Kandji

Collect audit logs from your Kandji account to monitor device management actions and administrative changes. RunReveal polls the Kandji audit events API every 60 seconds.

Ingest Methods

• API Polling

API Polling

Step 1 — Create a Kandji API token

1. In the Kandji web app go to Settings → Access.
2. Note your API URL — it looks like https://YOUR_SUBDOMAIN.api.kandji.io. You'll need this in Step 2.
3. Click Add Token, give it a name (for example RunReveal), and under permissions enable List audit events. No other permissions are needed.
4. Copy the token value — it is only shown once.

Step 2 — Connect in RunReveal

1. Go to Sources → Add Source and click the Kandji tile.
2. Give the source a name and click Connect Source.
3. Enter your Kandji API URL (from Step 1) and paste in your API token.
4. Click Verify to confirm RunReveal can reach the API, then save.

Logs begin appearing within a minute. Historical audit events are backfilled on the first sync.

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

Kandji documentation

• Kandji API reference
• Kandji Support & Knowledge Base