category: Utilities
provider: Insight Partners
sectionorder:
- Connect
- Collect
commonfields:
  id: Armis
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: '10'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: UNHANDLED
  display: Fetch alerts with status (UNHANDLED,SUPPRESSED,RESOLVED)
  name: alert_status
  options:
  - UNHANDLED
  - SUPPRESSED
  - RESOLVED
  type: 16
  section: Collect
  advanced: true
  required: false
- additionalinfo: The type of alerts are Policy Violation, System Policy Violation, Anomaly Detection. If no type is chosen, all types will be fetched.
  display: Fetch alerts with type
  name: alert_type
  options:
  - Policy Violation
  - System Policy Violation
  - Anomaly Detection
  type: 16
  section: Collect
  advanced: true
  required: false
- defaultvalue: Low
  display: Minimum severity of alerts to fetch
  name: min_severity
  options:
  - Low
  - Medium
  - High
  required: true
  type: 15
  section: Collect
- additionalinfo: "The date or relative timestamp from which to begin fetching alerts.\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\nFor example: 01 April 2025, 01 March 2025 04:45:33, 2025-02-17T14:05:44Z."
  defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Secret API Key
  name: secret
  required: true
  type: 4
  section: Connect
- additionalinfo: Use this parameter to fetch incidents using a free AQL string rather than the simpler alert type, severity, etc.
  display: Fetch Alerts AQL
  name: free_fetch_string
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: Whether to use the system proxy.
  display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Use the Armis integration to search alerts and devices, tag and untag devices, and set alert statuses.
display: Armis
name: Armis
script:
  commands:
  - arguments:
    - defaultValue: '50'
      description: The maximum number of results to fetch.
      name: max_results
    - defaultValue: 3 days
      description: "Filter by start time. \nExamples:\n  \"3 days ago\"\n  \"1 month\"\n  \"2019-10-10T12:22:00\"\n  \"2019-10-10\"."
      name: time_frame
    - description: The ID of the alert.
      name: alert_id
    - description: 'A comma-separated list of alert severity levels by which to filter the search results. Possible values: "Low", "Medium", and "High".'
      isArray: true
      name: severity
    - description: 'A comma-separated list of alert statuses by which to filter the search results. Possible values: "UNHANDLED", "SUPPRESSED", and "RESOLVED".'
      isArray: true
      name: status
    - description: 'A comma-separated list of alert types by which to filter the search results. Possible values: "Policy Violation", "System Policy Violation", and "Anomaly Detection".'
      isArray: true
      name: alert_type
    description: Search Armis alerts.
    name: armis-search-alerts
    outputs:
    - contextPath: Armis.Alert.activityIds
      description: The activity IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.activityUUIDs
      description: The activity UUIDs of the alert.
      type: String
    - contextPath: Armis.Alert.alertId
      description: The ID of the alert.
      type: Number
    - contextPath: Armis.Alert.connectionIds
      description: The connection IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.description
      description: A text description of the alert.
      type: String
    - contextPath: Armis.Alert.deviceIds
      description: The device IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: Armis.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: Armis.Alert.time
      description: The date and time the alert occurred.
      type: Date
    - contextPath: Armis.Alert.title
      description: The title of the alert.
      type: String
    - contextPath: Armis.Alert.type
      description: The type of the alert.
      type: String
  - arguments:
    - description: The ID of the alert to update.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: 'New status of the alert. Possible values: "UNHANDLED", "RESOLVED", and "SUPPRESSED".'
      name: status
      predefined:
      - UNHANDLED
      - RESOLVED
      - SUPPRESSED
      required: true
    description: Update the status for an alert.
    name: armis-update-alert-status
  - arguments:
    - description: The AQL string to by which to search.
      name: aql_string
      required: true
    - defaultValue: '50'
      description: The maximum number of results to fetch.
      name: max_results
    description: Search the alerts with a raw AQL string.
    name: armis-search-alerts-by-aql-string
    outputs:
    - contextPath: Armis.Alert.activityIds
      description: The activity IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.activityUUIDs
      description: The activity UUIDs of the alert.
      type: String
    - contextPath: Armis.Alert.alertId
      description: The ID of the alert.
      type: Number
    - contextPath: Armis.Alert.connectionIds
      description: The connection IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.description
      description: The description of the alert.
      type: String
    - contextPath: Armis.Alert.deviceIds
      description: The device IDs of the alert.
      type: Number
    - contextPath: Armis.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: Armis.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: Armis.Alert.time
      description: The date and time the alert occurred.
      type: Date
    - contextPath: Armis.Alert.title
      description: The title of the alert.
      type: String
    - contextPath: Armis.Alert.type
      description: The type of the alert.
      type: String
  - arguments:
    - description: The ID of the device to add a tag to.
      name: device_id
      required: true
    - description: The tags to add to the device.
      isArray: true
      name: tags
      required: true
    description: Add a tag to a device.
    name: armis-tag-device
  - arguments:
    - description: The ID of the device to remove a tag from.
      name: device_id
      required: true
    - description: The tags to remove from the device.
      isArray: true
      name: tags
      required: true
    description: Remove a tag from a device.
    name: armis-untag-device
  - arguments:
    - description: The name of the device to search for.
      name: name
    - description: The ID of the device to search for.
      name: device_id
    - description: The MAC address of the device to search for.
      name: mac_address
    - description: The IP address of the device to search for.
      name: ip_address
    - description: A comma-separated list of device types by which to filter the results. for example "Routers", "Laptops", "IP Cameras" (there are many device types. for a full list access your Armis instance).
      isArray: true
      name: device_type
    - description: The time frame of the device to search for.
      name: time_frame
    - defaultValue: '50'
      description: The maximum number of results to get.
      name: max_results
    - description: 'A comma-separated list of device risk levels by which to filter the results. Possible values: "Low", "Medium", and "High".'
      isArray: true
      name: risk_level
    description: Search devices by identifiers.
    name: armis-search-devices
    outputs:
    - contextPath: Armis.Device.accessSwitch
      description: The access switch of the device.
      type: String
    - contextPath: Armis.Device.category
      description: The category of the device.
      type: String
    - contextPath: Armis.Device.firstSeen
      description: The first time the device was seen.
      type: Date
    - contextPath: Armis.Device.id
      description: The ID of the device.
      type: Number
    - contextPath: Armis.Device.ipaddress
      description: The IP address of the device.
      type: String
    - contextPath: Armis.Device.ipv6
      description: The IPv6 address of the device.
      type: String
    - contextPath: Armis.Device.lastSeen
      description: The last time the device was seen.
      type: Date
    - contextPath: Armis.Device.macAddress
      description: The MAC address of the device.
      type: String
    - contextPath: Armis.Device.manufacturer
      description: The manufacturer of the device.
      type: String
    - contextPath: Armis.Device.model
      description: The model of the device.
      type: String
    - contextPath: Armis.Device.name
      description: The name of the device.
      type: String
    - contextPath: Armis.Device.operatingSystem
      description: The operating system of the device.
      type: String
    - contextPath: Armis.Device.operatingSystemVersion
      description: The operating system version of the device.
      type: String
    - contextPath: Armis.Device.purdueLevel
      description: The purdue level of the device.
      type: String
    - contextPath: Armis.Device.riskLevel
      description: The risk level of the device.
      type: String
    - contextPath: Armis.Device.sensor
      description: The sensor of the device.
      type: String
    - contextPath: Armis.Device.site
      description: The site of the device.
      type: String
    - contextPath: Armis.Device.tags
      description: The tags of the device.
      type: String
    - contextPath: Armis.Device.type
      description: The type of the device.
      type: String
    - contextPath: Armis.Device.user
      description: The user of the device.
      type: String
    - contextPath: Armis.Device.visibility
      description: The visibility of the device.
      type: String
  - arguments:
    - description: The AQL string.
      name: aql_string
      required: true
    - defaultValue: '50'
      description: The maximum number of results to get.
      name: max_results
    description: Search devices with a custom AQL search string.
    name: armis-search-devices-by-aql
    outputs:
    - contextPath: Armis.Device.accessSwitch
      description: The access switch of the device.
      type: String
    - contextPath: Armis.Device.category
      description: The category of the device.
      type: String
    - contextPath: Armis.Device.firstSeen
      description: The first time the device was seen.
      type: Date
    - contextPath: Armis.Device.id
      description: The ID of the device.
      type: Number
    - contextPath: Armis.Device.ipaddress
      description: The P address of the device.
      type: String
    - contextPath: Armis.Device.ipv6
      description: The IPv6 address of the device.
      type: String
    - contextPath: Armis.Device.lastSeen
      description: The last time the device was seen.
      type: Date
    - contextPath: Armis.Device.macAddress
      description: The MAC address of the device.
      type: String
    - contextPath: Armis.Device.manufacturer
      description: The manufacturer of the device.
      type: String
    - contextPath: Armis.Device.model
      description: The model of the device.
      type: String
    - contextPath: Armis.Device.name
      description: The name of the device.
      type: String
    - contextPath: Armis.Device.operatingSystem
      description: The operating system of the device.
      type: String
    - contextPath: Armis.Device.operatingSystemVersion
      description: The operating system version of the device.
      type: String
    - contextPath: Armis.Device.purdueLevel
      description: The purdue level of the device.
      type: String
    - contextPath: Armis.Device.riskLevel
      description: The risk level of the device.
      type: String
    - contextPath: Armis.Device.sensor
      description: The sensor of the device.
      type: String
    - contextPath: Armis.Device.site
      description: The site of the device.
      type: String
    - contextPath: Armis.Device.tags
      description: The tags of the device.
      type: String
    - contextPath: Armis.Device.type
      description: The type of the device.
      type: String
    - contextPath: Armis.Device.user
      description: The user of the device.
      type: String
    - contextPath: Armis.Device.visibility
      description: The visibility of the device.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Armis-Test
defaultmapperin: Armis - Incoming Mapper
defaultclassifier: Armis - Classifier
fromversion: 5.0.0