Armis V3
App Vendor: Armis
App Category: Analytics & SIEM, IoT Security
Connector Version: 1.0.0
API Version: v3
About App
The armis v3 app enables security teams to integrate with the armis platform to access asset intelligence, security insights, and risk context. This integration helps organizations streamline security operations and respond to threats more efficiently.
The Armis V3 app is configured with Cyware Orchestrate to perform the following actions:
Action Name | Description |
|---|---|
Create Device Custom Property Configuration | This action creates a new device custom property configuration. |
Create Site | This action creates a new site. |
Delete Device Custom Property Configuration | This action deletes a device custom property configuration. |
Delete Site | This action deletes a site. |
Enable Data Export Legacy | This action enables data export for the specified entity (legacy helper). |
Enable or Disable Data Export | This action enables or disables export for the specified entity. |
Get Collector Image | This action retrieves the details required to download and run a collector's image. |
Get Data Export URLs | This action retrieves the URLs of the latest data exports for the specified entity. |
Get Device Custom Property Configuration | This action retrieves the details of a device custom property configuration. |
Get Site | This action retrieves the details of a site. |
List Device Custom Property Configurations | This action retrieves all device custom property configurations. |
List Searchable Asset Fields | This action retrieves the list of allowed fields for asset search. |
List Sites | This action retrieves the list of sites. |
Search Asset Properties by Data Source | This action searches asset properties filtered by the data source. |
Search Assets | This action searches assets that match the given criteria. |
Update Assets in Bulk | This action updates assets in bulk. |
Update Device Custom Property Configuration | This action updates an existing device custom property configuration. |
Update Site | This action updates an existing site. |
Generic Action | This action performs a custom Armis API call using the specified method and endpoint. |
Configuration Parameters
The following configuration parameters are required for the Armis V3 app to communicate with the Armis V3 enterprise application. The parameters can be configured by creating instances in the app.
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Client ID | Enter the email or client identifier of the secret creator. | Text | Required | |
Client Secret | Enter the tenant-generated secret. | Password | Required | |
Tenant Domain | Enter your Armis tenant identifier. Example: If your login URL is https://secops.armis.com, enter secops. | Text | Required | |
Vendor ID | Enter the vendor ID. Example: aegv1bl6rc | Text | Required | |
Verify | Choose your preference to verify SSL or TLS while making requests. It is recommended to set this option to yes. Passing no may result in connection errors. | Boolean | Optional | Allowed values: true and false Default value: true |
Timeout | Enter the timeout value in seconds. This is the number of seconds that requests will wait to establish a connection with Armis V3. | Integer | Optional | Allowed range: 15-120 Default value: 15 |
Action: Create Device Custom Property Configuration
This action creates a new device custom property configuration.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Name | Enter the property name with a maximum of 40 characters. | Text | Required | |
Property Type | Enter the property type. Example: string | Text | Required | Allowed values: boolean, enum, externallink, integer, string, timestamp |
Description | Enter the description for the property, with a maximum of 250 characters. | Text | Optional | |
Allowed Values | Enter the list of allowed values. format: $list[values]. | List | Optional | This is required if the property type is enum. |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values] | List | Optional | Default value: PERMISSION.SETTINGS.CUSTOM_PROPERTIES.MANAGE. |
Example Request
[
{
"name": "location",
"property_type": "string"
}
]Action: Create Site
This action creates a new site.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Name | Enter the site name. Example: office 1 | Text | Required | |
Location | Enter the site location. Example: New York | Text | Optional | |
Parent ID | Enter the parent site ID. Example: 100 | Integer | Optional | |
Tier | Enter the site tier. | Text | Optional | |
ASQ rule | Enter the ASQ rule. | Key Value | Optional | |
ASQ | Enter the description for the ASQ rule. | Text | Optional | |
Network Equipment Device IDs | Enter the list of related network equipment device IDs. Follow the format: $LIST[values]. Example: $LIST[1001, 1002] | List | Optional | |
Integration IDs | Enter the list of related integration IDs. Follow the format: $LIST[values] Example: $LIST[1, 2] | List | Optional | |
Scopes | Enter the additional OAuth scopes. Follow format: $LIST[values]. | List | Optional | Default value: PERMISSION.SETTINGS.SITES_AND_SENSORS.MANAGE.SITES |
Example Request
[
{
"name": "Site 153",
"asq_rule": {}
}
]Action: Delete Device Custom Property Configuration
This action deletes a device custom property configuration.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Config ID | Enter the configuration identifier. Example: 50 | Integer | Required | |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values] | List | Optional | Default value: PERMISSION.SETTINGS.CUSTOM_PROPERTIES.MANAGE |
Example Request
[
{
"config_id": 467
}
]Action: Delete Site
This action deletes a site.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Site ID | Enter the site identifier. Example: 100 | Integer | Required | You can retrieve the site ID using the List Sites action. |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values]. | List | Optional | Default value: PERMISSION.SETTINGS.SITES_AND_SENSORS.MANAGE.SITES |
Example Request
[
{
"site_id": 1285
}
]Action: Enable Data Export Legacy
This action enables data export for the specified entity (legacy helper).
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Entity | Enter the entity type. Example: applications | Text | Required | Allowed values: applications, risk-factors, vulnerabilities |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values]. | List | Optional | Default value: PERMISSION.REPORT.MANAGE.CREATE |
Example Request
[
{
"entity": "risk-factors"
}
]Action: Enable or Disable Data Export
This action enables or disables export for the specified entity.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Entity | Enter the target entity for export. Example: applications | Text | Required | Allowed values: applications, risk-factors, vulnerabilities. |
Enabled | Enter true to enable export or false to disable. | Boolean | Required | |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values]. | List | Optional | Default value: PERMISSION.REPORT.MANAGE.CREATE, PERMISSION.REPORT.MANAGE.DELETE |
Example Request
[
{
"entity": "risk-factors",
"enabled": false
}
]Action: Get Collector Image
This action retrieves the details required to download and run a collector's image.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Image Type | Enter the image type. | Text | Optional | Allowed values: DARWIN_AMD64_BROKER, DARWIN_ARM64_BROKER, DEB, LINUX_AMD64_BROKER, LINUX_ARM64_BROKER, OVA , QCOW2, RPM, VHD, VHDX, WINDOWS_BROKER Default value: OVA |
Scopes | Enter the additional OAuth scopes. Follow the format $LIST[values] | List | Optional | Default value: PERMISSION.SETTINGS.COLLECTOR.READ |
Example Request
[
{
"image_type": "OVA"
}
]Action: Get Data Export URLs
This action retrieves the URLs of the latest data exports for the specified entity.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Entity | Enter the entity type. Example: applications | Text | Required | Allowed values: applications, risk-factors, vulnerabilities |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values]. | List | Optional | Default value: PERMISSION.REPORT.READ, FULL_VISIBILITY |
Example Request
[
{
"entity": "applications"
}
]Action: Get Device Custom Property Configuration
This action retrieves the details of a device custom property configuration.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Config ID | Enter the configuration identifier. Example: 50 | Integer | Required | |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values]. | List | Optional | Default value: PERMISSION.SETTINGS.CUSTOM_PROPERTIES.READ. |
Example Request
[
{
"config_id": 50
}
]Action: Get Site
This action retrieves the details of a site.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Site ID | Enter the site identifier. Example: 100 | Integer | Required | You can retrieve the site ID using the List Sites action. |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values] | List | Optional | Default value: PERMISSION.SETTINGS.SITES_AND_SENSORS.READ. |
Example Request
[
{
"site_id": 1285
}
]Action: List Device Custom Property Configurations
This action retrieves all device custom property configurations.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values]. | List | Optional | Default value: PERMISSION.SETTINGS.CUSTOM_PROPERTIES.READ. |
Action: List Searchable Asset Fields
This action retrieves the list of allowed fields for asset search.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Asset Type | Enter the asset type. Example: DEVICE | Text | Optional | Allowed value: DEVICE |
Scopes | Optional OAuth scopes for this request. Follow the format: $LIST[values] | List | Optional |
Action: List Sites
This action retrieves the list of sites.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
After | Enter the pagination cursor for the next page. | Text | Optional | |
Limit | Enter the number of items per page. | Integer | Optional | Allowed range: 1-100 |
Scopes | Enter the additional oauth scopes. Follow the format: $LIST[values] | List | Optional | Default value: |
Action: Search Asset Properties by Data Source
This action searches asset properties filtered by the data source.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Data Sources | Enter the list of data source identifiers to filter by. Example: $LIST[AWS, API]. | List | Required | Allowed values: AWS, API, and more. For more information, see Search asset properties. |
Asset Type | Enter the asset type. | Text | Optional | Default value: DEVICE |
After | Enter the pagination cursor for the next page. | Text | Optional | |
Limit | Enter the number of items per page. | Integer | Optional | Allowed range: 1-1000 Default value: 100 |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values] | List | Optional | Default value: PERMISSION.DEVICE.READ, PERMISSION.PII.DEVICE, FULL_VISIBILITY |
Example Request
[
{
"data_sources": [
"API"
]
}
]Action: Search Assets
This action searches assets that match the given criteria.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Fields | Enter the list of field identifiers to return. Follow the format: $LIST[values] | List | Required | |
Asset IDs | Enter the list of asset IDs to search. Follow the format: $LIST[values]. Example: $LIST[457, 126] | List | Required | |
Asset ID Source | Enter the asset ID source. Example: A device can have an asset ID, a MAC address, an IPv4 address, and more. | Text | Optional | This field determines which field will be used to find the asset. |
Asset Type | Enter the asset type. Example: DEVICE | Text | Optional | Allowed value: DEVICE Default value: DEVICE |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values] | List | Optional | Default value: PERMISSION.DEVICE.READ, PERMISSION.PII.DEVICE, FULL_VISIBILITY |
Example Request
[
{
"fields": [
"brand"
],
"asset_ids": [
"527"
],
"asset_type": "DEVICE",
"asset_id_source": "IPV4_ADDRESS"
}
]Action: Update Assets in Bulk
This action updates assets in bulk.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Asset ID | Enter the list of asset IDs. Follow the format: $LIST[values]. Example: $list[457, 123] | List | Required | The list length must match the Operation, Key, and Value lists |
Operation | Enter the list of operations. Follow the format: $LIST[values] Example: $LIST[set, set, set] | List | Required | Provide one operation per asset ID (example, for 3 asset IDs, use 3 operations). Allowed value: set |
Property Key | Enter the list of property keys to update. Follow the format: $LIST[values]. Example: $LIST[tags, name, siteid] | List | Required | Length must match the asset ID list. |
Value | Enter the list of values for SET operations. Follow the format: $LIST[values]. Example: $LIST[value1, value2, value3] | List | Optional | This is required when the operation is SET, and the length must match the asset ID list. |
Asset Type | Enter the asset type. | Text | Optional | Default value: DEVICE |
Asset ID Source | Enter the identifier type for asset IDs. Example: ASSET_ID | Text | Optional | Allowed values: ASSET_ID, IPV4_ADDRESS, IPV6_ADDRESS, MAC_ADDRESS, SERIAL_NUMBER |
Scopes | Enter the additional OAuth scopes for this request. Follow the format: $LIST[values] | List | Optional | Default value: PERMISSION.DEVICE.MANAGE.EDIT |
Action: Update Device Custom Property Configuration
This action updates an existing device custom property configuration.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Config ID | Enter the configuration identifier. Example: 50 | Integer | Required | |
Description | Enter the new description for the configuration, with a maximum of 250 characters. | Text | Optional | |
Allowed Values | Enter the new list of allowed enum values. Follow the format: $LIST[values]. | List | Optional | |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values]. | List | Optional | Default value: |
Example Request
[
{
"config_id": 467,
"description": "custom property"
}
]Action: Update Site
This action updates an existing site.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Site ID | Enter the site identifier. Example: 100 | Integer | Required | You can retrieve the site ID using the List Sites action. |
Name | Enter the new site name. Example: office 1 | Text | Optional | |
Location | Enter the new location. Example: New York | Text | Optional | |
Parent ID | Enter the new parent site ID. Example: 100 | Integer | Optional | |
Tier | Enter the new site tier. | Text | Optional | |
ASQ | Enter the updated ASQ rule. | Key Value | Optional | |
ASQ Rule Description | Enter the updated ASQ rule description. | Text | Optional | |
Network Equipment Device IDs | Enter the updated list of network equipment device IDs. Follow the format: $List[values]. Example: $list[1001, 1002] | List | Optional | |
Integration IDs | Enter the updated list of integration IDs. Follow the format: $LIST[values]. Example: $LIST[1, 2] | List | Optional | |
Scopes | Enter the additional OAuth scopes. Follow the format: $LIST[values] | List | Optional | Default value: PERMISSION.SETTINGS.SITES_AND_SENSORS.MANAGE.SITES. |
Example Request
[
{
"name": "Site sample",
"site_id": 1285,
"asq_rule": {}
}
]Action: Generic Action
This action performs a custom Armis API call using the specified method and endpoint.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Method | Enter the HTTP method. for example: get. | Text | Required | Allowed values: GET, POST, PUT, PATCH, DELETE |
Endpoint | Enter the API endpoint path to call. Example: settings/sites | Text | Required | |
Query Params | Enter the dictionary of query parameters to append to the request. | Key Value | Optional | |
Payload | Enter the payload to send in the request body. | Any | Optional | |
Extra Fields | Enter the extra fields to pass to the API. | Key Value | Optional | Allowed keys: headers, payload_data, custom_output, download, filename, files, retry_wait, retry_count, and response_type |
Scopes | Optional OAuth scopes for this request. Follow the format: $LIST[values]. | List | Optional |