Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Fsecurity%2Fkandji.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Fsecurity%2Fkandji.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Kandji

Kandji is a device management platform that helps businesses manage and secure Apple devices. It allows IT teams to automate tasks such as setting up devices, enforcing security settings, and keeping software up-to-date, making it easier to manage a large number of devices across a company.

Integrate Kandji into Coralogix via OpenTelemetry (OTel) Collector to send Threat-Details logs. These logs track and record security-related events, including potential threats and vulnerabilities, within an organization's Apple devices managed through Kandji.

## Prerequisites[​](#prerequisites "Direct link to Prerequisites")

* Permission to create API token on a Kandji account.
* Access to Coralogix account.
* A virtual machine to run automated script and OTel.

## Integration[​](#integration "Direct link to Integration")

1. [Create a read-access API token](https://support.kandji.io/support/solutions/articles/72000560412-kandji-api) on your Kandji account. API token should have read access.
2. Set up automated script to pull Kandji Threat-Details logs and save them to a file. Use the following cron expression for your cron job.

```
0 0 * * * rm /var/log/kandji.json; rm /var/log/log.json; rm /var/log/kandji.log; curl --location -g 'https://{sub_domain}.api.kandji.io/api/v1/threat-details' --header 'Authorization: Bearer <api_token>' --header 'date_range: 1' >> /var/log/kandji.json; jq '.results' /var/log/kandji.json >> /var/log/log.json; cat /var/log/log.json | jq ".[]" >> /var/log/kandji.log
```

where:

* `{sub_domain}` is your Kandji sub-domain.
* `<api_token>` is the token generated in step 1.

1. Set up OTel Collector to read logs from the `/var/log/kandji.log` file and send them to Coralogix.
2. Replace the OTel configuration file with the following:

```
receivers:

  filelog:

    start_at: beginning

    include:

      - /var/log/kandji.log

    multiline:

      line_start_pattern: "^{"

    operators:

      - type: json_parser

        parse_to: body

exporters:

  coralogix:

    domain: "eu2.coralogix.com"

    private_key: "your Send-Your-Data API key"

    application_name: "<your-app-name>"

    subsystem_name: "<your-subsystem-name>"

    timeout: 30s

service:

  pipelines:

    logs:

      receivers: [ filelog ]

      exporters: [ coralogix ]
```

where:

* `private_key` is your Coralogix [Send-Your-Data API key](https://docs-docusaurus.kinsta.page/user-guides/account-management/api-keys/send-your-data-api-key/.md).
* `domain` is your [Coralogix domain](https://docs-docusaurus.kinsta.page/user-guides/account-management/account-settings/coralogix-domain/.md).