Jamf Protect via Webhook

Collect analytic and security events from Jamf Protect Cloud — including screenshot detection, prevented execution, and Gatekeeper blocks — by forwarding them to RunReveal via webhook. For S3-based ingestion, see Jamf Protect Logs.

Prerequisites

• Jamf Protect Cloud admin access — configure action configurations and data endpoints.
• RunReveal account with permission to add sources and view logs.
• Jamf Protect analytics producing events you want to forward.

Step 1: Generate a Webhook Endpoint in RunReveal

1. Open Sources in RunReveal and click Add Source.
2. Select Jamf Protect via Webhook (or JAMF Protect with webhook ingest).
3. Save the source with a clear name to generate the webhook URL.
4. Copy the webhook endpoint URL.

Step 2: Create a Data Endpoint Action in Jamf Protect Cloud

1. Log in to Jamf Protect Cloud.
2. Go to Settings → Action Configurations.
3. Click New and choose Data Endpoint.
4. Name it (e.g. “RunReveal Webhook”).
5. Set Endpoint URL to your RunReveal webhook URL, Method POST, Content-Type application/json, and Data Format JSON.

See Creating an Action Configuration in Jamf’s documentation.

Step 3: Attach Analytics

Attach your Data Endpoint action to the analytics or groups you want. Common event types include GPScreenshotEvent, GPGatekeeperEvent, GPPreventedExecutionEvent, and GPThreatMatchExecEvent.

Example security event payload

{
  "caid": "CAID_HASH",
  "certid": "CERT_ID_HASH",
  "input": {
    "eventType": "GPScreenshotEvent",
    "host": {
      "hostname": "HOST_NAME",
      "ips": ["192.0.2.1"],
      "os": "Version 15.4.1 (Build 24E263)",
      "protectVersion": "7.0.0.9",
      "provisioningUDID": "UDID_VALUE",
      "serial": "SERIAL_NUMBER"
    },
    "match": {
      "event": {
        "path": "/Users/user/Documents/Screenshots/example.png",
        "timestamp": 1747062957.09414,
        "uuid": "EVENT_UUID"
      },
      "tags": ["MITREattack", "T1113", "ScreenCapture", "Collection"],
      "uuid": "MATCH_UUID"
    }
  }
}

Step 4: Validate Delivery

Open your source in RunReveal, confirm events are arriving, and query them in Explorer or Native AI Chat.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Troubleshooting

• No events — Verify the Data Endpoint action is enabled, analytics are firing, and the URL matches your RunReveal webhook.
• 401/403 from RunReveal — Check bearer token or URL if your org requires them.

Helpful Links

• Jamf Protect Logs (S3)
• Analytic Descriptions — Jamf Protect
• Creating an Action Configuration