Armis
Asset Management- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Armis Connector integrates with the Armis device security platform to synchronize asset inventory, security alerts, and vulnerability data. It connects to the Armis API to fetch device details, security alerts, and both infrastructure and application vulnerabilities across your network.
Official documentation can be found at https://docs.armis.com/api/.
Armis Standard Query (ASQ) documentation:
Data retrieved from Armis
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Host | Yes | Host |
| Cloud Resource | Yes | Cloud Resource |
| Alert | Yes | Alert |
| Alert Definition | Yes | Alert Definition |
| Vulnerability | Yes | Vulnerability |
| Vulnerability Definition | Yes | Vulnerability Definition |
Model relationships
For detailed steps on how to view the data retrieved from Armis in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Armis from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | Yes | Default - (user input, Required) | Armis server URL |
| API secret key | Yes | Default - (user input, Required) | Armis account API secret key |
| Page size | No | 100 | Maximum number of records to get per API request |
| SSL / TLS | No | false | Skip certificate verification |
| Maximum retries | No | 5 | Maximum number of API request retries |
Authentication
The connector uses an API secret key to obtain an access token for subsequent API requests.
Endpoint
| Method | URL |
|---|---|
POST | https://<tenant>.armis.com/api/v1/access_token/ |
Request Headers
| Header | Value |
|---|---|
Content-Type | application/x-www-form-urlencoded |
Request Body
secret_key=your-api-secret-key
Sample Response
{
"success": true,
"data": {
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"expiration_utc": "2026-03-24T12:00:00Z"
}
}
Response Fields
| Field | Type | Description |
|---|---|---|
access_token | String | Bearer token for API requests |
expiration_utc | Instant | Token expiration timestamp |
Usage
Once authenticated, all subsequent API requests include the access token in the Authorization header:
Authorization: <token>
How to obtain Armis credentials
Generate an Armis API key
For the Armis connector to use the Armis API, you must provide an API key. To generate a new API key, follow these steps:
-
Log in to your organization's Armis server as an administrator.
-
Navigate to Settings > API Management.
-
Click Create.
This page also includes links to the Armis API Docs and API Guide. These links are located under the Usage Example section.
Your new API key displays. While you can come back to this page and obtain your API key, it is recommended that you handle it with caution by storing it in a safe and secure location.
Note: If you do not have the permissions to create an API key, contact your Armis administrator. For additional information, see Armis documentation.
Info: You can verify your API key with a simple request: bash curl -X GET "https://api.armis.com/v1/search" \ -H "x-api-key: YOUR_API_KEY"
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Host
| Source Field Name | SDM Attribute |
|---|---|
device.category / device.type | CATEGORIES |
device.customProperties.sec_asset_risk | SEC_ASSET_RISK |
device.customProperties.sec_exposure_risk | SEC_EXPOSURE_RISK |
device.customProperties.sec_impact_risk | SEC_IMPACT_RISK |
device.firstSeen | FIRST_SEEN |
device.id | UID |
device.ipAddress | IP_ADDRESSES |
device.itsmAssetId | ITSM_ASSET_ID |
device.itsmDeviceIdentifier | ITSM_DEVICE_IDENTIFIER |
device.lastSeen | LAST_SEEN |
device.macAddress | MAC_ADDRESSES |
device.manufacturer | MANUFACTURER |
device.model | MODEL |
device.name | NAME |
device.name | HOSTNAMES |
device.operatingSystem / device.operatingSystemVersion | OPERATING_SYSTEM |
device.riskLevel | RISK_LEVEL |
device.sensor.name | SENSOR |
device.site.name | SITE |
device.tags | TAGS |
device.type | DEVICE_TYPE |
device.user | USER |
now() | LAST_CAPTURED |
Cloud Resource
| Source Field Name | SDM Attribute |
|---|---|
device.category / device.type | CATEGORIES |
device.customProperties.sec_asset_risk | SEC_ASSET_RISK |
device.customProperties.sec_exposure_risk | SEC_EXPOSURE_RISK |
device.customProperties.sec_impact_risk | SEC_IMPACT_RISK |
device.firstSeen | FIRST_SEEN |
device.id | UID |
device.ipAddress | IP_ADDRESSES |
device.itsmAssetId | ITSM_ASSET_ID |
device.itsmDeviceIdentifier | ITSM_DEVICE_IDENTIFIER |
device.lastSeen | LAST_SEEN |
device.macAddress | MAC_ADDRESSES |
device.manufacturer | MANUFACTURER |
device.model | MODEL |
device.name | NAME |
device.name | HOSTNAMES |
device.operatingSystem / device.operatingSystemVersion | OPERATING_SYSTEM |
device.riskLevel | RISK_LEVEL |
device.sensor.name | SENSOR |
device.site.name | SITE |
device.tags | TAGS |
device.type | DEVICE_TYPE |
device.user | USER |
now() | LAST_CAPTURED |
Alert
| Source Field Name | SDM Attribute |
|---|---|
alert.activityIds | ACTIVITIES |
alert.alertId | UID |
alert.deviceIds | TARGETS |
alert.status | PROVIDER_STATUS |
alert.status | SOURCE_STATUS |
alert.status | STATUS |
alert.status | STATUS_CATEGORY |
alert.time | SOURCE_LAST_MODIFIED |
alert.title / alert.alertId | NAME |
now() | LAST_CAPTURED |
Alert Definition
| Source Field Name | SDM Attribute |
|---|---|
alert.severity | SOURCE_SEVERITY |
alert.title | NAME |
alert.type | CATEGORIES |
getFindingSeverityScore(severity) | SEVERITY_SCORE |
normalizeFindingSeverity(alert.severity) | SEVERITY |
now() | LAST_CAPTURED |
uid | UID |
Vulnerability
| Source Field Name | SDM Attribute |
|---|---|
now() | LAST_CAPTURED |
vulnerability.avmRating | AVM_RATING |
vulnerability.cveUid | TYPE |
vulnerability.cveUid + "_" + vulnerability.deviceId | UID |
vulnerability.deviceId | TARGETS |
vulnerability.matchSources | MATCH_SOURCES |
vulnerability.status | PROVIDER_STATUS |
vulnerability.status | SOURCE_STATUS |
vulnerability.status | STATUS |
vulnerability.status | STATUS_CATEGORY |
vulnerability.statusChangeReason | STATUS_CHANGE_REASON |
Vulnerability Definition
| Source Field Name | SDM Attribute |
|---|---|
now() | LAST_CAPTURED |
vulnerability.affectedDevicesCount | AFFECTED_DEVICE_COUNT |
vulnerability.attackComplexity | CVSS_V3_AC |
vulnerability.attackVector | CVSS_V3_AV |
vulnerability.availabilityImpact | CVSS_V3_AI |
vulnerability.botnets | BOTNETS |
vulnerability.cisaDueDate | CISA_DUE_DATE |
vulnerability.commonName | NAME |
vulnerability.confidentialityImpact | CVSS_V3_CI |
vulnerability.cveUid | UID |
vulnerability.cveUid | CVE_IDS |
vulnerability.cveUid | CVE_RECORDS |
vulnerability.cvssScore | CVSS_V3_BASE_SCORE |
vulnerability.description | SUMMARY |
vulnerability.epssPercentile | EPSS_PERCENTILE |
vulnerability.epssScore | EPSS_SCORE |
vulnerability.exploitabilityScore | EXPLOITABILITY_SCORE |
vulnerability.firstReferencePublishDate | FIRST_REF_PUBLISH_DATE |
vulnerability.firstWeaponizedReferencePublishDate | FIRST_WEAPONIZED_REF_PUBLISH_DATE |
vulnerability.hasRansomware | HAS_RANSOMWARE |
vulnerability.impactScore | IMPACT_SCORE |
vulnerability.integrityImpact | CVSS_V3_II |
vulnerability.isWeaponized | IS_WEAPONIZED |
vulnerability.latestExploitUpdate | LATEST_EXPLOIT_UPDATE |
vulnerability.numberOfThreatActors | NUM_OF_THREAT_ACTORS |
vulnerability.numOfExploits | NUM_OF_EXPLOITS |
vulnerability.orgPriority | ORG_PRIORITY |
vulnerability.privilegesRequired | CVSS_V3_PR |
vulnerability.publishedDate | PUBLISHED_DATE |
vulnerability.reportedByGoogleZeroDays | REPORTED_BY_GOOGLE_ZERO_DAYS |
vulnerability.scope | CVSS_V3_SCOPE |
vulnerability.score | SCORE |
vulnerability.severity | SEVERITY |
vulnerability.severity | SOURCE_SEVERITY |
vulnerability.severity | SEVERITY_SCORE |
vulnerability.threatTags | THREAT_TAGS |
vulnerability.userInteraction | CVSS_V3_UI |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Host
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeFrame.
API
- Type: REST (Armis Search API with an Armis Standard Query) · Endpoint:
GET /api/v1/search/ - Default filters:
in:devices visibility:"Full"plus atimeFrame:filter derived from thesincesync token (defaults to90 Days)
Cloud Resource
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeFrame.
API
- Type: REST (Armis Search API with an Armis Standard Query) · Endpoint:
GET /api/v1/search/ - Default filters:
in:devices visibility:"Full"plus atimeFrame:filter derived from thesincesync token (defaults to90 Days) - Query: Same as Host.
Alert
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeFrame.
API
- Type: REST (Armis Search API with an Armis Standard Query) · Endpoint:
GET /api/v1/search/ - Default filters:
in:alertsplus atimeFrame:filter derived from thesincesync token (defaults to90 Days)
Alert Definition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeFrame.
API
- Type: REST (Armis Search API with an Armis Standard Query) · Endpoint:
GET /api/v1/search/ - Default filters:
in:alertsplus atimeFrame:filter derived from thesincesync token (defaults to90 Days) - Query: Same as Alert.
Vulnerability
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
system_report_name | String | BRINQA_VULNERABILITY_SYSTEM_REPORT | Custom name for the Armis system report used for vulnerability data retrieval |
Delta sync
Not supported. The connector performs a full sync of Vulnerability on every run and applies no incremental date filter.
API
- Type: REST (multi-step Armis system-report workflow, not the Search API)
- Default filters: The report's query (ASQ) is fixed at creation time; delta sync (
since) and custom AQL filtering do not apply to this model
- System reports are generated daily after 12:00 am GMT; a newly created report is not available until the next generation window.
- Delta sync and custom AQL filtering are not supported for the system report API.
Vulnerability Definition
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeFrame.
API
- Type: REST (Armis Search API with an Armis Standard Query) · Endpoint:
GET /api/v1/search/ - Default filters:
in:vulnerabilitiesplus atimeFrame:filter derived from thesincesync token (defaults to90 Days)
Changelog
The Armis connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.7 | New Features - Risk-rating attributes from Armis custom properties — The Host and Cloud Resource models now import three optional risk-rating values — Security exposure risk, Security impact risk, and Security asset risk — from the Armis customProperties object on each device. Each attribute is populated only when the corresponding field is present in the API response. | N/A |
| 3.0.6 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Armis data is no longer overridden by lower-priority sources. - Refreshed the connector model library to the latest release and replaced the deprecated date deserializer with its supported replacement. Bug Fixes - Corrected the Alert model's "Activities" attribute element type from number to text. The attribute is multi-valued and is populated from the API's list of activity IDs, which are strings, so the element type is now text to match the values returned. | • Alert: the "Activities" attribute element type changed from number to text. Re-sync the Armis connector to repopulate alerts with the corrected type. |
| 3.0.5 | New Features - system_report_name operation option for Vulnerability model — Added a configurable operation option (system_report_name) to the Vulnerability model, allowing users to specify a custom Armis system report name for vulnerability data retrieval. Defaults to BRINQA_VULNERABILITY_SYSTEM_REPORT if not provided Improvements - Vulnerability system report name is now configurable via operation options, replacing the previously hardcoded value and enabling support for custom system report configuration - Added support for exposing the Last captured field (Last capture date) across data retrieval for all models | N/A |
| 3.0.4 | Improvements Dependency Upgrades - Upgraded internal framework and storage libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.3 | New Features - Added configurable host device type classification — users can now customize which Armis device types are classified as Host vs Cloud Resource using the host_device_types operation option, instead of relying on a hardcoded list, if operatin option is not deifne the default list will be used. - Added explicit field selection for device queries to ensure custom fields such as haloItsmAssetId and haloItsmDeviceIdentifier are included in API responses Improvements - Device type matching is now case-insensitive, reducing classification mismatches between Host and Cloud Resource models - Improved null safety when processing custom field values to prevent errors on incomplete data - Updated documentation with model relationship diagram and comprehensive operation options reference | N/A |
| 3.0.2 | New Features - Added ITSM asset ID and ITSM device identifier attributes to the Host and Cloud Resource models, populated from the corresponding Armis device custom fields so ITSM linkage information is now available alongside device data. Improvements - Added Servers to the set of Armis device types classified as Hosts, so server devices are now ingested as Host assets by default. | N/A |
| 3.0.1 | New Features - Added the Match sources, AVM rating, and Status change reason attributes to the Vulnerability model, surfacing additional context about how each vulnerability match was identified and its current rating and status. Improvements - Reworked vulnerability data retrieval to source vulnerabilities from a dedicated Armis system report rather than per-device match lookups, improving completeness and reliability of synchronized vulnerability data. - Significantly expanded the connector documentation with per-model field mappings, endpoints, delta sync behavior, operation options, and sample requests and responses. Bug Fixes - Removed the obsolete Confidence level and Match criteria attributes from the Vulnerability model, which were no longer populated by the updated data source. - Removed the unused Type attribute from the Alert model. | • Vulnerability: vulnerability data is now retrieved from an Armis system report and the Confidence level and Match criteria attributes have been removed while Match sources, AVM rating, and Status change reason were added. Re-sync the Armis connector to repopulate vulnerabilities from the new source and refresh the attribute set. |
| 3.0.0 | Overview The Armis connector integrates with the Armis asset intelligence platform to synchronize device inventory, security alerts, and vulnerability findings. Category: Asset Management Models | N/A |