Skip to main content
All Jamf Pro integration capabilities

​
About

Stream Jamf Pro events into Sazabi so device posture sits next to your identity and endpoint alerts: which Macs and mobile devices enrolled or left management, what their inventory reports, which policies and patch policies ran, which devices joined or left a compliance smart group, and who changed Jamf Pro through its API. Jamf Pro sends each event as a JSON webhook. Each webhook carries one event type, so you create one webhook per event, all pointed at the same Sazabi intake URL. The key is part of the URL’s hostname, so the webhook needs no authentication in Jamf Pro. Sazabi timestamps each log from the webhook’s eventTimestamp, stores the Jamf event object as the log body, and promotes these attributes when the event includes the field: Device fields are read from the event, or from its computer object for computer events such as ComputerInventoryCompleted and ComputerPolicyFinished. Jamf Pro Change Management (audit) logs are not supported. Jamf Cloud cannot export them, and this source only receives webhooks.

​
Prerequisites

  • A Jamf Pro server (Jamf Cloud or on-premises).
  • A Jamf Pro administrator account that can create webhooks.
  • Your Sazabi intake URL (shown above).

​
Set up in the dashboard

Create one webhook per event. We recommend these events for security and compliance context: ComputerCheckIn fires on every device check-in and can be very high volume. Add it only if you need it.
1

​
Open the webhooks page

Sign in to your Jamf Pro server as an administrator, go to Settings > Global > Webhooks, and click New.
2

​
Configure the webhook

  • Display Name: Sazabi (add the event name if you create several)
  • Enabled: on
  • Webhook URL: paste your Sazabi intake URL (shown above)
  • Authentication Type: None
  • Content Type: JSON. XML is not supported.
  • Webhook Event: the event to send
Click Save.
3

​
Repeat for each event

Create one webhook for each event you chose, with the same intake URL.

​
Set up with the CLI

You can also register the Jamf Pro log source with the Sazabi CLI (installed and authenticated — see CLI reference). Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
The command prints the intake URL for the new source. Paste it into each Jamf Pro webhook’s Webhook URL field. Run sazabi log-sources list --provider jamf_pro to see your Jamf Pro log sources.

​
Verify

Trigger one of the events you chose. For example, run sudo jamf recon on an enrolled Mac to send ComputerInventoryCompleted, or change any object through the Jamf Pro API to send RestAPIOperation. Open the Intake page in the Sazabi dashboard and confirm logs from the Jamf Pro source appear.

​
Troubleshooting

No logs after saving the webhook — Confirm the webhook is enabled and its URL matches your Sazabi intake URL exactly. Most events fire only on a real change, so trigger the event again. An on-premises Jamf Pro server needs outbound HTTPS access to the intake host. Logs arrive as raw XML with no jamf.* fields — The webhook’s content type is XML. Sazabi stores non-JSON payloads as plain text logs, timestamped at receipt. Change the content type to JSON and save. HTTP 401 — The intake key is wrong or was deactivated. Create a new Jamf Pro log source and update every webhook with its URL.

​
Further reading

Intake

See per-source ingestion volume and health in the Intake page.

Jamf Pro webhooks

Jamf’s reference for webhook events and payloads.

Log sources

Browse the full log source catalog.