Armis

Use the Armis integration to search alerts and devices, tag and untag devices, and set alert statuses.

Utilities · Armis

Details

IDArmis
ProviderInsight Partners
CategoryUtilities
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Use the Armis integration to search alerts and devices, tag and untag devices, and set alert statuses.
This integration was integrated and tested with the latest version of Armis.

Configure Armis in Cortex

Parameter Description Required
Server URL   True
Fetch incidents   False
Incident type   False
Maximum number of incidents per fetch   False
Fetch alerts with status (UNHANDLED, SUPPRESSED, RESOLVED)   False
Fetch alerts with type The type of alerts are Policy Violation, System Policy Violation, Anomaly Detection If no type is chosen, all types will be fetched. False
Minimum severity of alerts to fetch   True
First fetch time The date or relative timestamp from which to begin fetching alerts.

Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.

For example: 01 April 2025, 01 March 2025 04:45:33, 2025-02-17T14:05:44Z.		 False
Trust any certificate (not secure)   False
Secret API Key   True
Fetch Alerts AQL Use this parameter to fetch incidents using a free AQL string rather than the simpler alert type, severity, etc. False
Proxy Whether to use the System proxy False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

armis-search-alerts

Search Armis Alerts.

Base Command

armis-search-alerts

Input

Argument Name Description Required
max_results The maximum number of results to get. Default is 50. Optional
time_frame Filter by start time.
Examples:
“3 days ago”
“1 month”
“2019-10-10T12:22:00”
“2019-10-10”. Default is 3 days.		 Optional
alert_id The ID of the alert. Optional
severity A comma-separated list of alert severity levels by which to filter the search results. Possible values: “Low”, “Medium”, and “High”. Optional
status A comma-separated list of alert statuses by which to filter the search results. Possible values: “UNHANDLED”, “SUPPRESSED”, and “RESOLVED”. Optional
alert_type A comma-separated list of alert types by which to filter the search results. Possible values: “Policy Violation”, “System Policy Violation”, and “Anomaly Detection” Optional

Context Output

Path Type Description
Armis.Alert.activityIds Number The activity IDs of the alert.
Armis.Alert.activityUUIDs String The activity UUIDs of the alert.
Armis.Alert.alertId Number The ID of the alert.
Armis.Alert.connectionIds Number The connection IDs of the alert.
Armis.Alert.description String A text description of the alert.
Armis.Alert.deviceIds Number The device IDs of the alert
Armis.Alert.severity String The severity of the alert.
Armis.Alert.status String The status of the alert.
Armis.Alert.time Date The date and time the alert occurred.
Armis.Alert.title String The title of the alert.
Armis.Alert.type String The type of the alert.

Command Example

!armis-search-alerts status=RESOLVED max_results=10

Context Example

{
    "Armis": {
        "Alert": {
            "activityIds": [
                23314066,
                23316462,
                23317202,
                23326470,
                23341779,
                23342441
            ],
            "activityUUIDs": [
                "enyZFHgBAAAC-vCT9nJG",
                "0Hy2FHgBAAAC-vCTGnJB",
                "3Hy_FHgBAAAC-vCTp3Kz",
                "v3wSFXgBAAAC-vCTFnNL",
                "_nxOGHgBAAAC-vCTUnc2",
                "2HxpGHgBAAAC-vCT03jo"
            ],
            "alertId": 3984,
            "connectionIds": [
                923419,
                923501,
                924451
            ],
            "description": "Smart TV started connection to Corporate Network",
            "deviceIds": [
                165722,
                532
            ],
            "severity": "Medium",
            "status": "Resolved",
            "time": "2021-03-09T01:28:44.032944+00:00",
            "title": "Smart TV connected to Corporate network",
            "type": "System Policy Violation"
        }
    }
}

Human Readable Output

Alerts

Severity Type Time Status Title Description Activity Ids Activity UUI Ds Alert Id Connection Ids Device Ids
Medium System Policy Violation 2021-03-09T01:28:44.032944+00:00 Resolved Smart TV connected to Corporate network Smart TV started connection to Corporate Network 23314066,
23316462,
23317202,
23326470,
23341779,
23342441		 enyZFHgBAAAC-vCT9nJG,
0Hy2FHgBAAAC-vCTGnJB,
3Hy_FHgBAAAC-vCTp3Kz,
v3wSFXgBAAAC-vCTFnNL,
_nxOGHgBAAAC-vCTUnc2,
2HxpGHgBAAAC-vCT03jo		 3984 923419,
923501,
924451		 165722,
532

armis-update-alert-status

Updates the status for an alert.

Base Command

armis-update-alert-status

Input

Argument Name Description Required
alert_id The ID of the alert to update. Required
status New status of the alert. Possible values are: UNHANDLED, RESOLVED, SUPPRESSED. Required

Context Output

There is no context output for this command.

Command Example


#### Human Readable Output

### armis-search-alerts-by-aql-string

***
Searches the alerts with a raw AQL string.

#### Base Command

`armis-search-alerts-by-aql-string`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| aql_string | The AQL string to by which to search. | Required |
| max_results | The maximum number of results to get. Default is 50. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Armis.Alert.activityIds | Number | The activity IDs of the alert. |
| Armis.Alert.activityUUIDs | String | The activity UUIDs of the alert. |
| Armis.Alert.alertId | Number | The ID of the alert. |
| Armis.Alert.connectionIds | Number | The connection IDs of the alert. |
| Armis.Alert.description | String | The description of the alert. |
| Armis.Alert.deviceIds | Number | The device IDs of the alert. |
| Armis.Alert.severity | String | The severity of the alert. |
| Armis.Alert.status | String | The status of the alert. |
| Armis.Alert.time | Date | The date and time the alert occurred. |
| Armis.Alert.title | String | The title of the alert. |
| Armis.Alert.type | String | The type of the alert. |

#### Command Example

```!armis-search-alerts-by-aql-string aql_string="alertId:(3821)"```

#### Context Example

```json
{
    "Armis": {
        "Alert": {
            "activityIds": [
                22060159
            ],
            "activityUUIDs": [
                "nTiGqXcBAAAC-vCTfzPN"
            ],
            "alertId": 3821,
            "connectionIds": [],
            "description": "The Armis security platform has detected a violation of a policy and generated an alert.",
            "deviceIds": [
                199808
            ],
            "severity": "Medium",
            "status": "Resolved",
            "time": "2021-02-16T06:23:02.101479+00:00",
            "title": "Unencrypted Traffic: SMB",
            "type": "System Policy Violation"
        }
    }
}

Human Readable Output

Alerts

Alert Id Description Type Title Severity Status Time Activity Ids Activity UUI Ds Device Ids
3821 The Armis security platform has detected a violation of a policy and generated an alert. System Policy Violation Unencrypted Traffic: SMB Medium Resolved 2021-02-16T06:23:02.101479+00:00 22060159 nTiGqXcBAAAC-vCTfzPN 199808

armis-tag-device

Adds a tag to a device.

Base Command

armis-tag-device

Input

Argument Name Description Required
device_id The ID of the device to add a tag to. Required
tags The tags to add to the device. Required

Context Output

There is no context output for this command.

Command Example

!armis-tag-device device_id=165722 tags=test

Human Readable Output

Successfully Tagged device: 165722 with tags: [‘test’]

armis-untag-device

Removes a tag from a device.

Base Command

armis-untag-device

Input

Argument Name Description Required
device_id The ID of the device to remove a tag from. Required
tags The tags to remove from the device. Required

Context Output

There is no context output for this command.

Command Example

!armis-untag-device device_id=165722 tags=test

Human Readable Output

Successfully Untagged device: 165722 with tags: [‘test’]

armis-search-devices

Search devices by identifiers.

Base Command

armis-search-devices

Input

Argument Name Description Required
name The name of the device to search for. Optional
device_id The ID of the device to search for. Optional
mac_address The MAC address of the device to search for. Optional
ip_address The IP address of the device to search for. Optional
device_type A comma-separated list of device types by which to filter the results. for example “Routers”, “Laptops”, “IP Cameras” (there are many device types. for a full list access your Armis instance). Optional
time_frame The time frame of the device to search for. Optional
max_results The maximum number of results to get. Default is 50. Optional
risk_level A comma-separated list of device risk levels by which to filter the results. Possible values: “Low”, “Medium”, and “High”. Optional

Context Output

Path Type Description
Armis.Device.accessSwitch String The access switch of the device.
Armis.Device.category String The category of the device.
Armis.Device.firstSeen Date The first time the device was seen.
Armis.Device.id Number The ID of the device.
Armis.Device.ipaddress String The IP address of the device.
Armis.Device.ipv6 String The IPv6 address of the device.
Armis.Device.lastSeen Date The last time the device was seen.
Armis.Device.macAddress String The MAC address of the device.
Armis.Device.manufacturer String The manufacturer of the device.
Armis.Device.model String The model of the device.
Armis.Device.name String The name of the device.
Armis.Device.operatingSystem String The operating system of the device.
Armis.Device.operatingSystemVersion String The operating system version of the device.
Armis.Device.purdueLevel String The purdue level of the device.
Armis.Device.riskLevel String The risk level of the device.
Armis.Device.sensor String The sensor of the device.
Armis.Device.site String The site of the device.
Armis.Device.tags String The tags of the device.
Armis.Device.type String The type of the device.
Armis.Device.user String The user of the device.
Armis.Device.visibility String The visibility of the device.

Command example

!armis-search-devices device_id=2172

Context Example

{
    "Armis": {
        "Device": {
            "accessSwitch": null,
            "boundaries": "Corporate",
            "category": "Computers",
            "customProperties": {},
            "dataSources": [
                {
                    "firstSeen": "2022-08-11T07:54:32.167939+00:00",
                    "lastSeen": "2022-11-28T14:56:36.198248+00:00",
                    "name": "Active Directory",
                    "types": [
                        "Asset & System Management",
                        "Identity Provider"
                    ]
                },
                {
                    "firstSeen": "2021-08-15T07:37:58.891683+00:00",
                    "lastSeen": "2022-11-28T21:02:20.208248+00:00",
                    "name": "CrowdStrike",
                    "types": [
                        "Agent Based",
                        "Endpoint Protection"
                    ]
                },
                {
                    "firstSeen": "2022-07-09T07:50:51.190248+00:00",
                    "lastSeen": "2022-11-28T20:02:52.190248+00:00",
                    "name": "MBAM (BitLocker)",
                    "types": [
                        "Asset & System Management"
                    ]
                },
                {
                    "firstSeen": "2022-11-16T13:55:23.190248+00:00",
                    "lastSeen": "2022-11-28T21:30:45.190248+00:00",
                    "name": "Palo Alto Networks GlobalProtect",
                    "types": [
                        "Firewall"
                    ]
                },
                {
                    "firstSeen": "2022-07-12T12:55:47.190248+00:00",
                    "lastSeen": "2022-11-28T23:42:41.190248+00:00",
                    "name": "Qualys",
                    "types": [
                        "Vulnerability Management"
                    ]
                },
                {
                    "firstSeen": "2022-07-09T07:50:51.190248+00:00",
                    "lastSeen": "2022-11-28T20:02:52.190248+00:00",
                    "name": "SCCM",
                    "types": [
                        "Asset & System Management",
                        "Patch Management"
                    ]
                },
                {
                    "firstSeen": "2022-07-22T06:36:52.190248+00:00",
                    "lastSeen": "2022-07-22T06:40:36.190248+00:00",
                    "name": "ServiceNow",
                    "types": [
                        "Asset & System Management"
                    ]
                },
                {
                    "firstSeen": "2022-11-21T17:00:00.360310+00:00",
                    "lastSeen": "2022-11-28T22:23:35.190248+00:00",
                    "name": "Traffic Inspection",
                    "types": [
                        "Traffic Inspection",
                        "Data Analysis"
                    ]
                },
                {
                    "firstSeen": "2022-06-13T07:10:57.686241+00:00",
                    "lastSeen": "2022-11-22T00:59:54.686241+00:00",
                    "name": "User",
                    "types": [
                        "Data Upload"
                    ]
                },
                {
                    "firstSeen": "2022-11-15T10:05:08.190248+00:00",
                    "lastSeen": "2022-11-28T21:30:45.190248+00:00",
                    "name": "Aruba WLC",
                    "types": [
                        "WLC"
                    ]
                }
            ],
            "firstSeen": "2022-11-21T16:59:58.360310+00:00",
            "id": 2172,
            "ipAddress": "10.77.27.183",
            "ipv6": "fe80::647b:ba0f:9628:6014",
            "lastSeen": "2022-11-29T18:42:50.190248+00:00",
            "macAddress": "50:76:AF:D3:3F:AB",
            "manufacturer": "Lenovo",
            "model": "ThinkPad X1 Yoga 3rd Gen",
            "name": "000000731194pc.corporate.acme.com",
            "operatingSystem": "Windows",
            "operatingSystemVersion": "10",
            "purdueLevel": 4,
            "riskLevel": 5,
            "sensor": {
                "name": "PALO_ALTO-IDF04-SW01:Gig1/0/44 Enterprise",
                "type": "Access Switch"
            },
            "site": {
                "location": "Palo Alto",
                "name": "Palo Alto Enterprise"
            },
            "tags": [
                "Corporate",
                "ServiceNow",
                "SCCM"
            ],
            "type": "Laptops",
            "userIds": [
                12
            ],
            "visibility": "Full"
        }
    }
}

Human Readable Output

Devices

Risk Level Id Name Type Ip Address Ipv 6 Mac Address Operating System Operating System Version Manufacturer Model Tags
5 2172 000000731194pc.corporate.acme.com Laptops 10.77.27.183 fe80::647b:ba0f:9628:6014 50:76:AF:D3:3F:AB Windows 10 Lenovo ThinkPad X1 Yoga 3rd Gen Corporate,
ServiceNow,
SCCM

armis-search-devices-by-aql

Searches devices with a custom AQL search string.

Base Command

armis-search-devices-by-aql

Input

Argument Name Description Required
aql_string The AQL string. Required
max_results The maximum number of results to get. Default is 50. Optional

Context Output

Path Type Description
Armis.Device.accessSwitch String The access switch of the device.
Armis.Device.category String The category of the device.
Armis.Device.firstSeen Date The first time the device was seen.
Armis.Device.id Number The ID of the device.
Armis.Device.ipaddress String The IP address of the device.
Armis.Device.ipv6 String The IPv6 address of the device.
Armis.Device.lastSeen Date The last time the device was seen.
Armis.Device.macAddress String The MAC address of the device.
Armis.Device.manufacturer String The manufacturer of the device.
Armis.Device.model String The model of the device.
Armis.Device.name String The name of the device.
Armis.Device.operatingSystem String The operating system of the device.
Armis.Device.operatingSystemVersion String The operating system version of the device.
Armis.Device.purdueLevel String The purdue level of the device.
Armis.Device.riskLevel String The risk level of the device.
Armis.Device.sensor String The sensor of the device.
Armis.Device.site String The site of the device.
Armis.Device.tags String The tags of the device.
Armis.Device.type String The type of the device.
Armis.Device.user String The user of the device.
Armis.Device.visibility String The visibility of the device.

Command Example

!armis-search-devices-by-aql aql_string="macAddress:(a4:5d:36:c5:32:69)"

Context Example

{
    "Armis": {
        "Device": {
            "accessSwitch": "win-sw-hoc-01:po9",
            "category": "Computers",
            "dataSources": [
                {
                    "firstSeen": "2020-10-01T11:56:48+00:00",
                    "lastSeen": "2021-03-11T20:26:40+00:00",
                    "name": "Meraki",
                    "types": [
                        "WLC"
                    ]
                },
                {
                    "firstSeen": "2021-02-02T08:34:10.536715+00:00",
                    "lastSeen": "2021-03-11T20:21:22.374047+00:00",
                    "name": "Network Mapper",
                    "types": [
                        "Network Monitoring"
                    ]
                },
                {
                    "firstSeen": "2020-07-05T11:25:24.128383+00:00",
                    "lastSeen": "2021-03-11T20:32:33.494314+00:00",
                    "name": "Traffic Inspection",
                    "types": [
                        "Traffic Inspection",
                        "Data Analysis"
                    ]
                }
            ],
            "firstSeen": "2020-06-01T00:30:32.318087+00:00",
            "id": 74745,
            "ipAddress": "10.0.100.10",
            "ipv6": null,
            "lastSeen": "2021-03-11T20:32:33.494314+00:00",
            "macAddress": "a4:5d:36:c5:32:69",
            "manufacturer": "Hewlett Packard",
            "model": "Hewlett device",
            "name": "wc-shoretel.winslow.local",
            "operatingSystem": "Windows",
            "operatingSystemVersion": "Server 2008 R2",
            "riskLevel": 10,
            "sensor": {
                "name": "win-wap-tfm-01",
                "type": "Access Point"
            },
            "site": {
                "location": "28 Merri Concourse, Campbellfield VIc 3061 Australia",
                "name": "Winslow Small Plant"
            },
            "tags": [
                "MERAKI_NETWORK=Winslow Campbellfield"
            ],
            "type": "Servers",
            "user": "",
            "visibility": "Full"
        }
    }
}

Human Readable Output

Devices

Risk Level Name Type Ip Address Tags Id
10 wc-shoretel.winslow.local Servers 10.0.100.10 MERAKI_NETWORK=Winslow Campbellfield 74745

Configuration parameters

  • url — Server URL (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • max_fetch — Maximum number of incidents per fetch
  • alert_status — Fetch alerts with status (UNHANDLED,SUPPRESSED,RESOLVED)
  • alert_type — Fetch alerts with type
  • min_severity — Minimum severity of alerts to fetch (required)
  • first_fetch — First fetch time
  • insecure — Trust any certificate (not secure)
  • secret — Secret API Key (required)
  • free_fetch_string — Fetch Alerts AQL
  • proxy — Use system proxy settings

Commands (7)

  • armis-search-alerts

    Search Armis alerts.

  • armis-search-alerts-by-aql-string

    Search the alerts with a raw AQL string.

  • armis-search-devices

    Search devices by identifiers.

  • armis-search-devices-by-aql

    Search devices with a custom AQL search string.

  • armis-tag-device

    Add a tag to a device.

  • armis-untag-device

    Remove a tag from a device.

  • armis-update-alert-status

    Update the status for an alert.

Source

Armis.py Armis_test.py Armis.yml Armis_description.md command_examples.txt
Download History Raw 
category: Utilities
provider: Insight Partners
sectionorder:
- Connect
- Collect
commonfields:
  id: Armis
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: '10'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: UNHANDLED
  display: Fetch alerts with status (UNHANDLED,SUPPRESSED,RESOLVED)
  name: alert_status
  options:
  - UNHANDLED
  - SUPPRESSED
  - RESOLVED
  type: 16
  section: Collect
  advanced: true
  required: false
- additionalinfo: The type of alerts are Policy Violation, System Policy Violation, Anomaly Detection. If no type is chosen, all types will be fetched.
  display: Fetch alerts with type
  name: alert_type
  options:
  - Policy Violation
  - System Policy Violation
  - Anomaly Detection
  type: 16
  section: Collect
  advanced: true
  required: false
- defaultvalue: Low
  display: Minimum severity of alerts to fetch
  name: min_severity
  options:
  - Low
  - Medium
  - High
  required: true
  type: 15
  section: Collect
- additionalinfo: "The date or relative timestamp from which to begin fetching alerts.\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\nFor example: 01 April 2025, 01 March 2025 04:45:33, 2025-02-17T14:05:44Z."
  defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Secret API Key
  name: secret
  required: true
  type: 4
  section: Connect
- additionalinfo: Use this parameter to fetch incidents using a free AQL string rather than the simpler alert type, severity, etc.
  display: Fetch Alerts AQL
  name: free_fetch_string
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: Whether to use the system proxy.
  display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Use the Armis integration to search alerts and devices, tag and untag devices, and set alert statuses.
display: Armis
name: Armis
script:
  commands:
  - arguments:
    - defaultValue: '50'
      description: The maximum number of results to fetch.
      name: max_results
    - defaultValue: 3 days
      description: "Filter by start time. \nExamples:\n  \"3 days ago\"\n  \"1 month\"\n  \"2019-10-10T12:22:00\"\n  \"2019-10-10\"."
      name: time_frame
    - description: The ID of the alert.
      name: alert_id
    - description: 'A comma-separated list of alert severity levels by which to filter the search results. Possible values: "Low", "Medium", and "High".'
      isArray: true
      name: severity
    - description: 'A comma-separated list of alert statuses by which to filter the search results. Possible values: "UNHANDLED", "SUPPRESSED", and "RESOLVED".'
      isArray: true
      name: status
    - description: 'A comma-separated list of alert types by which to filter the search results. Possible values: "Policy Violation", "System Policy Violation", and "Anomaly Detection".'
      isArray: true
      name: alert_type
    description: Search Armis alerts.
    name: armis-search-alerts
    outputs:
    - contextPath: Armis.Alert.activityIds
      description: The activity IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.activityUUIDs
      description: The activity UUIDs of the alert.
      type: String
    - contextPath: Armis.Alert.alertId
      description: The ID of the alert.
      type: Number
    - contextPath: Armis.Alert.connectionIds
      description: The connection IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.description
      description: A text description of the alert.
      type: String
    - contextPath: Armis.Alert.deviceIds
      description: The device IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: Armis.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: Armis.Alert.time
      description: The date and time the alert occurred.
      type: Date
    - contextPath: Armis.Alert.title
      description: The title of the alert.
      type: String
    - contextPath: Armis.Alert.type
      description: The type of the alert.
      type: String
  - arguments:
    - description: The ID of the alert to update.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: 'New status of the alert. Possible values: "UNHANDLED", "RESOLVED", and "SUPPRESSED".'
      name: status
      predefined:
      - UNHANDLED
      - RESOLVED
      - SUPPRESSED
      required: true
    description: Update the status for an alert.
    name: armis-update-alert-status
  - arguments:
    - description: The AQL string to by which to search.
      name: aql_string
      required: true
    - defaultValue: '50'
      description: The maximum number of results to fetch.
      name: max_results
    description: Search the alerts with a raw AQL string.
    name: armis-search-alerts-by-aql-string
    outputs:
    - contextPath: Armis.Alert.activityIds
      description: The activity IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.activityUUIDs
      description: The activity UUIDs of the alert.
      type: String
    - contextPath: Armis.Alert.alertId
      description: The ID of the alert.
      type: Number
    - contextPath: Armis.Alert.connectionIds
      description: The connection IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.description
      description: The description of the alert.
      type: String
    - contextPath: Armis.Alert.deviceIds
      description: The device IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: Armis.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: Armis.Alert.time
      description: The date and time the alert occurred.
      type: Date
    - contextPath: Armis.Alert.title
      description: The title of the alert.
      type: String
    - contextPath: Armis.Alert.type
      description: The type of the alert.
      type: String
  - arguments:
    - description: The ID of the device to add a tag to.
      name: device_id
      required: true
    - description: The tags to add to the device.
      isArray: true
      name: tags
      required: true
    description: Add a tag to a device.
    name: armis-tag-device
  - arguments:
    - description: The ID of the device to remove a tag from.
      name: device_id
      required: true
    - description: The tags to remove from the device.
      isArray: true
      name: tags
      required: true
    description: Remove a tag from a device.
    name: armis-untag-device
  - arguments:
    - description: The name of the device to search for.
      name: name
    - description: The ID of the device to search for.
      name: device_id
    - description: The MAC address of the device to search for.
      name: mac_address
    - description: The IP address of the device to search for.
      name: ip_address
    - description: A comma-separated list of device types by which to filter the results. for example "Routers", "Laptops", "IP Cameras" (there are many device types. for a full list access your Armis instance).
      isArray: true
      name: device_type
    - description: The time frame of the device to search for.
      name: time_frame
    - defaultValue: '50'
      description: The maximum number of results to get.
      name: max_results
    - description: 'A comma-separated list of device risk levels by which to filter the results. Possible values: "Low", "Medium", and "High".'
      isArray: true
      name: risk_level
    description: Search devices by identifiers.
    name: armis-search-devices
    outputs:
    - contextPath: Armis.Device.accessSwitch
      description: The access switch of the device.
      type: String
    - contextPath: Armis.Device.category
      description: The category of the device.
      type: String
    - contextPath: Armis.Device.firstSeen
      description: The first time the device was seen.
      type: Date
    - contextPath: Armis.Device.id
      description: The ID of the device.
      type: Number
    - contextPath: Armis.Device.ipaddress
      description: The IP address of the device.
      type: String
    - contextPath: Armis.Device.ipv6
      description: The IPv6 address of the device.
      type: String
    - contextPath: Armis.Device.lastSeen
      description: The last time the device was seen.
      type: Date
    - contextPath: Armis.Device.macAddress
      description: The MAC address of the device.
      type: String
    - contextPath: Armis.Device.manufacturer
      description: The manufacturer of the device.
      type: String
    - contextPath: Armis.Device.model
      description: The model of the device.
      type: String
    - contextPath: Armis.Device.name
      description: The name of the device.
      type: String
    - contextPath: Armis.Device.operatingSystem
      description: The operating system of the device.
      type: String
    - contextPath: Armis.Device.operatingSystemVersion
      description: The operating system version of the device.
      type: String
    - contextPath: Armis.Device.purdueLevel
      description: The purdue level of the device.
      type: String
    - contextPath: Armis.Device.riskLevel
      description: The risk level of the device.
      type: String
    - contextPath: Armis.Device.sensor
      description: The sensor of the device.
      type: String
    - contextPath: Armis.Device.site
      description: The site of the device.
      type: String
    - contextPath: Armis.Device.tags
      description: The tags of the device.
      type: String
    - contextPath: Armis.Device.type
      description: The type of the device.
      type: String
    - contextPath: Armis.Device.user
      description: The user of the device.
      type: String
    - contextPath: Armis.Device.visibility
      description: The visibility of the device.
      type: String
  - arguments:
    - description: The AQL string.
      name: aql_string
      required: true
    - defaultValue: '50'
      description: The maximum number of results to get.
      name: max_results
    description: Search devices with a custom AQL search string.
    name: armis-search-devices-by-aql
    outputs:
    - contextPath: Armis.Device.accessSwitch
      description: The access switch of the device.
      type: String
    - contextPath: Armis.Device.category
      description: The category of the device.
      type: String
    - contextPath: Armis.Device.firstSeen
      description: The first time the device was seen.
      type: Date
    - contextPath: Armis.Device.id
      description: The ID of the device.
      type: Number
    - contextPath: Armis.Device.ipaddress
      description: The P address of the device.
      type: String
    - contextPath: Armis.Device.ipv6
      description: The IPv6 address of the device.
      type: String
    - contextPath: Armis.Device.lastSeen
      description: The last time the device was seen.
      type: Date
    - contextPath: Armis.Device.macAddress
      description: The MAC address of the device.
      type: String
    - contextPath: Armis.Device.manufacturer
      description: The manufacturer of the device.
      type: String
    - contextPath: Armis.Device.model
      description: The model of the device.
      type: String
    - contextPath: Armis.Device.name
      description: The name of the device.
      type: String
    - contextPath: Armis.Device.operatingSystem
      description: The operating system of the device.
      type: String
    - contextPath: Armis.Device.operatingSystemVersion
      description: The operating system version of the device.
      type: String
    - contextPath: Armis.Device.purdueLevel
      description: The purdue level of the device.
      type: String
    - contextPath: Armis.Device.riskLevel
      description: The risk level of the device.
      type: String
    - contextPath: Armis.Device.sensor
      description: The sensor of the device.
      type: String
    - contextPath: Armis.Device.site
      description: The site of the device.
      type: String
    - contextPath: Armis.Device.tags
      description: The tags of the device.
      type: String
    - contextPath: Armis.Device.type
      description: The type of the device.
      type: String
    - contextPath: Armis.Device.user
      description: The user of the device.
      type: String
    - contextPath: Armis.Device.visibility
      description: The visibility of the device.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Armis-Test
defaultmapperin: Armis - Incoming Mapper
defaultclassifier: Armis - Classifier
fromversion: 5.0.0