Issue
Does Red Canary ingest and monitor data from mobile devices, like Android tablets or iPhone iOS?
Environment
Red Canary
Resolution
If your organization has integrated identity sources with Red Canary, like Okta or Entra ID, we may receive sign-in logs from these sources for IdP authentication made from mobile devices and reference that data when monitoring for suspicious activity.
Additionally, Red Canary may ingest alerts from EDR platforms that provide mobile device support, like Crowdstrike Falcon for Mobile, though we do not consider the alerts strong investigative leads and will not conduct investigations on them at this time.
Cause
After integrating an identity source, Red Canary's coverage will generally monitor all logon activity, rather than logons from a particular OS.
Meanwhile, Red Canary's detection and response for endpoints continues to focus on Windows, macOS, and Linux operating systems.