Iru (Kandji) Integration via API

Purpose

This guide explains how to generate an API Token in the Iru (formerly Kandji) admin console and use it in Logsign USO to ingest Iru audit/activity events and endpoint threat detections for security analytics and forensic purposes.

Iru is a cloud-only endpoint management and EDR platform with no syslog forwarding option for these logs. This API poller is the only supported way to bring Iru data into Logsign USO.

Prerequisites

The account used to generate the API Token must be a tenant administrator with access to the Settings area of the Iru console. The token itself must be granted read access to two specific areas, see Step 2, otherwise the corresponding log type will fail with an authorization error while the other keeps working.

Step 1: Find Your API URL

1. Sign in to your Iru console as an administrator.
2. Go to Settings > Access.
3. Copy the value shown in the API URL field exactly as displayed (including https://, no trailing slash). Its format depends on your region:

The domain still reads kandji.io even though the product has been rebranded to Iru; this is expected and not a mistake on your part. Do not guess your subdomain; copy the value shown in the console.

Step 2: Create an API Token

1. On the same Settings > Access screen, find the API Token section and create a new token (for example, name it "Logsign Integration").
2. Grant the token both of the following read permissions:
   • Audit / Activity Log: required for device enrollment, blueprint, and admin/token activity events
   • Threat / EDR (Threat Details): required for malware and PUP detection events
3. Copy the generated token value immediately. Iru does not show it again once you leave the screen; if you lose it you must generate a new one.

Creating this token is itself logged as an audit event in Iru (category base, type create.api_token); you can use this to confirm the token was created if needed.

Step 3: Configure the Integration in Logsign USO

Add a new Iru (Kandji) data source in Logsign USO and provide:

Logsign sends the token as a Bearer credential on every request; there is no separate token exchange or refresh step, since Iru tokens are static and long-lived. Logsign then periodically polls both the audit/activity feed and the threat details feed, tracking each with its own cursor so a new poll never re-delivers an already-collected event.

Notes and Limits

• The API token does not expire on its own; it stays valid until you revoke it in the Iru console. If you do revoke it, generate a new one and update the Logsign data source; no other reconfiguration is needed.
• Iru's published rate limit is about 10,000 requests/hour, far above what this integration uses at its default 5-minute polling interval; you should not see any throttling under normal operation.
• If polling fails with 401 or 403, the most common cause is a token that is missing one of the two read permissions from Step 2; check which log type stopped (audit vs. threat) and confirm the matching permission is still granted.
• This integration covers Iru's Audit/Activity log (device, blueprint, admin, and token operations, including endpoint DLP/vulnerability posture events carried in the same feed) and the Threat Details feed (malware/PUP detections with file, hash, device, severity, and quarantine status). Other Iru surfaces are not covered by this poller.