---
title: "Kandji EDR"
slug: "kandji-edr"
updated: 2025-03-13T00:08:42Z
published: 2025-03-13T00:08:42Z
canonical: "docs.databee.buzz/kandji-edr"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Kandji EDR

Kandji Endpoint Detection and Response (EDR) is designed to enhance endpoint protection and streamline device management, particularly for Apple devices. Kandji EDR combines real-time threat detection, automated response mechanisms, and robust analytics to safeguard organizations against evolving cyber threats. For detailed information, refer to [Kandji EDR’s official documentation](https://www.kandji.io/endpoint-detection-response/).

**Integration Method**: API

**Table**: Detection Finding (2004)

This integration supports the following events.

| **Events** | **Description** |
| --- | --- |
| Threats | Captures detected threats, including malware and PUPs, with information on affected devices, file paths, threat status, and security actions taken. |

This integration supports the following versions.

| Kandji agent version Supported | 4.6.7 (5238) |
| --- | --- |
| Kandji EDR API | v1 |

## Prerequisites

- The user should have access to the Kandji portal with an account that has admin access.
- The user should have access to the DataBee console.

## Configuration Overview

1. Create an API Token with required permissions to fetch the data.
2. Create [Kandji EDR data feed](/user-manual/docs/kandji-edr#databee-configuration) in the DataBee console with the required Client credentials.

| **DataBee Parameter** | **Kandji Parameter** |
| --- | --- |
| API Base URL (< subdomain > ,< region >) | Organization’s API URL |
| Token | Token |

## Kandji EDR Configuration

### Create a Token

1. Login to the Kandji EDR console. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-4vhpsqjv.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
2. Click on the **Settings** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-d7vtoonw.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
3. Click on the **Access** tab. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-shtqsxl7.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
4. Click on the **Add Token** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-tu8fi0t7.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
5. Enter ‘Name’ and ‘Description’ of Token. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-s0m6tx1d.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
6. Click on the **Create** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-i5lc7v0i.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
7. Click on the **Copy Token** to copy the token to your clipboard. Ensure you store the token in a secure location, as you will not be able to view it again. Check the checkbox to confirm that the token has been copied. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-5we6x4qj.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)

> [!NOTE]
> Note:
> 
> Ensure you store the token in a secure location, as you will not be able to view it again.
8. Click on the **Next** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-l0b31vv8.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
9. Click on the **Configure** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-cdxy0duw.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
10. Click on the **Configure Permissions** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-3ozbz4mf.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
11. Select get Threat Details permission.
  1. Search for **Threat Details**.
  2. Select check box of **Get Threat Details** permission.
  3. Click on the **Save** button.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-pcjkrniz.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)

1. Click on the **Close** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-s0az0kza.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
2. Copy the **Organization’s API URL**, as it contains the subdomain and region, which are required during the DataBee configuration process. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-glumr1nr.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-nrkbredt.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
2. Search for **Kandji EDR** and select it. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-8xwrwivw.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
3. Click on the **API Ingest**. ![Inserting image...](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-r3nlsluj.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-lqzd7dh3.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)
5. In the configuration page, enter the following:
  - API Base URL: replace < subdomain > and < region >with your subdomain and region according to your organization's API URL .
  - Authorization Method: Bearer Token
  - Token: paste the Token generated earlier in the Kandji EDR portal.
  - Event Types: preselected for all the event types that integration pulls.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/kandji-edr-user-guide-mar2025-image-91sjbifz.png?sv=2026-02-06&spr=https&st=2026-11-15T00%3A04%3A53Z&se=2026-11-15T01%3A04%3A53Z&sr=c&sp=r&sig=poJ6hBvv3bSCokARZd7vBbzxCpv3IGo%2Bl4SyGfpO9%2Fo%3D)

> [!NOTE]
> Note:
> 
> The URL for the API endpoint that you use is based on your region. Here, we have used the URL for **US region**. You can change the URL as per subscription. Below is the list of URLs as per the subscription.

- US - [https://SubDomain.api.kandji.io](https://SubDomain.api.kandji.io)
- EU - [https://SubDomain.api.eu.kandji.io](https://SubDomain.api.eu.kandji.io)

1. Click **Submit**.

## Troubleshooting Tips

- If you encounter an **Unauthorized** error, it may indicate that the authentication token has expired or deleted. In this case, regenerate the token to restore access. To prevent potential issues, consider pasting the token into a text editor to verify that there are no extra spaces or unexpected characters before reconfiguring the DataBee feed.