Jamf

Scanner supports Jamf logs, which contain information related to device management, security, and user activities on Apple devices. In order for Scanner to see these logs, you can configure Jamf to publish them to an S3 bucket that Scanner is linked to.

Step 1: Publish to S3

You can use Jamf Log Stream to write logs to S3. You must reach out to Jamf support to enable this feature. Follow the Jamf documentation to set up S3 export. See: Jamf Premium Cloud Prerequisites.

Step 2: Ingest via Scanner Collect

Follow the Create an Index Rule guide to ingest logs from S3 via Scanner Collect.