Iru
Configure Iru integration with RAD Security to import endpoint detection and response findings.
This guide walks you through creating an API token in Iru and configuring the integration in RAD Security for unified endpoint visibility alongside your container and cloud runtime activity.
Iru provides device management and endpoint detection and response capabilities, letting RAD Security import endpoint inventory and device details for correlation with runtime events.
Prerequisites
Before you begin, ensure you have:
- Access to the Iru web app for your organization
- Permissions to create and manage API tokens
- Access to a RAD Security workspace with integration permissions
Token Visibility: The API token value is only displayed once when it is created. Make sure you store it securely before closing the dialog.
Required API Permissions
Assign the following permissions to the API token used by RAD Security:
| Permission | Purpose |
|---|---|
| Devices → Device list | Query endpoints |
| Devices → Device details | Retrieve endpoint details |
Step 1: Create an API Token
Log in to Iru
Sign in to the Iru web app with an account that can create and manage API tokens.
Open the user menu
Click your username in the bottom left of the interface.
Navigate to API tokens
Click Access, then click API tokens.
Add a new token
Click Add Token.
Name the token
Enter a Name and Description for the token (e.g., "RAD Security EDR").
Create the token
Click Create. Iru displays a modal containing the new API token.
Copy the token
Click the visibility control to reveal the token, or click Copy Token to copy it to your clipboard. Store it in a safe location such as a password manager or secrets vault.
You will not be able to view the token again. If you lose it, you will need to delete the token and create a new one.
Continue to permissions
Click Next to move on to permission configuration.
Step 2: Configure Token Permissions
Open the permissions editor
Click Configure to set API permissions for the token now. You can alternatively click Skip and edit them later.
Enable the required permissions
Enable the following permissions:
- ☑️ Devices → Device list
- ☑️ Devices → Device details
Save the permissions
Click Save to apply the changes.
Inspect or modify a token later: Click on a token in the API tokens list, then click View to see token details. Use the Permissions tab to edit permissions, or the Activity tab to see token lifecycle events such as creation, renames, and permission edits.
Step 3: Get your Base URL
After you create your first API token, Iru displays your tenant-specific API URL. This is the Base URL required to configure the integration.
The Base URL takes the form:
https://{tenant}.api.kandji.io
If you already have existing tokens and don't see the API URL, contact your Iru administrator or check the API token documentation in the Iru web app — the URL is tenant-specific and does not change between tokens.
Step 4: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Iru integration with the following parameters:
| Parameter | Required | Description | Example |
|---|---|---|---|
| Secret | Yes | The API token created in Step 1 | your-iru-api-token-here |
| Base URL | Yes | Your tenant-specific API URL from Iru | https://acme.api.kandji.io |
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > EDR in RAD Security
- Locate your Iru integration
- Check the connection status shows as Connected
- Verify endpoint data is being synced
Your Iru integration is now configured! RAD Security can now correlate endpoint data from Iru with container and cloud runtime events.
What Data is Synced
Once configured, RAD Security will sync the following data from Iru:
Use Cases
Endpoint Correlation Correlate Iru-managed endpoint data with container and cloud runtime activity to detect cross-environment threats.
Device Context for Alerts Enrich RAD Security alerts with device details from Iru to accelerate investigation.
Unified Asset Visibility Combine managed endpoints with containerized workloads for a complete asset inventory.
Coordinated Response Use Iru device context when triaging and responding to incidents spanning endpoints and cloud.
Troubleshooting
Security Best Practices
Least Privilege Tokens Only grant the two required permissions (Device list and Device details). Avoid adding unrelated permissions to the token.
Dedicated Tokens Create a dedicated API token for RAD Security rather than sharing tokens across integrations.
Rotate Tokens Regularly Periodically replace the API token and delete old ones as part of normal security hygiene.
Secure Credential Storage Store the API token in a secrets vault. Never commit it to source control.
Monitor Token Activity Use the token Activity tab in Iru to review token usage and detect unexpected behavior.
Revoke Unused Tokens Periodically review API tokens and delete any that are no longer in use.
Additional Resources
Generate an API Token
Upstream documentation for generating an API token
API Reference
Upstream API reference documentation