Skip to main content
Jamf Internet Security (Jamf Security Cloud) streams threat events to Wirespeed in real time using a Threat Events data stream with a Generic HTTP target. Each event (for example, a blocked phishing domain or a malicious app found on a device) becomes a detection in Wirespeed.

​
Setup in Wirespeed

  1. Login to Wirespeed and navigate to Integrations > Add Integration > Jamf Internet Security
  2. Enter a Source Name to identify this Jamf Security Cloud tenant
  3. Click Integrate
  4. Select Webhook Details
  5. Copy the Webhook URL and Webhook Secret
The Webhook URL has the form:

​
Configure the data stream in Jamf Security Cloud

  1. Login to Jamf Security Cloud and navigate to Integrations > Data Streams
  2. Click New configuration
  3. Select Threat Events as the data stream type
  4. Select Generic HTTP as the target type, then click Continue
  5. Enter a configuration name (e.g., Wirespeed)
  6. Fill in the HTTP connection details from the Wirespeed Webhook URL:
    • Protocol: https
    • Server Hostname/IP: the <API_HOST> portion of the URL
    • Port: 443
    • Endpoint: everything after the host, starting at /integration/webhook/... and including the ?teamId=...&integrationId=... query string
  7. Under Additional Headers, click Add header and enter:
    • Name: Authorization
    • Value: Bearer <WEBHOOK_SECRET>
  8. Click Test Configuration
  9. Turn on Enable configuration and click Save
The Authorization header is required. Wirespeed rejects deliveries that do not include the correct webhook secret.
Jamf Generic HTTP data stream documentation

​
What Gets Ingested

Wirespeed ingests every event from the Threat Events stream, including:
  • Risky hosts and domains: phishing, malware, spam, and cryptojacking destinations
  • Malicious and risky apps: malware, adware, spyware, sideloaded, and third-party app store apps
  • Device risks: jailbreak/root, risky iOS profiles, dangerous certificates, and out-of-date operating systems
  • Network threats: man-in-the-middle attacks and risky hotspots
Each detection is titled with Jamf’s event type (for example, ACCESS_PHISHING_HOST) and includes whichever of these fields Jamf sends for that event:
  • The affected device and the user’s email
  • The app, with hashes when available
  • Source and destination IPs, and the destination domain
  • A link back to the event in Jamf Security Cloud
Which fields appear depends on the event type. For example, device-risk events such as jailbreak detection usually have no app or network details. Jamf’s Blocked action is recorded as blocked, and Resolved events are recorded as mitigated.
Only the Threat Events data stream is ingested. The Access Events, App Insights, Device Data, Network Traffic, and Vulnerability Data streams are not.