ArmisEventCollector

Details

ID	`ArmisEventCollector`
Provider	Armis
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM

README

Collects alerts, devices and activities from Armis resources.
This integration was integrated and tested with API V.1.8 of Armis API.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Notes

Due to Armis API limitations, it is recommended to configure a separate integration instance for each event type (Alerts, Activities, Devices), and to tweak the limits according to the issues - lowering the limit for timeout or raising the limit for internal server errors.
Each instance must use its own unique API Secret Key. Reusing the same API Secret Key across multiple instances is prohibited by Armis and will cause authentication conflicts that lead to failed fetches.
Known issue — intermittent JSON decode errors. The Armis API may occasionally return malformed JSON responses (a known issue on the Armis side). The integration includes an automatic retry mechanism with exponential backoff to handle these transient failures, but in rare cases the error may still occur and will be logged.

Configure Armis Event Collector in Cortex

Parameter	Description	Required
Server URL	URL of the Armis instance the event collector should connect to.	True
API Secret Key	The API Secret Key allows you to programmatically integrate with the Armis ecosystem.	True
Maximum number of events per fetch	Alerts and activity events.
Maximum number of device events per fetch	Devices events.
Trust any certificate (not secure)
Use system proxy settings
Event types to fetch		True
Events Fetch Interval	Alerts and activity events.	False
Minutes to delay	Number of minutes to delay when fetching events (to handle events creation delay in the Armis database). Default is 10 minutes but note a higher value might be needed for users with heavier traffic.	False
Device Fetch Interval	Time between fetch of devices (for example 12 hours, 60 minutes, etc.).	False

Commands

You can execute these commands from a Cortex XSIAM incident War Room ,as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

armis-get-events

Manual command to fetch and display events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.

Base Command

armis-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to true in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Required
from_date	The date from which to fetch events. The format should be YYYY-MM-DD or YYYY-MM-DDT:HH:MM:SS. If not specified, the current date will be used.	Optional
event_type	The type of event to fetch. Possible values are: Alerts, Activities, Devices. Default is Alerts.	Optional
aql	Run your own AQL query to fetch events.	Optional

Context Output

There is no context output for this command.

Configuration parameters

server_url — Server URL (required)
credentials — (required)
max_fetch — Maximum number of events per fetch
devices_max_fetch — Maximum number of device events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
event_types_to_fetch — Event types to fetch (required)
eventFetchInterval — Events Fetch Interval
fetch_delay — Minutes to delay
deviceFetchInterval — Device Fetch Interval

Commands (1)

armis-get-events
Manual command to fetch and display events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.

Source

ArmisEventCollector.py ArmisEventCollector_test.py ArmisEventCollector.yml ArmisEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: Armis
sectionorder:
- Connect
- Collect
commonfields:
  id: ArmisEventCollector
  version: -1
configuration:
- defaultvalue: https://<armis-instance>.armis.com
  display: Server URL
  name: server_url
  required: true
  type: 0
  section: Connect
- displaypassword: API Secret Key
  additionalinfo: The API Secret Key allows you to programmatically integrate with the Armis ecosystem.
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Maximum number of events per fetch
  name: max_fetch
  additionalinfo: Alerts and activity events.
  type: 0
  defaultvalue: 50000
  section: Collect
- display: Maximum number of device events per fetch
  name: devices_max_fetch
  type: 0
  section: Collect
  additionalinfo: Devices events.
  defaultvalue: 50000
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  section: Connect
  type: 8
- display: Event types to fetch
  name: event_types_to_fetch
  section: Collect
  required: true
  type: 16
  defaultvalue: Alerts,Devices,Activities
  options:
  - Alerts
  - Devices
  - Activities
- section: Collect
  advanced: true
  display: Events Fetch Interval
  additionalinfo: Alerts and activity events.
  name: eventFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
- section: Collect
  advanced: true
  display: Minutes to delay
  additionalinfo: Number of minutes to delay when fetching events (to handle events creation delay in the Armis database). The default value is 10 minutes. A higher value can be configured in the event that some events are still not available within those ten minutes.
  name: fetch_delay
  defaultvalue: "10"
  type: 0
  required: false
- section: Collect
  advanced: true
  display: Device Fetch Interval
  additionalinfo: Time between fetch of devices (for example 12 hours, 60 minutes, etc.).
  name: deviceFetchInterval
  defaultvalue: "4 hours"
  type: 0
  required: false
description: Collects alerts, devices and activities from Armis resources.
display: Armis Event Collector
name: ArmisEventCollector
supportlevelheader: xsoar
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to true in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The date from which to fetch events. The format should be YYYY-MM-DD or YYYY-MM-DDT:HH:MM:SS. If not specified, the current date will be used.
      name: from_date
      required: false
    - auto: PREDEFINED
      defaultValue: 'Alerts'
      description: The type of event to fetch.
      name: event_type
      predefined:
      - 'Alerts'
      - 'Activities'
      - 'Devices'
      required: false
    - description: Run your own AQL query to fetch events.
      name: aql
      required: false
    description: Manual command to fetch and display events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.
    name: armis-get-events
  runonce: false
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10325753
marketplaces:
- marketplacev2
- platform
fromversion: 6.10.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam