Iru

Iru Behavioral Detections API

The Behavioral Detections API from Iru — 1 operation(s) for behavioral detections.

Documentation GitHub OpenAPI

Operations 1

GET /api/v1/behavioral-detections Get Behavioral Detections #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/kandji-behavioral-detections-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Iru Endpoint Management Behavioral Detections API
  description: '# Welcome to the Iru Endpoint Management API Documentation


    **Note:** Kandji is in the process of changing to Iru.'
  version: 1.0.0
servers:
- url: https://{subdomain}.api.kandji.io
  description: US Server
  variables:
    subdomain:
      default: your-subdomain
      description: Your Iru Endpoint Management subdomain
- url: https://{subdomain}.api.eu.kandji.io
  description: EU Server
  variables:
    subdomain:
      default: your-subdomain
      description: Your Iru Endpoint Management subdomain
security:
- BearerAuth: []
tags:
- name: Behavioral Detections
paths:
  /api/v1/behavioral-detections:
    get:
      summary: Get Behavioral Detections
      description: Get Behavioral Detections.
      parameters:
      - name: threat_id
        in: query
        required: false
        description: 'Filter by a specific threat ID. Example: `Kandji_BD_0096`'
        schema:
          type: string
        example: Kandji_BD_0096
      - name: classification
        in: query
        required: false
        description: 'Filter by threat classification. Example: `malicious`'
        schema:
          type: string
        example: malicious
      - name: status
        in: query
        required: false
        description: 'Filter by threat status. Example: `blocked`'
        schema:
          type: string
        example: blocked
      - name: date_range
        in: query
        required: false
        description: 'Return all records within a specified number of days. Example: `30`'
        schema:
          type: integer
          minimum: 1
        example: 30
      - name: detection_date_from
        in: query
        required: false
        description: 'Start date for detection date range filter. Example: `2024-01-01`'
        schema:
          type: string
          format: date
        example: '2024-01-01'
      - name: detection_date_to
        in: query
        required: false
        description: 'End date for detection date range filter. Example: `2024-01-31`'
        schema:
          type: string
          format: date
        example: '2024-01-31'
      - name: device_id
        in: query
        required: false
        description: 'Search for a specific device by the device id (uuid). Example: `123e4567-e89b-12d3-a456-426614174000`'
        schema:
          type: string
        example: 123e4567-e89b-12d3-a456-426614174000
      - name: malware_family
        in: query
        required: false
        description: 'Filter by malware family. Example: `TrickBot`'
        schema:
          type: string
        example: TrickBot
      - name: parent_process_name
        in: query
        required: false
        description: 'Filter by parent process. Example: `bash`'
        schema:
          type: string
        example: bash
      - name: target_process_name
        in: query
        required: false
        description: 'Filter by target process. Example: `python`'
        schema:
          type: string
        example: python
      - name: informational_tags
        in: query
        required: false
        description: 'Filter by tags. Example: `exploit,privilege_escalation`'
        schema:
          type: string
        example: exploit,privilege_escalation
      - name: term
        in: query
        required: false
        description: 'Search term to filter threat results. Device name, file hash, image path. Example: `device_name`'
        schema:
          type: string
        example: device_name
      - name: sort_by
        in: query
        required: false
        description: 'Detections can be sorted by any of the following keys. Prepending a dash (-) to the parameter value will reverse the order. Example: `status` or `-status`'
        schema:
          type: string
          enum:
          - threat_id
          - classification
          - device_name
          - parent_process_name
          - target_process_name
          - detection_date
          - status
        example: status
      - name: limit
        in: query
        required: false
        description: 'A hard upper limit is set at 1000 records returned per request. If more records are expected, pagination should be used using the limit and offset parameters. Example: `100`'
        schema:
          type: integer
          maximum: 1000
          default: 1000
        example: 100
      - name: offset
        in: query
        required: false
        description: 'Specify the starting record to return. Example: `0`'
        schema:
          type: integer
          minimum: 0
          default: 0
        example: 0
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                type: object
                example:
                  total_count: 71
                  next: null
                  previous: null
                  malicious_count: 37
                  suspicious_count: 34
                  results:
                  - id: CC80F462-1F4D-4A04-9380-C21743DFC308
                    threat_id: KTI_BD_0163
                    rule_version: 2
                    description: TP2419 long descriptionnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn123
                    classification: malicious
                    informational_tags: []
                    malware_family: []
                    detection_date: '2025-03-08T17:35:30.462076+00:00'
                    threat_status: detected
                    device_info:
                      id: ddfc3341-f319-4ef0-bf9a-80791b15a79a
                      name: arm-14_7_0
                      serial_number: ZMN33JFKKC
                    parent_process:
                      name: zsh
                      command_line: -zsh
                      image_path: /bin/zsh
                      pid: 7657
                      owner: root
                      sha256: 0ba6f44f486330453af994834aa406c8d398bfda68a54f3176bf3696ccc09c91
                    target_process:
                      name: vim
                      command_line: vim 123
                      image_path: /usr/bin/vim
                      pid: 7759
                      owner: root
                      sha256: c765f827442004d59ac6bd907f16fbda645f970a3bec94c2651a9f297a0f8030
                    library_item:
                      id: 6d4efe51-331a-4e92-bd63-33b1f2797ae5
                      name: Andreu LI
                      mal_posture_mode: protect
                    blueprint:
                      id: f8034d27-d566-456e-8bbe-6a4dd1848961
                      name: Andreu BP
                  - id: B42DF93B-1610-42CF-AB12-E8BF8C7A9D13
                    threat_id: KTI_BD_2796
                    rule_version: 4
                    description: QA Testing Rule
                    classification: malicious
                    informational_tags: []
                    malware_family:
                    - 3CX
                    - AceDeceiver
                    - Activator
                    - AdvancedMacCleaner
                    - Adware.Gen
                    - AMCleaner
                    - AnyKeylogger
                    detection_date: '2025-03-08T17:35:30.462076+00:00'
                    threat_status: detected
                    device_info:
                      id: ddfc3341-f319-4ef0-bf9a-80791b15a79a
                      name: arm-14_7_0
                      serial_number: ZMN33JFKKC
                    parent_process:
                      name: zsh
                      command_line: -zsh
                      image_path: /bin/zsh
                      pid: 7657
                      owner: root
                      sha256: 0ba6f44f486330453af994834aa406c8d398bfda68a54f3176bf3696ccc09c91
                    target_process:
                      name: vim
                      command_line: vim 123
                      image_path: /usr/bin/vim
                      pid: 7759
                      owner: root
                      sha256: c765f827442004d59ac6bd907f16fbda645f970a3bec94c2651a9f297a0f8030
                    library_item:
                      id: 6d4efe51-331a-4e92-bd63-33b1f2797ae5
                      name: Andreu LI
                      mal_posture_mode: protect
                    blueprint:
                      id: f8034d27-d566-456e-8bbe-6a4dd1848961
                      name: Andreu BP
                  - id: AA97B8C8-7CBD-401A-9EC3-63A15A9936BC
                    threat_id: KTI_BD_0141
                    rule_version: 10
                    description: Detects removal of Little Snitch by unloading the Little Snitch Launch Daemon.
                    classification: suspicious
                    informational_tags:
                    - exec
                    - Little Snitch
                    - Disable
                    - Launch Daemon
                    - unload
                    malware_family: []
                    detection_date: '2025-03-07T17:40:15.984091+00:00'
                    threat_status: informational
                    device_info:
                      id: ddfc3341-f319-4ef0-bf9a-80791b15a79a
                      name: arm-14_7_0
                      serial_number: ZMN33JFKKC
                    parent_process:
                      name: zsh
                      command_line: -zsh
                      image_path: /bin/zsh
                      pid: 462
                      owner: root
                      sha256: 0ba6f44f486330453af994834aa406c8d398bfda68a54f3176bf3696ccc09c91
                    target_process:
                      name: sudo
                      command_line: sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
                      image_path: /usr/bin/sudo
                      pid: 5735
                      owner: root
                      sha256: 938921ccaa776ab1bf2ca538e1ba63a8f981f047f236197581bcd968cd08f99f
                    library_item:
                      id: 6d4efe51-331a-4e92-bd63-33b1f2797ae5
                      name: Andreu LI
                      mal_posture_mode: protect
                    blueprint:
                      id: f8034d27-d566-456e-8bbe-6a4dd1848961
                      name: Andreu BP
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Unauthorized
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Not Found
      tags:
      - Behavioral Detections
      operationId: getApiV1BehavioralDetections
      x-operation-id-source: derived
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT