TL;DR
| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
| iVerify Mobile EDR Devices | ✅ | iverify_mobile_edr_devices |
JSON | API |
Overview
iVerify is a mobile Endpoint Detection and Response (EDR) platform that provides continuous threat monitoring, vulnerability management, and compromise detection for enterprise mobile devices (iOS and Android). This integration ingests device inventory and posture records pulled from the iVerify API, capturing enrollment status, OS version and patch state, security configuration (biometrics, screen lock, VPN/network protection), risk scoring, and device/user identity for each managed mobile endpoint. This data gives security teams visibility into the compliance and risk posture of mobile endpoints that traditional MDM and legacy MTD tools often miss, enabling detection of out-of-date OS versions, disabled security controls, and devices at elevated risk of compromise (e.g., from spyware, jailbreaking/rooting, or sideloading). Each record corresponds to a single enrolled device and its latest known security/risk state, supporting both compliance monitoring and investigation workflows.
Supported data types
iVerify Mobile EDR Devices
Table name: iverify_mobile_edr_devices
This data type contains the device inventory and posture state of mobile endpoints enrolled in iVerify, including device identity, user association, OS and app version state, and security control status (biometrics, screen lock, network protection, smishing protection). It covers security events such as devices becoming out of date, disabling of security controls, and changes in device risk score, supporting detection of mobile endpoints at elevated risk of compromise.
Expected format
Logs are expected in JSON format.
{"id": 346873, "memberId": 118234, "identifier": "3F2A9B4C-1D5E-4A6F-8B3C-2E7D9F1A4C5B", "status": "ACTIVE", "platform": "iOS", "provisionedByCode": null, "added": "2026-07-21T17:27:54.329451Z", "deviceName": "Residence - Alex Johnson", "riskScore": 30, "device": "iPhone18,5", "secure": true, "biometrics": true, "screenLock": true, "version": "35.0", "latestAppVersion": "0.0", "isLatestVersion": true, "appBundleLastUpdatedData": "IOS_VPN_SCAN_PRODUCTION", "smishing": false, "networkProtection": false, "osVersionState": "OUT_OF_DATE", "latestOSVersion": "26.6.2", "isNotificationsEnabled": true, "enrolled": true, "guidesCompleted": "1/40", "isWorkProfile": false}
Send data to Hunters
Hunters supports the collection of iVerify logs using API.
To connect iVerify logs:
Connect using API
- Log in to the iVerify console as an administrator and create API credentials with read access to the device inventory data, following the iVerify documentation.
- Connect the data source in the Hunters portal with those credentials, as described in this section. Hunters pulls the data from the vendor API on a schedule.