Description
Network logging in Mac Endpoint Telemetry, also referred to as Network Telemetry, expands Jamf Protect telemetry by logging inbound and outbound network connections from managed Mac computers.
Network Telemetry records network_connect events, including associated processes, domains, IP addresses, and protocols. This additional context can help security teams meet compliance requirements and conduct deeper endpoint investigations.
Collected data can be sent to a configured SIEM solution for searching, visualization, and analysis.
Note: Network Telemetry is available beginning June 18, 2026. Customers must use the latest version of Mac Endpoint Telemetry. Customers using deprecated telemetry configurations must migrate before the Network option is available.
This release provides:
Logging for inbound and outbound network connections
Additional context for endpoint investigations
Support for third-party SIEM integrations
Built-in exceptions for macOS platform binaries and high-volume safe processes
Enabling Network Telemetry
To enable Network Telemetry:
Navigate to Configuration > Telemetry.
Create a new telemetry configuration or edit an existing configuration that uses the latest version of telemetry.
Select the Network category.
Save the configuration and add it to the desired plan.
Deploy the updated plan to the target computers.
Important Note: Selecting the Network category alone does not enable network logging. The Network Content Filter configuration profile must also be installed on each target computer.
Deploying the Network Content Filter Profile
To deploy the required profile:
Download the signed Network Content Filter configuration profile from the macOS Security Portal. Administrative>Downloads>Network Content Filter Profile
Upload the profile to Jamf Pro.
Scope the profile to the target Mac computers.
Confirm that the profile has been successfully installed.
Jamf Pro is the standard deployment method. The profile can also be uploaded to another supported MDM solution, such as Jamf School.
Known Issue
Customers using Google Meet in Google Chrome may experience frozen or crashed meeting sessions if an auto-update occurs while Network Telemetry is enabled.
Before deploying the feature broadly, administrators should review the warning displayed in the Jamf Protect web app and follow the linked technical documentation.
Information to Collect
When troubleshooting Network Telemetry, collect the following information.
Jamf Protect Agent Information
Use the following command to gather detailed information about the Jamf Protect agent configuration:
/usr/local/bin/protectctl info -v
Installed Configuration Profiles
Use the following command to confirm that the Network Content Filter configuration profile is installed:
/usr/bin/profiles show -type configuration
Jamf Protect Daemon Activity
Use the following command to collect historical activity logs from the Jamf Protect daemon:
/usr/bin/log show --debug --predicate "subsystem == 'com.jamf.protect.daemon' && category != 'Cache'"
Additionally, confirm the following:
The customer is using the latest version of Mac Endpoint Telemetry.
The Network category is selected in the telemetry configuration.
The correct plan is assigned and deployed.
The Network Content Filter configuration profile is installed.
The expected SIEM destination is configured correctly.