---
title: "Integrate Jamf EDR with Red Canary"
slug: "integrate-jamf-edr-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-jamf-edr-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Jamf EDR with Zscaler MDR

Integrating Jamf EDR with Zscaler MDR provides a comprehensive security solution for Apple environments. Please note that the integration of Jamf EDR requires the support of the Zscaler MDR Technical Implementation Manager Team. To integrate Jamf EDR with Zscaler MDR, follow the procedure below from beginning to end.

## **Prerequisites**

Before you connect Jamf to Zscaler MDR, make sure the following configuration requirements are met:

- Zscaler MDR Managed Detection & Response (MDR) requires Jamf Pro and Jamf Protect.
- Jamf Pro and Jamf Protect must be deployed, configured, and enabled within your security environment.
- Jamf Pro must be a cloud implementation, not an on-premise install.
- The minimum supported macOS version is Catalina (version 10.15).
- Your Zscaler MDR contact must create an Amazon Web Service (AWS) role so Jamf can write telemetry to a Zscaler MDR Amazon Simple Storage Service (S3) bucket. This will be provided by your implementation manager on your integration call.
- Zscaler MDR requires API access on Jamf Protect products and a service account on Jamf Pro to manage the integration.
  - **Jamf Protect:** API access is required to manage the Zscaler MDR analytic which exports, grooms, and controls telemetry data flows from Jamf Protect.
  - **Jamf Pro:** A service account enables endpoint correlation and response actions.

> **Note**: The **Jamf Protect** Zscaler MDR plan should be scoped to all endpoints in Jamf Pro that the customer requires monitoring.

To avoid plans interacting with one other, the Jamf Protect Default plan should be de-scoped from these endpoints.

## **Step 1: Jamf–Create a Jamf Protect API client ID**

Create a Jamf Protect API client ID to begin the Jamf integration process with Zscaler MDR.

1. From your Jamf Protect dashboard, click the **Administrative** dropdown, and then click **API Clients**. ![2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/5581080151063.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
2. Click **Create API Client**.
  - Include Zscaler MDR in the API client name to make tracking and troubleshooting easier.
  - Confirm that the API Client role is set to Full Admin.
3. Copy and save the API client password.

> **Note**: This is the only time the password will be available in clear text.
4. Copy and save the Client ID.
5. With your API client ID copied, log in to Zscaler MDR.

## **Step 2: Jamf–Create a Jamf Pro Service Account**

Zscaler MDR requires a service account with the following access within Jamf Pro.

1. Within the Jamf Pro console click **Settings** in the top-right corner of the page.
2. In the systems settings section click [**Jamf Pro User Accounts and Groups**](https://docs.jamf.com/10.25.0/jamf-pro/administrator-guide/Jamf_Pro_User_Accounts_and_Groups.html#:~:text=Creating%20a%20Jamf%20Pro%20User%20Account).
3. Click **New**.
4. Select **Create Standard Account** and click **Next**.
5. From the **Access Level** pop-up menu, select **Full Access**.
6. **From** the **Privilege Set** pop-up menu, select **Custom**.
7. Select the following permissions set.
  - Computers: **Read**
  - Static Computer Groups: **Read** and **Update**

![clip2.jpg](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13014083437847.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)

![clip1.jpg](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13014069638807.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
8. Click **Save**.

## **Step 3: Jamf–Configure Jamf endpoint analytic**

Create a Zscaler MDR analytic that will be used with Zscaler MDR-configured Jamf plans. Due to the large telemetry requirements, Jamf plans must be specially configured to enable proper telemetry flow, and analytics will not be effective outside of the Zscaler MDR managed Jamf plan.

1. From your Jamf Protect dashboard, click **Analytics**.
2. Click the **All Analytics** tab.

> **Note**: An analytic is a configuration that tells an endpoint which events to log.

![New_1.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235356461079.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
3. Click **Create custom analytic**.

![New_2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235309881111.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
4. Create a new **Process Event Analytic** by filling in the required fields.

| **Field** | **What you'll fill in** |
| --- | --- |
| Analytic Name | Zscaler MDR: Process |
| Log Level | 0 (Default) |
| Categories | Zscaler MDR - Create a new category if Zscaler MDR does not already exist. |
| Severity | Informational (Default) |
| Sensory Type | Process Event |
| Filter Text View | (( $event.type IN { 0, 1, 2 } )) |

![New_3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235356945431.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D) ![New_4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235356871575.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
5. Click **Save**.

## **Step 4: Jamf–Create the Zscaler MDR analytic set**

Create the group of analytics to determine what telemetry gets sent to Zscaler MDR.

1. From your Jamf Protect dashboard, click **Analytics**.
2. Click the **Analytic Sets** tab.
3. Click **+Create Analytic Set**.

![New_5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235357195927.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
4. Enter a name for your Analytic Set.
5. From the **Analytics in this set** section, click the **Custom** tab.
6. Select the Zscaler MDR: Process analytic set from [Step 4.4](https://redcanary.document360.io/docs/integrate-jamf-edr-with-red-canary#step-4-jamf%E2%80%93configure-jamf-endpoint-analytic:~:text=Create%20a%20new%20Process%20Event%20Analytic%20by%20filling%20in%20the%20required%20fields.).

![New_6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235510213143.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
7. Click **Save**.

## **Step 5: Jamf–Create the Zscaler MDR Managed plan**

Create the plan that will be deployed on your endpoints to start sending telemetry to Zscaler MDR.

1. From your Jamf Protect dashboard, click the **Configuration** dropdown, and then click **Plans**.
2. Click **Create Plan**. ![New_7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235378052503.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
3. Enter a name for your Plan.
4. From the Analytic Sets dropdown, select the analytic set from [Step 5.4](https://redcanary.document360.io/docs/integrate-jamf-edr-with-red-canary#step-4-jamf%E2%80%93configure-jamf-endpoint-analytic:~:text=Enter%20a%20name%20for%20your%20Analytic%20Set.).

![New_8.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/13235378201751.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)

## **Step 6: Jamf–Configure your Jamf Protect data forwarding**

Configure Jamf Protect to forward telemetry from your endpoints to the Zscaler MDR collection facilities hosted by Amazon S3. This data forwarding allows Zscaler MDR to analyze endpoint activity and enable threat detection. Endpoint telemetry will be created and managed by the Zscaler MDR plan and Zscaler MDR analytics created within Jamf in the prior steps.

1. From your Jamf Protect dashboard, click the **Administrative** dropdown, and then click **Data**. ![6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/5581080232471.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
2. Enable **Amazon S3 Forwarding**.
3. Enable **Encrypt Forwarded Data**.
4. Fill in the following fields:

| **Field** | **What you'll fill in** |
| --- | --- |
| Amazon S3 Bucket Name | **rc-jamf-protect-native-us-east-2** |
| Prefix | **cust_name=** Description: The Prefix has match the user’s external service namespace. This will be sent via email. |
| IAM Role | **arn:aws:iam::498172931776:role/** **-jamf-protect-role** Description: IAM Details will be provided to you in an email and will be of similar form as above with carrots removed and the user's namespace filled in. |

![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/5581074804631.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
5. Click **Save**.
6. JAMF will immediately attempt to verify the S3 bucket access. If it saves successfully that means it’s working, otherwise it’ll provide an error message
  1. If an error message is encountered first verify the Prefix field is properly configured with cust_name=subdomain_name.
  2. If the error persists, contact engineering to verify the IAM role was properly provisioned.

## **Step 7: Jamf–Synchronize or upload the plan from Jamf Protect to Jamf Pro**

After configuring data forwarding, you’ll want to apply your Jamf Protect configurations onto endpoints. First, you’ll need to update Jamf Pro by synchronizing the Jamf Protect configured Jamf Plan into Jamf Pro. Learn more about [synchronizing or uploading the plan from Jamf Protect to Jamf Pro.](https://docs.jamf.com/10.32.0/jamf-pro/administrator-guide/Jamf_Protect_Integration_with_Jamf_Pro.html#:~:text=Jamf%20Protect%20Plans%20in%20Jamf%20Pro)

## **Step 8: Jamf–Assign computers to the Jamf plan in Jamf Pro**

Apply the Jamf Plan managed by Jamf Pro to the endpoints you want to monitor by assigning computers to this Jamf Plan. Learn more about [assigning computers to the plan in Jamf Pro.](https://docs.jamf.com/jamf-protect/documentation/Plans.html)

## **Step 9: Jamf/Zscaler MDR–Isolate and De-isolate Endpoints**

You can specify which endpoints can be isolated during the containment phase of incident response. This involves creating a static group within Jamf Pro and then updating the Zscaler MDR Jamf integration to reference that group. Once configuration is complete, the endpoints within the group can be isolated either manually or automatically.

You’ll need to have created a static group in Jamf Pro before you complete the steps below. To create a static group, follow the steps in the [Jamf Pro documentation](https://docs.jamf.com/10.32.0/jamf-pro/administrator-guide/Static_Groups.html).

#### Configure Your Static Group in Jamf Pro

1. Log in to Jamf Pro and find your network configuration profile.
2. Select the **Scope** tab, then click **Exclusions**.
3. Click **Computer Group**, then click **Add**.
4. Select your static group.
5. Configure your static group with the required Jamf Pro network restrictions.
6. Click **Save**.

#### Configure the Jamf Integration in Zscaler MDR

1. From your Zscaler MDR portal, go to the **Integrations** page.
2. In the Alert Sources table, click on your Jamf Integration (Ingest Type: Streaming).![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/jamf-integration-9_01.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
3. Click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/jamf-integration-9_02.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
4. From the **Jamf Network Isolation Group** dropdown, select the static group you configured in the previous step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/jamf-integration-9_03.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A04%3A35Z&se=2026-10-27T03%3A04%3A35Z&sr=c&sp=r&sig=NKfnnqz5tQbqwzOHedPY1g55UfOFMewLpTpEIdJItz4%3D)
5. Click **Save**.

Now that you've set up your endpoints for isolation, you can respond to threats by [manually isolating or de-isolating endpoints](/doc/docs/contain-threats-with-network-isolation) as needed, or by [configuring automations](/doc/docs/use-automation-to-combat-threats#isolate-and-remediate-workstations-affected-by-malicious-software) to handle the process automatically.