Skip to main content

Kandji

Visualize Iru (formerly Kandji) devices and apps, and monitor changes through queries and alerts.

Installation​

JupiterOne requires an API access token and the organization API URL for this integration. You need admin access to Iru (formerly Kandji) to generate an API token.

Configuration in Iru​

  1. Log in to your Iru tenant. Existing Kandji tenants use https://{subdomain}.kandji.io/; new Iru tenants use their assigned Iru URL.

  2. Go to Settings, then click the Access tab.

  3. Click Add API Token.

  4. Enter a Name for the token (required). A description is optional.

  5. Click Create. Copy the API token shown and store it securely — you will not be able to view it again.

  6. Click Next, then click Configure to assign endpoint permissions to the token.

  7. Enable the following permissions:

    PermissionEndpoint
    Device listGET /api/v1/devices
    Device detailsGET /api/v1/devices/{device_id}/details
    Application listGET /api/v1/devices/{device_id}/apps
    List custom profilesGET /api/v1/library/custom-profiles
    List blueprintsGET /api/v1/blueprints
    Vulnerability management — vulnerabilitiesGET /api/v1/vulnerability-management/vulnerabilities
    Vulnerability management — detectionsGET /api/v1/vulnerability-management/detections
    Threat detailsGET /api/v1/threat-details

  8. Click Save.

  9. Your tenant-specific API URL is shown on the API tokens page. Copy it for use in JupiterOne.

Data Volume Configuration​

Control how much data is ingested from Iru to manage storage and processing.

Ingestion Windows​

FieldDescriptionDefaultOptions
Threat Ingest Since DaysHow many days back to look when ingesting threat data. Increasing this value ingests more threats.9090, 180, 275, 365

Data Filtering Options​

FieldDescriptionDefault
Threat StatusFilters threat ingestion to the selected quarantine status. When unset, all statuses are ingested.All statuses

Available options for Threat Status:

  • Quarantined — Only ingest threats that are quarantined.
  • Not Quarantined — Only ingest threats that are not quarantined.
  • Released — Only ingest threats that have been released from quarantine.

Configuration in JupiterOne​

To install the integration in JupiterOne, navigate to the Integrations tab, select Kandji, and click New Instance. Provide the following:

  • Account Name — A label to identify this account in JupiterOne. Ingested entities store this value in tag.AccountName.

  • Description — Optional. Helps distinguish multiple integration instances.

  • Polling Interval — How often JupiterOne collects data from Iru. Set to DISABLED to run manually.

  • Kandji API Url — The organization API URL from your Iru tenant, in the format https://{yourApiUrl}/api/v1/. Include https:// at the start and /api/v1/ at the end.

  • Kandji Access Token — The API token generated in the steps above.

Click Create to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.