Collect JAMF Security Cloud logs

This document explains how to ingest JAMF Security Cloud logs into Google Security Operations using Google Cloud Storage V2.

JAMF Security Cloud is a mobile threat defense and endpoint security platform for Apple devices. It generates threat detection, compliance, and device security event logs covering DNS-layer protection, phishing prevention, content filtering, and device risk assessment.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• A GCP project with Cloud Storage API enabled
• Permissions to create and manage GCS buckets and IAM policies
• Privileged access to the JAMF Security Cloud portal (Jamf Threat Defense or Jamf Protect console)

Create Google Cloud Storage bucket

1. Go to the Google Cloud Console .
2. Select your project or create a new one.
3. In the navigation menu, go to Cloud Storage > Buckets.
4. Click Create bucket.

5. Provide the following configuration details:

   Setting	Value
   Name your bucket	Enter a globally unique name (for example, jamf-security-cloud-logs )
   Location type	Choose based on your needs (Region, Dual-region, Multi-region)
   Location	Select the location (for example, us-central1 )
   Storage class	Standard (recommended for frequently accessed logs)
   Access control	Uniform (recommended)
   Protection tools	Optional: Enable object versioning or retention policy

6. Click Create.

Export JAMF Security Cloud logs to Google Cloud Storage

JAMF Security Cloud supports streaming event data to cloud storage destinations. Configure the data export in the JAMF Security Cloud portal.

1. Sign in to the JAMF Security Cloudportal.
2. Go to Integrations > Data Streams.
3. Click Add Stream.
4. Select a supported destination type. JAMF Data Streams supports AWS S3 and Generic HTTP endpoints natively. To deliver logs to Google Cloud Storage, you can use a Generic HTTP endpoint with a Cloud Run function that writes to GCS, or configure an intermediate S3-compatible destination.
5. Provide the following configuration details:
   • Stream name: Enter a descriptive name (for example, Chronicle GCS Export )
   • GCS bucket name: Enter the bucket name (for example, jamf-security-cloud-logs )
   • Path prefix: Enter a folder prefix (for example, jamf-security-cloud/ )
   • Output format: Select JSON(recommended for Chronicle ingestion)
6. Upload or paste the GCP service account credentials JSON key that has write access to the GCS bucket.
7. Select the event types to export:
   • Threat events (network threats, phishing, malware)
   • Device compliance events
   • DNS security events
   • App risk events
8. Click Save(or Create).
9. Verify that log files begin appearing in the GCS bucket under the specified prefix.

• Ensure that the GCP service account used for the export has the Storage Object Creatorrole on the target bucket.
• Log files are written in JSON format, with each file containing one or more event records.

Retrieve the Google SecOps service account

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Feeds.
3. Click Add New Feed.
4. Click Configure a single feed.
5. Select Google Cloud Storage V2as the Source type.
6. Select JAMF Security Cloudas the Log type.

7. Click Get Service Account. A unique service account email will be displayed, for example:

    chronicle-12345678@chronicle-gcp-prod.iam.gserviceaccount.com 
   

8. Copy this email address. You will use it in the next step.

• Each Google SecOps instance has a unique service account. Do not use service accounts from other documentation or examples.

Grant IAM permissions to the Google SecOps service account

1. Go to Cloud Storage > Buckets.
2. Click your bucket name.
3. Go to the Permissionstab.
4. Click Grant access.
5. Provide the following configuration details:
   • Add principals: Paste the Google SecOps service account email
   • Assign roles: Select Storage Object Viewer
6. Click Save.

• If you plan to use the deletion option (delete transferred files), grant Storage Object Adminrole instead of Storage Object Viewer.

Configure a feed in Google SecOps to ingest JAMF Security Cloud logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Click Configure a single feed.
4. In the Feed namefield, enter a name for the feed (for example, JAMF Security Cloud logs ).
5. Select Google Cloud Storage V2as the Source type.
6. Select JAMF Security Cloudas the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   Field	Value
   Storage bucket URI	gs://jamf-security-cloud-logs/jamf-security-cloud/
   Source Deletion Option	Select the deletion option according to your preference
   Maximum File Age (Days)	Default is 180 days
   Asset namespace	The asset namespace
   Ingestion labels	The label to be applied to the events from this feed

   • Replace jamf-security-cloud-logs with your actual GCS bucket name.
   • Always include the trailing slash ( / ) at the end of the URI.

9. Click Next.

10. Review your new feed configuration in the Finalizescreen, and then click Submit.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.