category: Analytics & SIEM
provider: Armis
sectionorder:
- Connect
- Collect
commonfields:
  id: ArmisEventCollector
  version: -1
configuration:
- defaultvalue: https://<armis-instance>.armis.com
  display: Server URL
  name: server_url
  required: true
  type: 0
  section: Connect
- displaypassword: API Secret Key
  additionalinfo: The API Secret Key allows you to programmatically integrate with the Armis ecosystem.
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Maximum number of events per fetch
  name: max_fetch
  additionalinfo: Alerts and activity events.
  type: 0
  defaultvalue: 50000
  section: Collect
- display: Maximum number of device events per fetch
  name: devices_max_fetch
  type: 0
  section: Collect
  additionalinfo: Devices events.
  defaultvalue: 50000
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  section: Connect
  type: 8
- display: Event types to fetch
  name: event_types_to_fetch
  section: Collect
  required: true
  type: 16
  defaultvalue: Alerts,Devices,Activities
  options:
  - Alerts
  - Devices
  - Activities
- section: Collect
  advanced: true
  display: Events Fetch Interval
  additionalinfo: Alerts and activity events.
  name: eventFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
- section: Collect
  advanced: true
  display: Minutes to delay
  additionalinfo: Number of minutes to delay when fetching events (to handle events creation delay in the Armis database). The default value is 10 minutes. A higher value can be configured in the event that some events are still not available within those ten minutes.
  name: fetch_delay
  defaultvalue: "10"
  type: 0
  required: false
- section: Collect
  advanced: true
  display: Device Fetch Interval
  additionalinfo: Time between fetch of devices (for example 12 hours, 60 minutes, etc.).
  name: deviceFetchInterval
  defaultvalue: "4 hours"
  type: 0
  required: false
description: Collects alerts, devices and activities from Armis resources.
display: Armis Event Collector
name: ArmisEventCollector
supportlevelheader: xsoar
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to true in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The date from which to fetch events. The format should be YYYY-MM-DD or YYYY-MM-DDT:HH:MM:SS. If not specified, the current date will be used.
      name: from_date
      required: false
    - auto: PREDEFINED
      defaultValue: 'Alerts'
      description: The type of event to fetch.
      name: event_type
      predefined:
      - 'Alerts'
      - 'Activities'
      - 'Devices'
      required: false
    - description: Run your own AQL query to fetch events.
      name: aql
      required: false
    description: Manual command to fetch and display events. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and exceeding the API request limitation.
    name: armis-get-events
  runonce: false
  isfetchevents: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10325753
marketplaces:
- marketplacev2
- platform
fromversion: 6.10.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam