Set up IoT Security and Cortex XSOAR for Jamf Pro Integration

Configure IoT Security and Cortex XSOAR

1. Log in to IoT Security, and from there access the Jamf Pro integration settings in Cortex XSOAR.

   1. Log in to IoT Security and select Integrations.
   2. Launch Cortex XSOAR from the IoT Security portal.

      When you Launch Cortex XSAOR, the Cortex XSOAR interface opens in a new browser tab or window.
   3. Click Settings, and on the integration page search for Jamf Pro to locate it among other integrations.
2. Configure the Jamf Pro integration instance.

   Depending on what version of Jamf Pro you're using, you need to configure either client credentials or account authentication. Enter in client credentials if using Jamf Pro version 10.49.0 or later. If using a Jamf Pro version earlier than 10.49.0, enter in account authentication credentials.

   1. Click Add instance to open the settings panel.
   2. In the settings panel, configure the following settings:

      • Name: Use the default name of the instance or enter a new one.
      • Jamf Pro URL: Enter the domain URL of the Jamf Pro instance.
      • 10.49.0 and later Client Credentials: Check this box to use a client ID and client secret to access Jamf Pro.
      • Client ID or Username: Enter the client ID or username for Jamf Pro.
      • Client Secret or Password: Enter the client secret or password for Jamf Pro.
      • Use single engine: When using a cloud-based Cortex XSOAR instance and an on-premises Jamf Pro server, choose the Cortex XSOAR engine that you want to communicate with the Jamf Pro server.

      

   3. When finished, click Test or Test resultsRun test to test the integration instance.

      If the test is successful, a Success message appears. If not, check that the settings were entered correctly, and then test the configuration again.

      

   4. After the test succeeds, click Save & exit to save your changes and close the settings panel.
3. Create a job for Cortex XSOAR to send and receive information from Jamf Pro.

   Depending on whether you want to import device details or enable device locking, select the appropriate playbook when configuring the job. If you want to import devices and lock devices, you must create separate jobs, one for each playbook. You can also create multiple jobs if you have multiple integration instances.

   1. Click Jobs in the sidebar, and then click New Job to create a new Cortex XSOAR job.
   2. Configure the following settings in the New Job panel:

      • Optional Recurring: Select this if you want to periodically run the job. Clear it if you want to run the job on-demand.
        If you're configuring a job to lock devices through IoT Security, you don't need to select Recurring. IoT Security runs the device locking job when you send a command from the IoT Security portal.
      • Optional Every: If you selected Recurring, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, then the job will run every day by default. This determines how often Cortex XSOAR queries Jamf Pro to send and receive information.
        You can configure Queue Handling to determine what happens if a new job starts while an old job is still running.
      • Name: Enter a name for the job.
      • Playbook: Select the playbook depending on the type of job you're configuring. You can select one of the following playbooks when integrating with Jamf Pro:
        • Import JAMF Devices to PANW IoT cloud
        • JAMF Lock a Device - PANW IoT 3rd Party Integration

        

      • Integration Instance Name: Enter the instance name of the integration instance you created.
      • Import devices playbook Polling Duration in days: Enter the time range in days that you want to get device information from Jamf Pro. IoT Security polls for all devices that were active in Jamf Pro during the polling range. The default polling duration is a lookback of one day.
   3. Click Create new job and verify that the job appears in the Jobs list.
4. Enable the job and run it.

   1. Check the Job Status for the job you created. If it's Disabled, select its check box and then click Enable.
   2. If you enabled the sync job, keep the check box selected and click Run now. The Run Status changes from Idle to Running.

      If you selected Recurring, Cortex XSOAR queries Jamf Pro at the defined interval and sends information to IoT Security.

      If you cleared Recurring, Cortex XSOAR immediately queries Jamf Pro.
5. Return to the IoT Security portal and check the status of the Jamf Pro integration.

   An integration instance can be in one of the following four states, which IoT Security displays in the Status column on the Integrations page:

   • Disabled — either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
   • Error — the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
   • Inactive — the integration was configured and enabled but no job has run for at least the past 60 minutes.
   • Active — the integration was configured and enabled and is functioning properly.

   When you see that the status of an integration instance is Active, its setup is complete.