We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for JAMF_PRO_CONTEXT

Date	Changes
2026-07-13	Enhancement: - `event.idm.read_only_udm.metadata.entity.labels`: Removed mappings of multiple raw log fields from `event.idm.read_only_udm.metadata.entity.labels` UDM field as it is a deprecated UDM field. - `event.idm.read_only_udm.metadata.entity.user.attribute.labels`: Mapped multiple raw log fields with `event.idm.read_only_udm.metadata.entity.user.attribute.labels` UDM field. - `event.idm.read_only_udm.metadata.event_metadata.log_type`: Newly mapped `JAMF_PRO_CONTEXT` value with `event.idm.read_only_udm.metadata.event_metadata.log_type` UDM field. - `event.idm.read_only_udm.entity.user.attribute.labels`: Newly mapped `diskEncryption.institutionalRecoveryKeyPresent`, `diskEncryption.fileVault2Enabled`, `application.version`, `application.macAppStore`, `application.sizeMegabytes`, `application.updateAvailable`, `application.externalVersionId`, `configurationProfile.lastInstalled`, `configurationProfile.removable`, and `configurationProfile.uuid` raw log fields with `event.idm.read_only_udm.entity.user.attribute.labels` UDM field. - `event.idm.read_only_udm.entity.asset.attribute.labels`: Newly mapped `printer.name`, `printer.type`, `printer.uri`, and `printer.location` raw log fields with `event.idm.read_only_udm.entity.asset.attribute.labels` UDM field. - `event.idm.read_only_udm.entity.user.phone_numbers`: Newly mapped `userAndLocation.phone` raw log field with `event.idm.read_only_udm.entity.user.phone_numbers` UDM field.
2025-11-28	Enhancement: - `event.idm.read_only_udm.entity.labels`: Newly mapped fields `_jamf.raw.services.name`,`_jamf.raw.general.extensionAttributes.definitionId`,`_jamf.raw.general.extensionAttributes.name`,`_jamf.raw.general.extensionAttributes.description`,`_jamf.raw.general.extensionAttributes.dataType`,`_jamf.raw.general.extensionAttributes.inputType`,`_jamf.raw.general.extensionAttributes.enabled`,`_jamf.raw.general.extensionAttributes.multiValue`,`_jamf.raw.general.mdmCapable.userManagementInfo.managementId`,`_jamf.raw.general.mdmCapable.userManagementInfo.capableUser`,`_jamf.raw.userAndLocation.extensionAttributes.definitionId`,`_jamf.raw.userAndLocation.extensionAttributes.name`,`_jamf.raw.userAndLocation.extensionAttributes.description`,`_jamf.raw.userAndLocation.extensionAttributes.dataType`,`_jamf.raw.userAndLocation.extensionAttributes.inputType`,`_jamf.raw.userAndLocation.extensionAttributes.enabled`,`_jamf.raw.userAndLocation.extensionAttributes.multiValue`,`_jamf.raw.configurationProfiles.id`,`_jamf.raw.configurationProfiles.username`,`_jamf.raw.configurationProfiles.lastInstalled`,`_jamf.raw.configurationProfiles.removable`,`_jamf.raw.configurationProfiles.displayName`,`_jamf.raw.configurationProfiles.profileIdentifier`,`_jamf.raw.certificates.commonName`,`_jamf.raw.certificates.identity`,`_jamf.raw.certificates.expirationDate`,`_jamf.raw.certificates.username`,`_jamf.raw.certificates.lifecycleStatus`,`_jamf.raw.certificates.certificateStatus`,`_jamf.raw.certificates.subjectName`,`_jamf.raw.certificates.serialNumber`,`_jamf.raw.certificates.sha1Fingerprint`,`_jamf.raw.certificates.issuedDate`,`_jamf.raw.hardware.extensionAttributes.definitionId`,`_jamf.raw.hardware.extensionAttributes.name`,`_jamf.raw.hardware.extensionAttributes.description`,`_jamf.raw.hardware.extensionAttributes.dataType`,`_jamf.raw.hardware.extensionAttributes.inputType`,`_jamf.raw.hardware.extensionAttributes.enabled`,`_jamf.raw.hardware.extensionAttributes.multiValue`,`_jamf.raw.contentCaching.computerContentCachingInformationId`,`_jamf.raw.contentCaching.activated`,`_jamf.raw.contentCaching.active`,`_jamf.raw.contentCaching.actualCacheBytesUsed`,`_jamf.raw.contentCaching.cacheBytesFree`,`_jamf.raw.contentCaching.cacheBytesLimit`,`_jamf.raw.contentCaching.cacheStatus`,`_jamf.raw.contentCaching.cacheBytesUsed`,`_jamf.raw.contentCaching.dataMigrationCompleted`,`_jamf.raw.contentCaching.dataMigrationProgressPercentage`,`_jamf.raw.contentCaching.dataMigrationError.code`,`_jamf.raw.contentCaching.dataMigrationError.domain`,`_jamf.raw.contentCaching.maxCachePressureLast1HourPercentage`,`_jamf.raw.contentCaching.personalCacheBytesFree`,`_jamf.raw.contentCaching.personalCacheBytesLimit`,`_jamf.raw.contentCaching.personalCacheBytesUsed`,`_jamf.raw.contentCaching.port`,`_jamf.raw.contentCaching.publicAddress`,`_jamf.raw.contentCaching.registrationError`,`_jamf.raw.contentCaching.registrationResponseCode`,`_jamf.raw.contentCaching.registrationStarted`,`_jamf.raw.contentCaching.registrationStatus`,`_jamf.raw.contentCaching.restrictedMedia`,`_jamf.raw.contentCaching.serverGuid`,`_jamf.raw.contentCaching.startupStatus`,`_jamf.raw.contentCaching.tetheratorStatus`,`_jamf.raw.contentCaching.totalBytesAreSince`,`_jamf.raw.contentCaching.totalBytesDropped`,`_jamf.raw.contentCaching.totalBytesImported`,`_jamf.raw.contentCaching.totalBytesReturnedToChildren`,`_jamf.raw.contentCaching.totalBytesReturnedToClients`,`_jamf.raw.contentCaching.totalBytesReturnedToPeers`,`_jamf.raw.contentCaching.totalBytesStoredFromOrigin`,`_jamf.raw.contentCaching.totalBytesStoredFromParents`,`_jamf.raw.contentCaching.totalBytesStoredFromPeers`,`_jamf.raw.operatingSystem.name`,`_jamf.raw.operatingSystem.version`,`_jamf.raw.operatingSystem.build`,`_jamf.raw.operatingSystem.supplementalBuildVersion`,`_jamf.raw.operatingSystem.rapidSecurityResponse`,`_jamf.raw.operatingSystem.activeDirectoryStatus`,`_jamf.raw.operatingSystem.fileVault2Status`,`_jamf.raw.operatingSystem.softwareUpdateDeviceId`,`_jamf.raw.security.sipStatus`,`_jamf.raw.security.gatekeeperStatus`,`_jamf.raw.security.xprotectVersion`,`_jamf.raw.security.autoLoginDisabled`,`_jamf.raw.security.remoteDesktopEnabled`,`_jamf.raw.security.activationLockEnabled`,`_jamf.raw.security.secureBootLevel`,`_jamf.raw.security.externalBootLevel`,`_jamf.raw.security.bootstrapTokenAllowed`,`_jamf.raw.security.bootstrapTokenEscrowedStatus`,`_jamf.raw.security.recoveryLockEnabled`,`_jamf.raw.security.firewallEnabled`,`_jamf.raw.security.lastAttestationAttempt`,`_jamf.raw.security.lastSuccessfulAttestation`,`_jamf.raw.security.attestationStatus`,`_jamf.raw.hardware.make`,`_jamf.raw.hardware.model`,`_jamf.raw.hardware.modelIdentifier`,`_jamf.raw.hardware.serialNumber`,`_jamf.raw.hardware.processorSpeedMhz`,`_jamf.raw.hardware.processorCount`,`_jamf.raw.hardware.coreCount`,`_jamf.raw.hardware.processorType`,`_jamf.raw.hardware.processorArchitecture`,`_jamf.raw.hardware.busSpeedMhz`,`_jamf.raw.hardware.cacheSizeKilobytes`,`_jamf.raw.hardware.networkAdapterType`,`_jamf.raw.hardware.macAddress`,`_jamf.raw.hardware.altNetworkAdapterType`,`_jamf.raw.hardware.altMacAddress`,`_jamf.raw.hardware.totalRamMegabytes`,`_jamf.raw.hardware.openRamSlots`,`_jamf.raw.hardware.batteryCapacityPercent`,`_jamf.raw.hardware.batteryHealth`,`_jamf.raw.hardware.smcVersion`,`_jamf.raw.hardware.nicSpeed`,`_jamf.raw.hardware.opticalDrive`,`_jamf.raw.hardware.bootRom`,`_jamf.raw.hardware.bleCapable`,`_jamf.raw.hardware.supportsIosAppInstalls`,`_jamf.raw.hardware.appleSilicon`,`_jamf.raw.hardware.provisioningUdid`,`_jamf.raw.general.name`,`_jamf.raw.general.lastIpAddress`,`_jamf.raw.general.lastReportedIpV4`,`_jamf.raw.general.lastIpAddressV6`,`_jamf.raw.general.barcode1`,`_jamf.raw.general.barcode2`,`_jamf.raw.general.assetTag`,`_jamf.raw.general.reportDate`,`_jamf.raw.general.lastContactTime`,`_jamf.raw.general.lastCloudBackupDate`,`_jamf.raw.general.lastEnrolledDate`,`_jamf.raw.general.mdmProfileExpiration`,`_jamf.raw.general.initialEntryDate`,`_jamf.raw.general.distributionPoint`,`_jamf.raw.general.site.id`,`_jamf.raw.general.site.name`,`_jamf.raw.general.itunesStoreAccountActive`,`_jamf.raw.general.enrolledViaAutomatedDeviceEnrollment`,`_jamf.raw.general.userApprovedMdm`,`_jamf.raw.general.enrollmentMethod`,`_jamf.raw.general.declarativeDeviceManagementEnabled`,`_jamf.raw.general.managementId`,`_jamf.raw.general.lastLoggedInUsernameSelfService`,`_jamf.raw.general.lastLoggedInUsernameSelfServiceTimestamp`,`_jamf.raw.general.lastLoggedInUsernameBinary`,`_jamf.raw.general.lastLoggedInUsernameBinaryTimestamp`with `event.idm.read_only_udm.labels` UDM field. - `event.idm.read_only_udm.entity.user.attribute.labels`: Newly mapped fields `_jamf.raw.userAndLocation.username`,`_jamf.raw.userAndLocation.departmentId`,`_jamf.raw.userAndLocation.buildingId`,`_jamf.raw.userAndLocation.room` with `event.idm.read_only_udm.entity.user.attribute.labels` UDM field. - `event.idm.read_only_udm.entity.user.phone_numbers`: Newly mapped `_jamf.raw.userAndLocation.phone` raw log field with `event.idm.read_only_udm.entity.user.phone_numbers` UDM field.
2025-11-20	Enhancement: - `event.idm.read_only_udm.entity.asset.product_object_id`: Newly mapped `event_data.computer.udid` raw log field with `event.idm.read_only_udm.entity.asset.product_object_id` UDM field. - `event.idm.read_only_udm.entity.asset.attribute.creation_time`: Newly mapped `event_timestamp` raw log field with `event.idm.read_only_udm.entity.asset.attribute.creation_time` UDM field. - `event.idm.read_only_udm.entity.asset.platform_software.platform_version`: Newly mapped `_jamf.raw.general.jamfBinaryVersion` raw log field with `event.idm.read_only_udm.entity.asset.platform_software.platform_version` UDM field. - `event.idm.read_only_udm.entity.platform`: Newly mapped `_jamf.raw.general.platform` raw log field with `event.idm.read_only_udm.entity.platform` UDM field. - `event.idm.read_only_udm.entity.labels`: Newly mapped fields `application.name`,`application.path`,`application.version`,`application.macAppStore`,`application.sizeMegabytes`,`application.bundleId`,`application.updateAvailable`,`application.externalVersionId`,`_jamf.raw.purchasing.warrantyDate`,`_jamf.raw.purchasing.poDate`,`_jamf.raw.purchasing.leaseDate`,`_jamf.raw.purchasing.vendor`,`_jamf.raw.purchasing.appleCareId`,`_jamf.raw.purchasing.purchasingContact`,`_jamf.raw.purchasing.purchasingAccount`,`_jamf.raw.purchasing.purchasePrice`,`_jamf.raw.purchasing.lifeExpectancy`,`_jamf.raw.purchasing.poNumber`,`_jamf.raw.purchasing.leased`,`_jamf.raw.purchasing.purchased`,`_jamf.raw.diskEncryption.bootPartitionEncryptionDetails.partitionFileVault2Percent`,`_jamf.raw.diskEncryption.bootPartitionEncryptionDetails.partitionFileVault2State`,`_jamf.raw.diskEncryption.bootPartitionEncryptionDetails.partitionName`,`_jamf.raw.diskEncryption.fileVault2EligibilityMessage`,`_jamf.raw.diskEncryption.fileVault2Enabled`,`_jamf.raw.diskEncryption.diskEncryptionConfigurationName`,`_jamf.raw.diskEncryption.institutionalRecoveryKeyPresent`,`_jamf.raw.diskEncryption.individualRecoveryKeyValidityStatus`,`_jamf.raw.storage.bootDriveAvailableSpaceMegabytes`,`event_type`,`event_action`,`_jamf.id`,`_jamf.raw.id`,`_jamf.raw.general.remoteManagement.managed`,`_jamf.raw.general.remoteManagement.managementUsername`,`_jamf.raw.general.supervised`,`_jamf.raw.general.mdmCapable.capable`,`disk.type`, `disk.smartStatus`,`disk.sizeMegabytes`,`disk.serialNumber`,`disk.revision`,`disk.id`,`disk.device`,`disk.model`,`partition.lvmManaged`,`partition.fileVault2ProgressPercent`,`partition.fileVault2State`,`partition.percentUsed`,`partition.partitionType`,`partition.availableMegabytes`,`partition.sizeMegabytes`,`partition.name`,`extensionAttribute.multiValue`,`extensionAttribute.enabled`,`extensionAttribute.dataType`,`extensionAttribute.definitionId`,`extensionAttribute.name`,`extensionAttribute.description`, with `event.idm.read_only_udm.labels` UDM field. - `event.idm.read_only_udm.entity.user.attribute.labels`: Newly mapped fields `localUserAccount.azureActiveDirectoryId`,`localUserAccount.userAzureActiveDirectoryId`,`localUserAccount.computerAzureActiveDirectoryId`,`localUserAccount.passwordHistoryDepth`,`localUserAccount.passwordRequireAlphanumeric`,`localUserAccount.passwordMinComplexCharacters`,`localUserAccount.passwordMaxAge`,`localUserAccount.passwordMinLength`,`localUserAccount.fileVault2Enabled`,`localUserAccount.homeDirectorySizeMb`,`localUserAccount.homeDirectory`,`localUserAccount.userAccountType`,`localUserAccount.admin`,`localUserAccount.fullName`,`localUserAccount.uid`,`localUserAccount.userGuid`,`localUserAccount.username`,`groupMembership.smartGroup`,`groupMembership.groupDescription`,`groupMembership.groupName`,`groupMembership.groupId` with `event.idm.read_only_udm.entity.user.attribute.labels` UDM field. - `event.idm.read_only_udm.entity.asset.attribute.labels`: Newly mapped `printer.location`,`printer.uri`,`printer.type`,`printer.name`,`event_data.computer.modelIdentifier` raw log field with `event.idm.read_only_udm.entity.asset.attribute.labels` UDM field. - `event.idm.read_only_udm.entity.user.user_display_name`: Newly mapped `_jamf.raw.userAndLocation.realname` raw log field with `event.idm.read_only_udm.entity.user.user_display_name` UDM field. - `event.idm.read_only_udm.entity.user.email_addresses`: Newly mapped `_jamf.raw.userAndLocation.email` raw log field with `event.idm.read_only_udm.entity.user.email_addresses` UDM field. - `event.idm.read_only_udm.entity.user.title`: Newly mapped `_jamf.raw.userAndLocation.position` raw log field with `event.idm.read_only_udm.entity.user.title` UDM field.
2025-06-26	Enhancement: - event.idm.entity.entity.resource.name: Newly mapped `webhook.name` raw log field with `event.idm.entity.entity.resource.name` UDM field. - event.idm.entity.entity.ip: Newly mapped `event_data.ipAddress`, `event_data.reportedIpV4Address` and `event_data.reportedIpV6Address` raw log field with `event.idm.entity.entity.ip` UDM field. - event.idm.entity.entity.mac: Newly mapped `event_data.macAddress`, and `event_data.alternateMacAddress` raw log field with `event.idm.entity.entity.mac` UDM field. - event.idm.entity.entity.asset.asset_id: Newly mapped `event_data.udid` raw log field with `event.idm.entity.entity.asset.asset_id` UDM field. - event.idm.entity.entity.asset.product_object_id: Newly mapped `webhook.id` raw log field with `event.idm.entity.entity.asset.product_object_id` UDM field. - event.idm.entity.entity.asset.hostname: Newly mapped `event_data.deviceName` raw log field with `event.idm.entity.entity.asset.hostname` UDM field. - event.idm.entity.entity.asset.hardware.model: Newly mapped `event_data.model` raw log field with `event.idm.entity.entity.asset.hardware.model` UDM field. - event.idm.entity.entity.asset.hardware.serial_number: Newly mapped `event_data.serialNumber` raw log field with `event.idm.entity.entity.asset.hardware.serial_number` UDM field. - event.idm.entity.entity.asset.platform_software.platform_patch_level: Newly mapped `event_data.osBuild` raw log field with `event.idm.entity.entity.asset.platform_software.platform_patch_level` UDM field. - event.idm.entity.entity.platform_version: Newly mapped `event_data.osVersion` raw log field with `event.idm.entity.entity.platform_version` UDM field. - event.idm.entity.entity.user.userid: Newly mapped `event_data.userDirectoryID` raw log field with `event.idm.entity.entity.user.userid` UDM field. - event.idm.entity.entity.user.email_addresses: Newly mapped `event_data.emailAddress` raw log field with `event.idm.entity.entity.user.email_addresses` UDM field. - event.idm.entity.entity.user.user_display_name: Newly mapped `event_data.realName` raw log field with `event.idm.entity.entity.user.user_display_name` UDM field. - event.idm.entity.entity.user.phone_numbers: Newly mapped `event_data.phone` raw log field with `event.idm.entity.entity.user.phone_numbers` UDM field. - event.idm.entity.entity.user.title: Newly mapped `event_data.position` raw log field with `event.idm.entity.entity.user.title` UDM field. - event.idm.entity.entity.user.department: Newly mapped `event_data.department` raw log field with `event.idm.entity.entity.user.department` UDM field. - event.idm.entity.entity.user.office_address.floor_name: Newly mapped `event_data.building` raw log field with `event.idm.entity.entity.user.office_address.floor_name` UDM field. - event.idm.entity.entity.user.office_address.desk_name: Newly mapped `event_data.room` raw log field with `event.idm.entity.entity.user.office_address.desk_name` UDM field. - event.idm.entity.entity.ip: Newly mapped `event_data.computer.ipAddress`, `event_data.computer.reportedIpV4Address` and `event_data.computer.reportedIpV6Address` raw log field with `event.idm.entity.entity.ip` UDM field. - event.idm.entity.entity.mac: Newly mapped `event_data.computer.macAddress`, `event_data.computer.alternateMacAddress` and `event_data.computer.macAddress` raw log field with `event.idm.entity.entity.mac` UDM field. - event.idm.entity.entity.asset.asset_id: Newly mapped `event_data.computer.udid` raw log field with `event.idm.entity.entity.asset.asset_id` UDM field. - event.idm.entity.entity.asset.hostname: Newly mapped `event_data.computer.deviceName` raw log field with `event.idm.entity.entity.asset.hostname` UDM field. - event.idm.entity.entity.asset.hardware.model: Newly mapped `event_data.computer.model` raw log field with `event.idm.entity.entity.asset.hardware.model` UDM field. - event.idm.entity.entity.asset.hardware.serial_number: Newly mapped `event_data.computer.serialNumber` raw log field with `event.idm.entity.entity.asset.hardware.serial_number` UDM field. - event.idm.entity.entity.asset.platform_software.platform_patch_level: Newly mapped `event_data.computer.osBuild` raw log field with `event.idm.entity.entity.asset.platform_software.platform_patch_level` UDM field. - event.idm.entity.entity.platform_version: Newly mapped `event_data.computer.osVersion` raw log field with `event.idm.entity.entity.platform_version` UDM field. - event.idm.entity.entity.user.userid: Newly mapped `event_data.computer.userDirectoryID` raw log field with `event.idm.entity.entity.user.userid` UDM field. - event.idm.entity.entity.user.email_addresses: Newly mapped `event_data.computer.emailAddress` raw log field with `event.idm.entity.entity.user.email_addresses` UDM field. - event.idm.entity.entity.user.user_display_name: Newly mapped `event_data.computer.realName` raw log field with `event.idm.entity.entity.user.user_display_name` UDM field. - event.idm.entity.entity.user.phone_numbers: Newly mapped `event_data.computer.phone` raw log field with `event.idm.entity.entity.user.phone_numbers` UDM field. - event.idm.entity.entity.user.title: Newly mapped `event_data.computer.position` raw log field with `event.idm.entity.entity.user.title` UDM field. - event.idm.entity.entity.user.department: Newly mapped `event_data.computer.department` raw log field with `event.idm.entity.entity.user.department` UDM field. - event.idm.entity.entity.user.office_address.floor_name: Newly mapped `event_data.computer.building` raw log field with `event.idm.entity.entity.user.office_address.floor_name` UDM field. - event.idm.entity.entity.user.office_address.desk_name: Newly mapped `event_data.computer.room` raw log field with `event.idm.entity.entity.user.office_address.desk_name` UDM field. - event.idm.entity.entity.labels: Newly mapped `event_data.jssID`, `event_data.managementId`, `webhook.webhookEvent`, `event_data.computer.jssID`, `event_data.computer.managementId` and `webhook.webhookEvent` raw log field with `event.idm.entity.entity.labels` UDM field.
2025-02-24	- Newly created parser.