> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Jamf Protect

> Connect ThreatAware to Jamf Protect to monitor Apple device security and compliance

## Overview

The Jamf Protect integration enables ThreatAware to access your Jamf Protect console data, providing visibility into Apple device security, threat detection, and compliance status. This helps you validate endpoint protection across your macOS and iOS devices.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: Jamf Protect Administrator account
</Info>

## Data collected

The Jamf Protect integration provides:

* Apple device security status
* Threat detection events
* Device compliance information
* Protection status indicators

## Use cases

<CardGroup cols={2}>
  <Card title="Apple Device Monitoring" icon="apple">
    Monitor security status across macOS and iOS devices
  </Card>

  <Card title="Threat Detection" icon="exclamation-triangle">
    Track detected threats on Apple devices
  </Card>

  <Card title="Compliance Validation" icon="clipboard-check">
    Verify Apple device security policies are enforced
  </Card>

  <Card title="Security Posture" icon="shield">
    Assess overall security posture of Apple endpoints
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware">
    * Navigate to the ThreatAware dashboard
    * Go to **Settings → Integrations**
    * Use the search bar to find **Jamf Protect**
    * Click **Connect** - a pop-up window will appear
  </Step>

  <Step title="Access Jamf Protect Console">
    * Open the [Jamf Protect Console](https://protect.jamfcloud.com)
    * Log in using your administrator credentials
  </Step>

  <Step title="Navigate to API Settings">
    * Go to **Settings** in the Jamf Protect Console
    * Select **API Clients** from the menu
  </Step>

  <Step title="Create API Client for ThreatAware">
    * Click **Add API Client** to create a new API client
    * Name the client "ThreatAware Integration" (or similar)
    * Assign permissions:
      * Select **Read-only** access for monitoring purposes
      * This allows ThreatAware to collect data without modification capability
    * Click **Save** or **Create**
  </Step>

  <Step title="Copy API Credentials">
    * The system will display the **Client ID** and **Client Secret**
    * Copy the **Client ID**
    * Copy the **Client Secret** (note: this is typically shown only once)
    * Store both credentials securely
  </Step>

  <Step title="Configure in ThreatAware">
    In the ThreatAware pop-up window, enter:

    * **Client ID**: The Client ID from Jamf Protect
    * **Client Secret**: The Client Secret from Jamf Protect
    * **Jamf Protect URL**: The URL of your Jamf Protect instance (default: `https://protect.jamfcloud.com`)
    * Click **Authorize** or **Connect** to establish the integration
  </Step>

  <Step title="Verify Connection">
    * In ThreatAware, verify the **Integration Status** displays as **Active**
    * Data collection will begin within 1 hour
    * Check that Jamf Protect device data appears in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Client ID" icon="key">
    **Field Name**: Jamf Protect Client ID
    **Type**: String
    **Description**: The unique identifier for your Jamf Protect API client

    * Generated when creating the API client in Jamf Protect
    * Required for API authentication
    * Example: `ca6e6f79-5a2d-4c8f-9f1e-2d5c8f9a1b2c`
  </Accordion>

  <Accordion title="Client Secret" icon="lock">
    **Field Name**: Jamf Protect Client Secret
    **Type**: Password (encrypted)
    **Description**: The secret credential for authenticating to the Jamf Protect API

    <Tip>
      This credential is typically displayed only once when the API client is created. Store it securely in your organisation's password manager immediately. If you lose it, you will need to regenerate the API client.
    </Tip>
  </Accordion>

  <Accordion title="Jamf Protect URL" icon="server">
    **Field Name**: Jamf Protect URL
    **Type**: String
    **Description**: The URL of your Jamf Protect instance

    **Default**: `https://protect.jamfcloud.com`
    **Custom**: If using a dedicated or on-premises instance, enter your custom URL
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm Jamf Protect shows **Active** status
   * Check the last sync timestamp

2. **Verify Device Data**
   * Wait 60 minutes for the initial data poll
   * Search for a known Apple device in ThreatAware
   * Verify Jamf Protect security information appears in device details

3. **Test Security Queries**
   * Create a test query to filter devices by Jamf Protect security status
   * Verify the data matches your Jamf Protect Console

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Client ID** and **Client Secret** are correct
    * Ensure credentials were copied completely without extra spaces
    * Check that the API client exists and is active in Jamf Protect
    * Verify the API client has not been deleted or revoked
    * If unsure, create a new API client and update the credentials
  </Accordion>

  <Accordion title="Permission Errors" icon="ban">
    **Symptoms**: Integration connects but cannot retrieve device data or access is denied

    **Solutions**:

    * Verify the API client was created with **Read-only** permissions
    * Check that the API client has sufficient permissions in Jamf Protect
    * Ensure your Jamf Protect administrator account still has access
    * Review [Jamf Protect API Documentation](https://developer.jamf.com) for permission requirements
    * Regenerate the API client with correct permissions if needed
  </Accordion>

  <Accordion title="Invalid URL" icon="link">
    **Symptoms**: Integration fails to connect with URL error

    **Solutions**:

    * Verify the **Jamf Protect URL** is correct and accessible
    * Default URL should be: `https://protect.jamfcloud.com`
    * If using a custom URL, ensure it is correct for your deployment
    * Test the URL in a browser to confirm it is reachable
    * Check firewall rules allow outbound HTTPS (443) to the Jamf server
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no Jamf Protect device data appears

    **Solutions**:

    * Verify there are Apple devices enrolled in Jamf Protect
    * Check that devices have reported to Jamf Protect recently
    * Confirm the API client has access to view devices
    * Wait additional time - first sync may take longer than 1 hour
    * Review ThreatAware integration logs for error messages
    * Contact ThreatAware support if data collection continues to fail
  </Accordion>
</AccordionGroup>

## Important notes

<Warning>
  **API Credential Security**

  * The **Client Secret** is displayed only once during API client creation
  * Store the secret securely immediately after creation
  * If you lose the secret, you must regenerate the API client
  * Never share API credentials with unauthorized users
</Warning>

<Tip>
  **Read-Only Access**

  * ThreatAware only requires **Read-only** permissions to Jamf Protect
  * Ensure the API client is configured with Read-only access
  * This prevents any accidental modifications to your Jamf environment
</Tip>

## Additional resources

<CardGroup cols={2}>
  <Card title="Jamf Protect API Documentation" icon="book" href="https://developer.jamf.com">
    Official Jamf API documentation for detailed setup and permissions
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **API Client Management**

  * Create a dedicated API client specifically for ThreatAware integration
  * Document the Client ID and purpose in your integration records
  * Store the Client Secret securely in your organisation's password manager
  * Rotate API credentials annually or per your security policy
  * Monitor Jamf Protect audit logs for API usage activity
</Tip>

<Tip>
  **Integration Maintenance**

  * Verify the integration status regularly to ensure continuous data flow
  * Monitor for any permission or access issues
  * Test the connection periodically to catch any problems early
  * Keep your Jamf Protect instance and ThreatAware up to date
</Tip>