Skip to main content


Download With Dependencies

This MobileIron UEM Content Pack enables fetching device data and incidents from both MobileIron Core and Cloud. The integration, apart from providing custom commands helpful when doing data enrichment, includes sample playbooks and an incident layout to help analyst investigations

MobileIron UEM is the foundation for the industry’s first mobile-centric, security platform.
With MobileIron, organizations can quickly and easily onboard devices and provision them over the
air with all of the apps, settings, and security configurations needed to protect any iOS, macOS, Android, and Windows 10
endpoint across your digital workplace.
MobileIron’s zero trust approach ensures that only authorized users, devices, apps, and services can access business resources.
Users enjoy a seamless and productive experience during enrollment and the single console enables IT administrators
to reduce the complexity and cost of managing a fleet of endpoints.

Platform compatibility

This MobileIron UEM content pack contains the integration with both UEM platforms that MobileIron offers:

  • MobileIron Core - an on-premise solution.
  • MobileIron Cloud - a SAAS offering for device management.

The pack contains the corresponding custom MobileIron UEM incident fields, mappers, and layouts to facilitate analyst investigation.

Requesting a trial

Anyone interested in trying the MobileIron platform and this integration can request a free trial through the mobileiron website.

What does this pack provide?

  • Commands to fetch device data based on certain common attributes such as a WiFi MAC address, device UUID, serial number, and IP address.
  • An option to fetch device data based on custom queries based on the MobileIron API Query DSL for the respective platform.
  • Commands to execute device specific actions such as retire, wipe, send message etc.
  • Ability to fetch and create incidents based on device data contained within MobileIron.
  • Sample playbooks demonstrating how remediation actions can be set-up to respond to device incidents.
  • Custom layout and incident mapper to better show the relevant data when using fetch incidents.

More information on the different ways to query the API can be found inside the platform specific API documentation:

This integration also focuses on providing a very similar set of functionalities between Core and Cloud
as to ease the work needed when the customer moves from one MobileIron UEM platform to the other.


MobileIron Inc.


Cortex XSOARCortex XSIAM


CertificationRead more
Supported ByPartner
CreatedJanuary 9, 2021
Last ReleaseFebruary 14, 2022

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.