Iru Log Monitoring

Integration Overview

Iru (formerly Kandji) is a Mobile Device Management (MDM) and endpoint management platform for Apple, Windows, and Android devices. Iru audit logs capture device management activity, policy compliance events, and security-related actions across your managed fleet. Panther ingests Iru audit logs via S3, normalizing and storing them in a Snowflake-powered security data lake for detection and investigation alongside the rest of your endpoint telemetry.

Use Cases for Iru Logs

Common SIEM use cases for Iru logs include:

• Monitoring device enrollment, removal, and configuration changes for unauthorized activity

• Detecting policy compliance failures or security control violations across managed endpoints

• Correlating endpoint management events with other security data to investigate suspicious behavior

Onboarding Iru Logs in Panther

Panther's integration for Iru is easy to configure, allowing you to onboard your log data in just a few minutes. Iru audit logs are exported to an AWS S3 bucket and ingested into Panther using Panther's S3 data transport.

For more detailed steps on onboarding Iru or for supported log schema, you can view our Iru documentation here.