | str
| | jssID | int4
| | model | str
| | modelDisplay | str
| | osBuild | str
| | osVersion | str
| | product | str
| | room | str
| | serialNumber | str
| | udid | str
| | userDirectoryID | str
| | username | str
| | version | str
| | wifiMacAddress | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro.patch_software_title_updatedField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | name | str
| | latestVersion | str
| | lastUpdate | timestamp
| | jssID | int4
| | reportUrls | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro.push_sentField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | type | str
| | managementId | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro. |
...
...
api_operationField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | operationSuccessful | bool
| | objectID | int4
| | objectName | str
| | objectTypeName | str
| | authorizedUsername | str
| | restAPIOperationType | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
mdm.jamf.pro. |
...
scep_challengeField | Type | Extra fields |
---|
eventdate | timestamp
| | hostname | str
| | targetUser__dn | str
| | targetUser__username | str
| | targetUser__uid | str
| | targetUser__room | str
| | targetUser__uuid | str
| | targetUser__buildingID | int4
| | targetUser__phone | str
| | targetUser__departmentID | int4
| | targetUser__position | str
| | targetUser__password | str
| | targetUser__email | str
| | targetUser__realname | str
| | targetDevice__osBuild | str
| | targetDevice__bluetoothMacAddress | str
| | targetDevice__room | str
| | targetDevice__deviceName | str
| | targetDevice__udid | str
| | targetDevice__serialNumber | str
| | targetDevice__product | str
| | targetDevice__icciID | str
| | targetDevice__modelDisplay | str
| | targetDevice__version | str
| | targetDevice__imei | str
| | targetDevice__userDirectoryID | str
| | targetDevice__osVersion | str
| | targetDevice__model | str
| | targetDevice__wifiMacAddress | str
| | scepServerUrl | str
| | payloadIdentifier | str
| | payloadTypes | str
| | hostchain | str
| ✓ | tag | str
| ✓ | rawMessage | str
| ✓ |
|