TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: HTTP Event Collector (HEC)
ENVIRONMENT: Jamf Protect
SUMMARY: Configuration Guide for Jamf Protect. With this guide you can use Huntress to ingest telemetry, Unified Log, and alert events directly from Jamf Protect Offline Deployment Mode, bypassing the need to use Splunk or another 3rd party HEC.

Vendor Information

You must be an Account Administrator in Huntress in order to follow the steps below.

This guide only covers pointing an existing Jamf Protect Offline Deployment Mode action configuration at Huntress. It assumes you already have Offline Deployment Mode set up with a telemetry configuration and plan. If you haven't done that yet, see Jamf's Creating an Offline Deployment Mode Action Configuration and Creating an Offline Deployment Mode Plan guides first.

Configuration Checklist

Create Token

1. Open the Huntress Portal
2. Click SIEM on the left navigation menu
3. Click Source Management
4. Click Add Source
5. Click Jamf Protect
6. Click Add
7. Provide a name for the Integration and an optional description
8. Click Save
9. Copy the HTTP Event Collector Token value
   • Keep this secure, it is the equivalent of a password

Configure the Action Configuration in Jamf Protect

1. Log in to Jamf Protect
2. Click Actions
3. Click Create Action (or edit an existing action configuration you want to send data to Huntress)
4. Provide a name and description
5. Under Data Endpoints, click + Add
6. Choose HTTP as the endpoint type
7. In the endpoint URL field, enter: https://hec.huntress.io/services/collector/event
8. Add a custom HTTP header:
   Name: Authorization
   Value: Splunk <the token you copied above>
9. Enable the Telemetry, Unified Log, and/or Alert data you want Jamf Protect to send to this endpoint
10. Click Save

Test the Token Before deploying broadly, confirm the token is accepted using this command: 

curl https://hec.huntress.io/services/collector/event -H "Authorization: Splunk YOUR_TOKEN_HERE" -d '{"event": "Hello World"}' A successful response returns: {"text":"Success","code":0} 

If you get an authentication error, double check the token was copied without extra whitespace and that the header value starts with Splunk  (including the space).

Deploy the Configuration

1. Add the action configuration to your Offline Deployment Mode Plan
2. Download the updated configuration profile and installer, and deploy them to target computers via your MDM (e.g., Jamf Pro)
3. Data should begin appearing in Huntress SIEM Source Management within about 30 minutes of the first computers checking in with the new plan

Additional Information

Each configured Jamf Protect HEC source that has sent data in the last 30 days counts as one Managed SIEM Data Source. See our Managed SIEM Billing and Retention guide for more info.

Huntress normalizes Jamf Protect telemetry events (process execution, authentication, and persistence changes) into ECS fields. Other event types are still collected and searchable, but without tailored parsing.