Kandji Tables

Tables

KandjiBlueprint

The KandjiBlueprint table stores information about Blueprint used in the Kandji integration. Blueprint define configuration settings, policies, and assignments for enrolled devices. This table includes metadata such as the Blueprint's name, description, color theme, and associated icon. It tracks the number of assigned computers, enrollment codes for new devices, and whether the Blueprint is currently active.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
Color	string	The color theme assigned to this Blueprint.
ComputersCount	integer	The number of computers currently assigned to this Blueprint.
ConfigID	integer	The ID of the configuration within Compyl.
Description	string	A brief explanation of what this Blueprint represents.
EnrollmentCode	string	The unique code used for device enrollment integero this Blueprint.
Icon	string	The visual icon associated with this Blueprint, usually represented as a predefined system icon name.
ID	string	A unique identifier for the Blueprint.
IsActive	bit	Is the Blueprint active/inactive.
Name	string	The name of the Blueprint.

KandjiDeviceApps

The KandjiDeviceApps table stores information about applications installed on devices managed through the Kandji integration. It includes details such as the app's unique identifier, name, version, and bundle information. The table also tracks metadata like installation dates, modification timestamps, file system paths, and digital signatures for verification. Additionally, it records whether the app is available on the App Store, linked to a Volume Purchase Program (VPP) license, and the source of the application. Each app entry is associated with a specific device through a unique device ID.

Name	Type	Description
AppId	string	Unique identifier for the application installed on the device.
AppName	string	The name of the application installed on the device.
AppStoreVendable	string	Indicates whether the app is available for purchase or download from the App Store. If empty, the app is likely not available for retail distribution.
BatchDate	datetime	The date and time data was synced to our database.
BundleId	string	The unique identifier for the app's bundle, which is used to distinguish the app from others.
BundleSize	string	The size of the app bundle (usually in megabytes or another unit).
ConfigID	integer	The ID of the configuration within Compyl.
CreationDate	datetime	The date and time when the app was first installed or recorded on the device.
DeviceBasedVpp	string	Indicates whether the app is based on a device-specific Volume Purchase Program (VPP) license. If empty, the app is not linked to a device-based VPP license.
DeviceId	string	Unique identifier for the device to which the app is installed.
ID	integer	A unique identifier for the Device App.
ModificationDate	datetime	The date and time when the app’s information was last modified.
Path	string	The file system path to the app's location on the device.
Process	string	The name of the process running the app on the device (often the same as the app name).
Signature	string	Information related to the app's digital signature, typically used for verifying its authenticity and origin (such as `Apple Code Signing`).
Source	string	The source from where the app was obtained, such as `Apple` or another third-party provider.
Version	string	The version of the application installed on the device.

KandjiDeviceCommands

The KandjiDeviceCommands table tracks commands issued to devices managed through the Kandji integration. It records details such as the command type, request status, and priority level. Each command entry is linked to a specific device via its unique device ID. The table also logs timestamps for when commands were requested, last pushed, and completed, along with metadata such as the number of execution attempts. Additionally, it includes network tethering requirements.

Name	Type	Description
Attempts	integer	The number of attempts made to execute the command.
BatchDate	datetime	The date and time data was synced to our database.
CommandType	string	The type of the command being issued (e.g., `ActivationLockBypassCode`).
ConfigID	integer	The ID of the configuration within Compyl.
DateCompleted	datetime	The timestamp of when the command was completed (e.g., `2022-08-18T15:07:23.240937Z`).
DateRequested	datetime	The timestamp of when the command was requested (e.g., `2022-08-18T15:07:22.133248Z`).
DeviceId	string	The ID of the device to which the command is associated (e.g., `0bc8f610-5b88-49a6-b9ef-a68bf04e1e59`).
ID	integer	A unique identifier for the Device Command.
LastPushed	datetime	The timestamp of when the command was last pushed to the device (e.g., `2022-08-18T15:07:22.507520Z`).
Priority	integer	The priority level of the command (e.g., `0`).
RequestRequiresNetworkTether	bit	A bit value indicating whether the request requires a network tether to execute.
RequestType	string	The type of request for the command (e.g., `ActivationLockBypassCode`, `Settings`).
Status	integer	The status of the command, represented by an integereger (e.g., `3`).
Uuid	string	A unique identifier for the command, represented as a UUID (e.g., `d2b2eafe-2dc2-4b13-bd2b-f93735f0e59f`).

KandjiDeviceVolumes

Lists every logical volume discovered on managed devices, enabling visibility into format, capacity, encryption, and free‑space metrics.

Name	Type	Description
ID	integer	Unique identifier for the volume record.
DeviceID	string	Identifier of the device the volume belongs to.
Name	string	Volume name (e.g., `Macintosh HD`).
Format	string	Filesystem format (e.g., `APFS`, `HFS+`).
PercentUsed	string	Percentage of the volume’s capacity that is used (e.g., `72%`).
Identifier	string	System identifier for the volume (e.g., `disk3s5`).
Capacity	string	Total capacity of the volume (human‑readable or bytes).
Available	string	Free space available on the volume.
Encrypted	string	`Yes`/`No` (or true/false) indicating whether the volume is encrypted.
ConfigID	integer	Compyl configuration ID.
BatchDate	datetime	Date/time the data was synced into Compyl.

KandjiDevices

The KandjiDevices table stores detailed information about devices managed through the Kandji integration. It includes device-specific attributes such as name, model, operating system version, and serial number. Additionally, it tracks management-related data, including MDM status, agent installation details, and FileVault encryption status. The table also records enrollment timestamps, last check-in times, and blueprinteger associations.

Name	Type	Description
AgentInstalled	bit	A bit indicating whether the management agent is installed on the device.
AgentVersion	string	The version of the installed agent (e.g., `4.5.9 (5160)`).
AssetTag	string	An identifier tag associated with the device (e.g., `sending_tag_to_now`).
BatchDate	datetime	The date and time data was synced to our database.
BlueprintegerId	string	The unique identifier for the blueprinteger associated with the device (e.g., `ab102b9d-8e9c-420d-a498-f2a1123091c7`).
BlueprintegerName	string	The name of the blueprinteger associated with the device (e.g., `main hive`).
ConfigID	integer	The ID of the configuration within Compyl.
DeviceName	string	The name of the device (e.g., `accuhive's MacBook Air`).
FileVaultEnabled	bit	A bit indicating whether FileVault is enabled on the device.
FirstEnrollment	string	The timestamp of when the device was first enrolled (e.g., `2024-01-26 16:15:36.087016+00:00`).
ID	string	A unique identifier for the Device.
IsMissing	bit	A bit indicating whether the device is marked as missing.
IsRemoved	bit	A bit indicating whether the device is marked as removed.
LastCheckIn	datetime	The timestamp of when the device last checked in (e.g., `2024-07-23T14:11:37.150080Z`).
LastEnrollment	string	The timestamp of the last enrollment (e.g., `2024-05-13 20:09:27.374451+00:00`).
LostModeStatus	string	The status of the device in lost mode (empty string if not in lost mode).
MdmEnabled	bit	A bit indicating whether the Mobile Device Management (MDM) system is enabled on the device.
Model	string	The model of the device (e.g., `MacBook Air (M1, 2020)`).
OsVersion	string	The operating system version of the device (e.g., `14.4.1`).
Platform	string	The platform of the device (e.g., `Mac`).
SerialNumber	string	The serial number of the device (e.g., `FVHHFKF7Q6L4`).
SupplementalBuildVersion	string	The supplemental build version of the OS (e.g., `23E224`).
SupplementalOsVersionExtra	string	Additional version details (empty string if not provided).
UserEmail	string	The email address of the user associated with the device (e.g., `[email protected]`).
UserId	string	The unique identifier for the user associated with the device (e.g., `5344c996-8823-4b37-8d6e-8515fc7c3a0a`).
UserName	string	The name of the user associated with the device (e.g., `accuhive admin`).
IpAddress	string	The device’s private IPv4/IPv6 address captured at the last check‑in.
LocalHostName	string	The local hostname the device advertises on the LAN.
MacAddress	string	Primary network‑interface MAC (hardware) address of the device.
PublicIp	string	The external/public IP address observed for the device’s internet connection.
RemoteDesktopEnabled	bit	True when macOS Screen Sharing / Remote Desktop is enabled.
BootVolume	string	Name of the startup (boot) volume currently mounted.
FileVaultNextRotation	datetime	Scheduled date/time for the next FileVault recovery‑key rotation.
FileVaultPersonalRecoveryKeyEscrowed	bit	True if the personal recovery key is escrowed to Kandji/MDM.
FileVaultRecoveryKeyType	string	Type of FileVault recovery key in use (Personal, Institutional, None).
FileVaultRegenRequired	bit	True when a new FileVault recovery key must be generated.
RecoveryFirmwarePasswordExist	bit	True if a firmware (`EFI`) password is currently set.
RecoveryFirmwarePasswordPending	bit	True if firmware‑password creation/removal is pending.
RecoveryLockEnabled	bit	True if Apple‑silicon Recovery Lock is enabled on the device.
RecoveryPasswordHasBeenSet	bit	True once a Recovery password has been configured.
RecoveryPasswordRotationScheduled	datetime	Scheduled date/time for the next Recovery password rotation.

Kandjiintegrations

Table contains 0+ configurations a customer may have.

Name	Type	Description
APIUrl	string	Base URL used for calling the Salesforce API
CreatedBy	string	Email address of the user who created the integration configuration.
CreatedDate	datetime	The date and time the integration configuration was created.
ID	integer	Unique identifier for the integration configuration.
IsEnabled	bit	Whether this integration configuration is enabled or not.
ModifiedBy	string	Email address of the user who modified the integration configuration.
ModifiedDate	datetime	The date and time the integration configuration was updated.
Name	string	Name of the configuration.

KandjiPrismApplicationFirewalls

Stores per‑device macOS Application Firewall settings pulled from the Kandji Prism API; used to audit inbound‑traffic protections and logging configuration.

Name	Type	Description
ID	integer	Unique identifier for the firewall snapshot record.
DeviceID	string	Unique identifier of the device the settings belong to.
DeviceFamily	string	Platform family (e.g., `Mac` or `iOS`).
Tags	string	Comma‑separated tags associated with the device.
ModelId	string	Kandji internal model identifier.
Count	integer	Number of firewall rules or entries in the snapshot.
CreatedAt	datetime	Timestamp when the snapshot was first recorded.
UpdatedAt	datetime	Timestamp of the most recent update to this record.
LastChangedAt	datetime	When firewall settings last changed on the device.
LastCollectedAt	datetime	When this data was last collected from Kandji.
Status	bit	True if the Application Firewall is enabled.
BlockAllIncoming	bit	True if `Block all incoming connections` is enabled.
Logging	bit	True if firewall logging is enabled.
LoggingOption	string	Logging detail level (e.g., `brief`, `detail`).
StealthMode	bit	True if Stealth Mode (drop ICMP, etc.) is enabled.
Version	string	Version string of the firewall subsystem.
AllowSignedApps	bit	True if signed apps are automatically allowed.
Unloading	bit	True if unloading the firewall kernel extension is allowed.
ConfigID	integer	Compyl configuration ID.
BatchDate	datetime	Date/time the data was synced into Compyl.

KandjiPrismFileVaults

Captures per‑device FileVault (disk‑encryption) posture from the Kandji Prism API, including key escrow status and rotation schedules.

Name	Type	Description
ID	integer	Unique identifier for the FileVault status record.
DeviceID	string	Unique identifier of the device.
DeviceFamily	string	Platform family (e.g., `Mac`).
Tags	string	Comma‑separated tags associated with the device.
ModelId	string	Kandji internal model identifier.
Count	integer	Number of FileVault‑related events in the snapshot.
CreatedAt	datetime	When this status record was created.
UpdatedAt	datetime	When the record was last updated.
LastChangedAt	datetime	When FileVault settings last changed on the device.
LastCollectedAt	datetime	When data was last collected from Kandji.
Status	bit	True if FileVault is enabled on the device.
KeyType	string	Recovery‑key type (`Personal`, `Institutional`).
KeyEscrowed	bit	True if the recovery key is escrowed to Kandji/MDM.
RegenerationNeeded	bit	True if a new recovery key must be generated.
ScheduledKeyRotation	datetime	Next scheduled rotation date/time for the recovery key.
ConfigID	integer	Compyl configuration ID.
BatchDate	datetime	Date/time the data was synced into Compyl.

KandjiUsers

The KandjiUsers table stores user data synchronized from the Kandji integration. It contains details about each user, including their unique identifier, email, name, department, and job title. The table also tracks the user's active and archived status, associated integration details, device count, and timestamps for creation and updates.

Name	Type	Description
Active	bit	A bit indicating whether the user is active (e.g., `true`).
Archived	bit	A bit indicating whether the user is archived (e.g., `false`).
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
CreatedAt	datetime	The timestamp of when the user was created (e.g., `2024-09-06T21:00:04.304248Z`).
Department	string	The department the user belongs to (null if not provided).
DeprecatedUserId	string	A deprecated user ID (e.g., `29360`).
DeviceCount	integer	The count of devices associated with the user (e.g., `2`).
Email	string	The email address of the user (e.g., `[email protected]`).
integrationID	integer	The unique identifier for the integration (e.g., `634`).
integrationName	string	The name of the integration associated with the user (e.g., `accuhive`).
integrationType	string	The type of the integration (e.g., `office365`).
integrationUuid	string	The unique UUID of the integration (e.g., `f7461096-4ef9-43aa-88e9-ca1967ba0b38`).
JobTitle	string	The job title of the user (null if not provided).
Name	string	The name of the user (e.g., `test_user_01`).
UpdatedAt	datetime	The timestamp of when the user information was last updated (e.g., `2024-09-06T21:00:04.304280Z`).
UserId	string	The unique identifier for the user (e.g., `69c009ca-1f78-4bdf-bb93-08d6d39041db`).