> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Jamf Pro

> Create Jamf Pro webhooks pointed at your Sazabi intake URL to stream device enrollment, inventory, policy, smart group, and API activity events.

[All Jamf Pro integration capabilities](https://docs.sazabi.com/catalogs/integrations/jamf-pro)

## About

Stream Jamf Pro events into Sazabi so device posture sits next to your identity and endpoint alerts: which Macs and mobile devices enrolled or left management, what their inventory reports, which policies and patch policies ran, which devices joined or left a compliance smart group, and who changed Jamf Pro through its API.

Jamf Pro sends each event as a JSON webhook. Each webhook carries one event type, so you create one webhook per event, all pointed at the same Sazabi intake URL. The key is part of the URL's hostname, so the webhook needs no authentication in Jamf Pro.

Sazabi timestamps each log from the webhook's `eventTimestamp`, stores the Jamf `event` object as the log body, and promotes these attributes when the event includes the field:

| Attribute | Jamf field |
| - | - |
| `jamf.webhook.event` | `webhook.webhookEvent` |
| `jamf.webhook.id` / `jamf.webhook.name` | `webhook.id` / `webhook.name` |
| `jamf.device.serial_number` | `serialNumber` |
| `jamf.device.udid` | `udid` |
| `jamf.device.name` | `deviceName` |
| `jamf.device.os_version` | `osVersion` |
| `jamf.device.ip_address` | `ipAddress` |
| `jamf.user.name` | `username` |
| `jamf.api.authorized_username` | `authorizedUsername` (`RestAPIOperation`) |
| `jamf.api.operation_type` | `restAPIOperationType` (`RestAPIOperation`) |
| `jamf.api.object_type` / `jamf.api.object_name` | `objectTypeName` / `objectName` (`RestAPIOperation`) |

Device fields are read from the event, or from its `computer` object for computer events such as `ComputerInventoryCompleted` and `ComputerPolicyFinished`.

Jamf Pro Change Management (audit) logs are not supported. Jamf Cloud cannot export them, and this source only receives webhooks.

## Prerequisites

* A Jamf Pro server (Jamf Cloud or on-premises).
* A Jamf Pro administrator account that can create webhooks.
* Your Sazabi intake URL (shown above).

## Set up in the dashboard

Create one webhook per event. We recommend these events for security and compliance context:

| Event | What it tells you |
| - | - |
| `ComputerAdded` | A new Mac was added to Jamf Pro |
| `ComputerInventoryCompleted` | A Mac submitted inventory |
| `ComputerPolicyFinished` | A policy ran on a Mac, and whether it succeeded |
| `ComputerPatchPolicyCompleted` | A patch policy finished on a Mac |
| `SmartGroupComputerMembershipChange` | Macs entered or left a smart group, such as a compliance group |
| `MobileDeviceEnrolled` / `MobileDeviceUnEnrolled` | A mobile device enrolled or left management |
| `RestAPIOperation` | Someone changed Jamf Pro through the API |

`ComputerCheckIn` fires on every device check-in and can be very high volume. Add it only if you need it.

**Step 1**

### Open the webhooks page

Sign in to your Jamf Pro server as an administrator, go to **Settings > Global > Webhooks**, and click **New**.

**Step 2**

### Configure the webhook

* **Display Name**: `Sazabi` (add the event name if you create several)
* **Enabled**: on
* **Webhook URL**: paste your Sazabi intake URL (shown above)
* **Authentication Type**: **None**
* **Content Type**: **JSON**. XML is not supported.
* **Webhook Event**: the event to send

Click **Save**.

**Step 3**

### Repeat for each event

Create one webhook for each event you chose, with the same intake URL.

## Set up with the CLI

You can also register the Jamf Pro log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):

```bash theme={"system"}
sazabi log-sources create jamf_pro
```

The command prints the intake URL for the new source. Paste it into each Jamf Pro webhook's **Webhook URL** field. Run `sazabi log-sources list --provider jamf_pro` to see your Jamf Pro log sources.

## Verify

Trigger one of the events you chose. For example, run `sudo jamf recon` on an enrolled Mac to send `ComputerInventoryCompleted`, or change any object through the Jamf Pro API to send `RestAPIOperation`. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm logs from the **Jamf Pro** source appear.

## Troubleshooting

**No logs after saving the webhook** — Confirm the webhook is enabled and its URL matches your Sazabi intake URL exactly. Most events fire only on a real change, so trigger the event again. An on-premises Jamf Pro server needs outbound HTTPS access to the intake host.

**Logs arrive as raw XML with no `jamf.*` fields** — The webhook's content type is XML. Sazabi stores non-JSON payloads as plain text logs, timestamped at receipt. Change the content type to **JSON** and save.

**HTTP 401** — The intake key is wrong or was deactivated. Create a new Jamf Pro log source and update every webhook with its URL.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Jamf Pro webhooks](https://developer.jamf.com/developer-guide/docs/webhooks)
>
> Jamf's reference for webhook events and payloads.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.