Armis Centrix

Armis Centrix provides asset visibility and security for connected devices, enhancing threat detection and response.

Armis Centrix is a leading platform for device visibility and security, offering comprehensive insights into connected devices. This connector enables Swimlane Turbine users to automate device information retrieval and alert management, enhancing security operations. By integrating Armis Centrix with Swimlane Turbine, users can efficiently manage device tags, search alerts, and update alert statuses, streamlining security workflows and improving response times.

Prerequisites

Before you can use the Armis Centrix connector for Turbine, you'll need access to the Armis Centrix API. This requires the following:

Custom authentication using Secret Key with the following parameters:

URL: The endpoint URL for accessing the Armis Centrix API.

Secret API Key: A unique key provided by Armis Centrix for secure API access.

Capabilities

This Connector provides the following capabilities:

Get Device Info

Search Alerts

Tag Device

Untag Device

Update Alert Status

Notes

Search Alerts Action can search below entities with the help of AQL search string as below given example.

  {
    "aql": "in:devices name:(system)"
  }

  {
    "aql": "in:alerts alertId:(57)"
  }

alerts

devices

activity

application

businessApplications

connections

users

operatingSystems

riskFactors

vulnerabilities

For Swagger docs login here using your username and password.

Additional Documentation

Armis Centrix Connector Documentation

Armis Centrix API Documentation

Configurations

Armis Centrix Custom Authentication

Authenticates using Secret Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
secret_key	Secret API key.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Device Info

Retrieve device information using a unique identifier such as IP, MAC, Device ID, or Search. Provide exactly one of 'id', 'ip', 'mac', 'search', or 'tag' for accurate results.

Endpoint

URL: /api/v1/devices/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.id	number	Optional	The Armis device ID.
parameters.ip	string	Optional	The IPv4 or IPv6 Address of the device(s).
parameters.mac	string	Optional	The MAC Address of the device(s).
parameters.tag	string	Optional	The tag of the device(s).
parameters.search	string	Optional	The search string.
parameters.fields	string	Optional	Fields to show. If omitted, returns a default subset of fields.
parameters.from	number	Optional	Paging from.
parameters.length	number	Optional	Paging from.

Input Example

{"parameters":{"id":1,"ip":"8.8.8.8","mac":"","search":"in:devices","fields":"","from":0,"length":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.count	number	Response data
data.data	array	Response data
data.data.accessSwitch	object	Response data
data.data.boundaries	string	Response data
data.data.businessImpact	string	Response data
data.data.category	string	Response data
data.data.customProperties	object	Response data
data.data.dataSources	array	Response data
data.data.dataSources.file_name	string	Response data
data.data.dataSources.file	string	Response data
data.data.firstSeen	string	Response data
data.data.id	number	Response data
data.data.ipAddress	string	Response data
data.data.ipv6	object	Response data
data.data.lastSeen	string	Response data
data.data.macAddress	string	Response data
data.data.manufacturer	string	Response data
data.data.model	string	Response data
data.data.name	string	Response data
data.data.names	string	Response data
data.data.operatingSystem	object	Response data
data.data.operatingSystemVersion	object	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 29 Feb 2024 09:46:48 GMT","Content-Type":"application/json","Content-Length":"816","Connection":"keep-alive","Content-Encoding":"gzip","CF-Cache-Status":"DYNAMIC","Server":"cloudflare","CF-RAY":"85cffb7069d585d8-BOM","alt-svc":"h3=\":443\"; ma=86400"},"reason":"OK","json_body":{"data":{"count":2,"data":[],"next":2,"prev":null,"total":3231},"success":true}}

Search Alerts

Returns search results for a given AQL query in Armis Centrix.

Endpoint

URL: /api/v1/search/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.aql	string	Required	The AQL search string.
parameters.fields	string	Optional	Fields to show. If omitted, returns a default subset of fields.
parameters.from	number	Optional	Information about paging from.
parameters.length	number	Optional	Information about paging length.
parameters.includeTotal	boolean	Optional	If set to "false", the total count will not be calculated.
parameters.orderBy	string	Optional	Sort order for results, values separated by commas. Default direction is ASC.
parameters.tz	string	Optional	The time zone to run the query with.

Input Example

{"parameters":{"aql":"in:alerts","from":1,"length":15,"includeTotal":true,"orderBy":"ASC"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.count	number	Response data
data.next	number	Response data
data.prev	number	Response data
data.results	array	Response data
data.results.activityUUIDs	array	Response data
data.results.affectedDevicesCount	number	Response data
data.results.alertId	number	Response data
data.results.classification	string	Response data
data.results.connectionIds	array	Response data
data.results.connectionIds.file_name	string	Response data
data.results.connectionIds.file	string	Response data
data.results.description	string	Response data
data.results.deviceIds	array	Response data
data.results.policyId	object	Response data
data.results.policyLabels	object	Response data
data.results.policyTitle	object	Response data
data.results.severity	string	Response data
data.results.status	string	Response data
data.results.time	string	Response data
data.results.title	string	Response data
data.results.type	string	Response data
data.total	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 29 Feb 2024 09:01:52 GMT","Content-Type":"application/json","Content-Length":"802","Connection":"keep-alive","Content-Encoding":"gzip","CF-Cache-Status":"DYNAMIC","Server":"cloudflare","CF-RAY":"85cfb99e6d0185d8-BOM","alt-svc":"h3=\":443\"; ma=86400"},"reason":"OK","json_body":{"data":{"count":5,"next":6,"prev":0,"results":[],"total":"Many"},"success":true}}

Tag Device

Add specified tags to a device in Armis Centrix using the device ID and tag details.

Endpoint

URL: /api/v1/devices/{{device_id}}/tags/

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.device_id	number	Required	Parameters for the Tag Device action
tags	array	Optional	Parameter for Tag Device

Input Example

{"json_body":{"tags":["foo","bar"]},"path_parameters":{"device_id":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 29 Feb 2024 09:57:38 GMT","Content-Type":"application/json","Content-Length":"17","Connection":"keep-alive","CF-Cache-Status":"DYNAMIC","Server":"cloudflare","CF-RAY":"85d00b4acd8d85d8-BOM","alt-svc":"h3=\":443\"; ma=86400"},"reason":"OK","json_body":{"success":true}}

Untag Device

Remove specified tags from a device in Armis Centrix using the device ID and tag details.

Endpoint

URL: /api/v1/devices/{{device_id}}/tags/

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.device_id	number	Required	Parameters for the Untag Device action
tags	array	Optional	Parameter for Untag Device

Input Example

{"json_body":{"tags":["foo"]},"path_parameters":{"device_id":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 29 Feb 2024 10:03:08 GMT","Content-Type":"application/json","Content-Length":"17","Connection":"keep-alive","CF-Cache-Status":"DYNAMIC","Server":"cloudflare","CF-RAY":"85d013608aec85d8-BOM","alt-svc":"h3=\":443\"; ma=86400"},"reason":"OK","json_body":{"success":true}}

Update Alert Status

Update the status of an alert in Armis Centrix using the specified alert ID, path parameters, data body, and headers.

Endpoint

URL: /api/v1/alerts/{{alert_id}}/

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	number	Optional	Parameters for the Update Alert Status action
headers	object	Required	HTTP headers for the request
headers.content-type	string	Optional	HTTP headers for the request
data_body	object	Required	Response data
data_body.status	string	Optional	The status of the designated alert.

Input Example

{"path_parameters":{"alert_id":57},"headers":{"content-type":"application/x-www-form-urlencoded"},"data_body":{"status":"SUPPRESSED"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 29 Feb 2024 09:30:03 GMT","Content-Type":"application/json","Content-Length":"17","Connection":"keep-alive","CF-Cache-Status":"DYNAMIC","Server":"cloudflare","CF-RAY":"85cfe2dee83c85d8-BOM","alt-svc":"h3=\":443\"; ma=86400"},"reason":"OK","json_body":{"success":true}}

Response Headers

Header	Description	Example
alt-svc	HTTP response header: alt-svc	h3=":443"; ma=86400
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	85d00b4acd8d85d8-BOM
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	802
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 29 Feb 2024 09:57:38 GMT
Server	Information about the software used by the origin server	cloudflare