Armis Intelligence Center
This Connector is a Data Enrichment & Threat Intelligence Product that provides the ability to enrich details on CVE's, Threats and Devices Information.
Asset Setup
The Connector can be authenticated as shown below:
- API Key Authentication, which requires an URL, and an API Key as input parameters.
Capabilities
This Connector provides the following capabilities:
- Search CVE
- Search Device
- Search Threat
Notes
For more information on Armis Security is found at:
API Documentation Link
Configurations
Armis Intelligence Center API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
x-api-key | API key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
search_cve
Searches CVE
Endpoint
- URL: /api/v1/cve/_search
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.from | number | Optional | Parameters for the search_cve action |
parameters.length | number | Optional | Parameters for the search_cve action |
parameters.groupBy | array | Optional | Parameters for the search_cve action |
parameters.calculate | array | Optional | Parameters for the search_cve action |
parameters.orderBy | array | Optional | Parameters for the search_cve action |
parameters.timestamp | array | Optional | Parameters for the search_cve action |
parameters.timestamp[lt] | array | Optional | Parameters for the search_cve action |
parameters.timestamp[le] | array | Optional | Parameters for the search_cve action |
parameters.timestamp[ge] | array | Optional | Parameters for the search_cve action |
parameters.timestamp[gt] | array | Optional | Parameters for the search_cve action |
parameters.timestamp[eq] | array | Optional | Parameters for the search_cve action |
parameters.id | array | Optional | Parameters for the search_cve action |
parameters.id[like] | array | Optional | Parameters for the search_cve action |
parameters.id[nlike] | array | Optional | Parameters for the search_cve action |
parameters.id[eq] | array | Optional | Parameters for the search_cve action |
parameters.id[ne] | array | Optional | Parameters for the search_cve action |
parameters.description | array | Optional | Parameters for the search_cve action |
parameters.description[like] | array | Optional | Parameters for the search_cve action |
parameters.description[nlike] | array | Optional | Parameters for the search_cve action |
parameters.description[eq] | array | Optional | Parameters for the search_cve action |
parameters.description[ne] | array | Optional | Parameters for the search_cve action |
parameters.severity | array | Optional | Parameters for the search_cve action |
parameters.severity[lt] | array | Optional | Parameters for the search_cve action |
parameters.severity[le] | array | Optional | Parameters for the search_cve action |
parameters.severity[ge] | array | Optional | Parameters for the search_cve action |
Input Example
{"parameters":{"from":0,"length":10,"groupBy":["timestamp","score"],"calculate":["affectedDevices","bucket"],"orderBy":["timestamp","score"],"timestamp":["2022-11-01","2021-10-01"],"timestamp[lt]":["2022-11-01","2021-10-01"],"timestamp[le]":["2022-11-01","2021-10-01"],"timestamp[ge]":["2022-11-01","2021-10-01"],"timestamp[gt]":["2022-11-01","2021-10-01"],"timestamp[eq]":["2022-11-01","2021-10-01"],"id":["CVE-2020-1599"],"id[like]":["CVE-2020-1599"],"id[nlike]":["CVE-2020-1599"],"id[eq]":["CVE-2020-1599"],"id[ne]":["CVE-2020-1599"],"description":["Windows Spoofing Vulnerability"],"description[like]":["Windows Spoofing Vulnerability"],"description[nlike]":["Windows Spoofing Vulnerability"],"description[eq]":["Windows Spoofing Vulnerability"],"description[ne]":["Windows Spoofing Vulnerability"],"severity":["MEDIUM","HIGH"],"severity[lt]":["MEDIUM","HIGH"],"severity[le]":["MEDIUM","HIGH"],"severity[ge]":["MEDIUM","HIGH"],"severity[gt]":["MEDIUM","HIGH"],"severity[ne]":["MEDIUM","HIGH"],"severity[eq]":["MEDIUM","HIGH"],"score":[5.5,7.5],"score[lt]":[5.5,7.5],"score[le]":[5.5,7.5],"score[ge]":[5.5,7.5],"score[gt]":[5.5,7.5],"score[ne]":[5.5,7.5],"score[eq]":[5.5,7.5],"published":["2022-11-01","2020-11-11"],"published[lt]":["2022-11-01","2020-11-11"],"published[le]":["2022-11-01","2020-11-11"],"published[ge]":["2022-11-01","2020-11-11"],"published[gt]":["2022-11-01","2020-11-11"],"published[eq]":["2022-11-01","2020-11-11"],"matchStatus":["OPEN","IGNORED"],"matchStatus[ne]":["OPEN","IGNORED"],"matchStatus[eq]":["OPEN","IGNORED"],"weaponized":[true,false],"weaponized[eq]":[true,false],"hasRansomware":[true,false],"hasRansomware[eq]":[true,false],"reportedByGoogleZeroDays":[true,false],"reportedByGoogleZeroDays[eq]":[true,false],"cisaDueDate":["2022-11-01","2020-11-11"],"cisaDueDate[lt]":["2022-11-01","2020-11-11"],"cisaDueDate[le]":["2022-11-01","2020-11-11"],"cisaDueDate[ge]":["2022-11-01","2020-11-11"],"cisaDueDate[gt]":["2022-11-01","2020-11-11"],"cisaDueDate[eq]":["2022-11-01","2020-11-11"],"numberOfReferences":[3,4],"numberOfReferences[lt]":[3,4],"numberOfReferences[le]":[3,4],"numberOfReferences[ge]":[3,4],"numberOfReferences[gt]":[3,4],"numberOfReferences[ne]":[3,4],"numberOfReferences[eq]":[3,4],"numberOfThreatActors":[3,4],"numberOfThreatActors[lt]":[3,4],"numberOfThreatActors[le]":[3,4],"numberOfThreatActors[ge]":[3,4],"numberOfThreatActors[gt]":[3,4],"numberOfThreatActors[ne]":[3,4],"numberOfThreatActors[eq]":[3,4],"device.industry":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"device.industry[ne]":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"device.industry[eq]":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"device.group":["IT","OT"],"device.group[ne]":["IT","OT"],"device.group[eq]":["IT","OT"],"device.category":["Computers","Displays"],"device.category[ne]":["Computers","Displays"],"device.category[eq]":["Computers","Displays"],"device.type":["Personal Computers","Alarms"],"device.type[ne]":["Personal Computers","Alarms"],"device.type[eq]":["Personal Computers","Alarms"],"device.brand":["Apple"],"device.brand[like]":["Apple"],"device.brand[nlike]":["Apple"],"device.brand[eq]":["Apple"],"device.brand[ne]":["Apple"],"device.model":["MacBook Pro (15-inch, 2019)"],"device.model[like]":["MacBook Pro (15-inch, 2019)"],"device.model[nlike]":["MacBook Pro (15-inch, 2019)"],"device.model[eq]":["MacBook Pro (15-inch, 2019)"],"device.model[ne]":["MacBook Pro (15-inch, 2019)"],"device.osName":["macOS"],"device.osName[like]":["macOS"],"device.osName[nlike]":["macOS"],"device.osName[eq]":["macOS"],"device.osName[ne]":["macOS"],"device.osVersion":["11.6.4"],"device.osVersion[like]":["11.6.4"],"device.osVersion[nlike]":["11.6.4"],"device.osVersion[eq]":["11.6.4"],"device.osVersion[ne]":["11.6.4"],"device.osTitle":["macOS 11"],"device.osTitle[like]":["macOS 11"],"device.osTitle[nlike]":["macOS 11"],"device.osTitle[eq]":["macOS 11"],"device.osTitle[ne]":["macOS 11"],"threat.type":["Tor Access","Suspicious Host"],"threat.type[ne]":["Tor Access","Suspicious Host"],"threat.type[eq]":["Tor Access","Suspicious Host"],"threat.host":["61.3.74.12"],"threat.host[like]":["61.3.74.12"],"threat.host[nlike]":["61.3.74.12"],"threat.host[eq]":["61.3.74.12"],"threat.host[ne]":["61.3.74.12"],"threat.direction":["Inbound","Outbound"],"threat.direction[ne]":["Inbound","Outbound"],"threat.direction[eq]":["Inbound","Outbound"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | object | Output field: items |
items.timestamp | string | Output field: items.timestamp |
items.id | string | Unique identifier |
items.description | string | Output field: items.description |
items.severity | string | Output field: items.severity |
items.score | number | Score value |
items.published | string | Output field: items.published |
items.matchStatus | string | Status value |
items.weaponized | boolean | Output field: items.weaponized |
items.hasRansomware | boolean | Output field: items.hasRansomware |
items.reportedByGoogleZeroDays | boolean | Output field: items.reportedByGoogleZeroDays |
items.cisaDueDate | string | Date value |
items.numberOfReferences | number | Output field: items.numberOfReferences |
items.numberOfThreatActors | number | Output field: items.numberOfThreatActors |
items.device.industry | string | Output field: items.device.industry |
items.device.group | string | Output field: items.device.group |
items.device.category | string | Output field: items.device.category |
items.device.type | string | Type of the resource |
items.device.brand | string | Output field: items.device.brand |
items.device.model | string | Output field: items.device.model |
items.device.osName | string | Name of the resource |
items.device.osVersion | string | Output field: items.device.osVersion |
items.device.osTitle | string | Output field: items.device.osTitle |
Output Example
{"status_code":200,"reason":"OK","json_body":{"items":{"timestamp":"2022-11-01","id":"CVE-2020-1599","description":"CVE","severity":"CRITICAL","score":5.5,"published":"2022-11-01","matchStatus":"DISMISS","weaponized":true,"hasRansomware":true,"reportedByGoogleZeroDays":true,"cisaDueDate":"2022-11-01","numberOfReferences":10,"numberOfThreatActors":10,"device.industry":"Forestry","device.group":"IoMT"},"count":100,"total":200,"next":10,"prev":10}}
search_device
Search Device
Endpoint
- URL: /api/v1/device/_search
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.from | number | Optional | Parameters for the search_device action |
parameters.length | number | Optional | Parameters for the search_device action |
parameters.groupBy | array | Optional | Parameters for the search_device action |
parameters.calculate | array | Optional | Parameters for the search_device action |
parameters.orderBy | array | Optional | Parameters for the search_device action |
parameters.timestamp | array | Optional | Parameters for the search_device action |
parameters.timestamp[lt] | array | Optional | Parameters for the search_device action |
parameters.timestamp[le] | array | Optional | Parameters for the search_device action |
parameters.timestamp[ge] | array | Optional | Parameters for the search_device action |
parameters.timestamp[gt] | array | Optional | Parameters for the search_device action |
parameters.timestamp[eq] | array | Optional | Parameters for the search_device action |
parameters.industry | array | Optional | Parameters for the search_device action |
parameters.industry[ne] | array | Optional | Parameters for the search_device action |
parameters.industry[eq] | array | Optional | Parameters for the search_device action |
parameters.group | array | Optional | Parameters for the search_device action |
parameters.group[ne] | array | Optional | Parameters for the search_device action |
parameters.group[eq] | array | Optional | Parameters for the search_device action |
parameters.category | array | Optional | Parameters for the search_device action |
parameters.category[ne] | array | Optional | Parameters for the search_device action |
parameters.category[eq] | array | Optional | Parameters for the search_device action |
parameters.type | array | Optional | Parameters for the search_device action |
parameters.type[ne] | array | Optional | Parameters for the search_device action |
parameters.type[eq] | array | Optional | Parameters for the search_device action |
parameters.brand | array | Optional | Parameters for the search_device action |
parameters.brand[like] | array | Optional | Parameters for the search_device action |
Input Example
{"parameters":{"from":0,"length":10,"groupBy":["timestamp","industry"],"calculate":["share","bucket"],"orderBy":["timestamp","industry"],"timestamp":["2022-11-01","2020-10-10"],"timestamp[lt]":["2022-11-01","2020-10-10"],"timestamp[le]":["2022-11-01","2020-10-10"],"timestamp[ge]":["2022-11-01","2020-10-10"],"timestamp[gt]":["2022-11-01","2020-10-10"],"timestamp[eq]":["2022-11-01","2020-10-10"],"industry":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"industry[ne]":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"industry[eq]":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"group":["IT","OT"],"group[ne]":["IT","OT"],"group[eq]":["IT","OT"],"category":["Computers","Displays"],"category[ne]":["Computers","Displays"],"category[eq]":["Computers","Displays"],"type":["Personal Computers","Alarms"],"type[ne]":["Personal Computers","Alarms"],"type[eq]":["Personal Computers","Alarms"],"brand":["Apple"],"brand[like]":["Apple"],"brand[nlike]":["Apple"],"brand[eq]":["Apple"],"brand[ne]":["Apple"],"model":["MacBook Pro (15-inch, 2019)"],"model[like]":["MacBook Pro (15-inch, 2019)"],"model[nlike]":["MacBook Pro (15-inch, 2019)"],"model[eq]":["MacBook Pro (15-inch, 2019)"],"model[ne]":["MacBook Pro (15-inch, 2019)"],"osName":["macOS"],"osName[like]":["macOS"],"osName[nlike]":["macOS"],"osName[eq]":["macOS"],"osName[ne]":["macOS"],"osVersion":["11.6.4"],"osVersion[like]":["11.6.4"],"osVersion[nlike]":["11.6.4"],"osVersion[eq]":["11.6.4"],"osVersion[ne]":["11.6.4"],"osTitle":["macOS 11"],"osTitle[like]":["macOS 11"],"osTitle[nlike]":["macOS 11"],"osTitle[eq]":["macOS 11"],"osTitle[ne]":["macOS 11"],"cve.id":["CVE-2020-1599"],"cve.id[like]":["CVE-2020-1599"],"cve.id[nlike]":["CVE-2020-1599"],"cve.id[eq]":["CVE-2020-1599"],"cve.id[ne]":["CVE-2020-1599"],"cve.description":["Windows Spoofing Vulnerability"],"cve.description[like]":["Windows Spoofing Vulnerability"],"cve.description[nlike]":["Windows Spoofing Vulnerability"],"cve.description[eq]":["Windows Spoofing Vulnerability"],"cve.description[ne]":["Windows Spoofing Vulnerability"],"cve.severity":["MEDIUM","HIGH"],"cve.severity[lt]":["MEDIUM","HIGH"],"cve.severity[le]":["MEDIUM","HIGH"],"cve.severity[ge]":["MEDIUM","HIGH"],"cve.severity[gt]":["MEDIUM","HIGH"],"cve.severity[ne]":["MEDIUM","HIGH"],"cve.severity[eq]":["MEDIUM","HIGH"],"cve.score":[5.5,7.5],"cve.score[lt]":[5.5,7.5],"cve.score[le]":[5.5,7.5],"cve.score[ge]":[5.5,7.5],"cve.score[gt]":[5.5,7.5],"cve.score[ne]":[5.5,7.5],"cve.score[eq]":[5.5,7.5],"cve.published":["2020-11-11","2020-10-10"],"cve.published[lt]":["2020-11-11","2020-10-10"],"cve.published[le]":["2020-11-11","2020-10-10"],"cve.published[ge]":["2020-11-11","2020-10-10"],"cve.published[gt]":["2020-11-11","2020-10-10"],"cve.published[eq]":["2020-11-11","2020-10-10"],"cve.matchStatus":["OPEN","IGNORED"],"cve.matchStatus[ne]":["OPEN","IGNORED"],"cve.matchStatus[eq]":["OPEN","IGNORED"],"cve.weaponized":[true,false],"cve.weaponized[eq]":[true,false],"cve.hasRansomware":[true,false],"cve.hasRansomware[eq]":[true,false],"cve.reportedByGoogleZeroDays":[true,false],"cve.reportedByGoogleZeroDays[eq]":[true,false],"cve.cisaDueDate":["2020-11-11","2020-10-10"],"cve.cisaDueDate[lt]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[le]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[ge]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[gt]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[eq]":["2020-11-11","2020-10-10"],"cve.numberOfReferences":[3,5],"cve.numberOfReferences[lt]":[3,5],"cve.numberOfReferences[le]":[3,5],"cve.numberOfReferences[ge]":[3,5],"cve.numberOfReferences[gt]":[3,5],"cve.numberOfReferences[ne]":[3,5],"cve.numberOfReferences[eq]":[3,5],"cve.numberOfThreatActors":[3,5],"cve.numberOfThreatActors[lt]":[3,5],"cve.numberOfThreatActors[le]":[3,5],"cve.numberOfThreatActors[ge]":[3,5],"cve.numberOfThreatActors[gt]":[3,5],"cve.numberOfThreatActors[ne]":[3,5],"cve.numberOfThreatActors[eq]":[3,5],"threat.type":["Tor Access","Suspicious Host"],"threat.type[ne]":["Tor Access","Suspicious Host"],"threat.type[eq]":["Tor Access","Suspicious Host"],"threat.host":["61.3.74.12"],"threat.host[like]":["61.3.74.12"],"threat.host[nlike]":["61.3.74.12"],"threat.host[eq]":["61.3.74.12"],"threat.host[ne]":["61.3.74.12"],"threat.direction":["Inbound","Outbound"],"threat.direction[ne]":["Inbound","Outbound"],"threat.direction[eq]":["Inbound","Outbound"],"threat.cve.id":["CVE-2020-1599"],"threat.cve.id[like]":["CVE-2020-1599"],"threat.cve.id[nlike]":["CVE-2020-1599"],"threat.cve.id[eq]":["CVE-2020-1599"],"threat.cve.id[ne]":["CVE-2020-1599"],"threat.cve.description":["Windows Spoofing Vulnerability"],"threat.cve.description[like]":["Windows Spoofing Vulnerability"],"threat.cve.description[nlike]":["Windows Spoofing Vulnerability"],"threat.cve.description[eq]":["Windows Spoofing Vulnerability"],"threat.cve.description[ne]":["Windows Spoofing Vulnerability"],"threat.cve.severity":["MEDIUM","HIGH"],"threat.cve.severity[lt]":["MEDIUM","HIGH"],"threat.cve.severity[le]":["MEDIUM","HIGH"],"threat.cve.severity[ge]":["MEDIUM","HIGH"],"threat.cve.severity[gt]":["MEDIUM","HIGH"],"threat.cve.severity[ne]":["MEDIUM","HIGH"],"threat.cve.severity[eq]":["MEDIUM","HIGH"],"threat.cve.score":[5.5,7.5],"threat.cve.score[lt]":[5.5,7.5],"threat.cve.score[le]":[5.5,7.5],"threat.cve.score[ge]":[5.5,7.5],"threat.cve.score[gt]":[5.5,7.5],"threat.cve.score[ne]":[5.5,7.5],"threat.cve.score[eq]":[5.5,7.5],"threat.cve.published":["2020-11-11","2020-10-10"],"threat.cve.published[lt]":["2020-11-11","2020-10-10"],"threat.cve.published[le]":["2020-11-11","2020-10-10"],"threat.cve.published[ge]":["2020-11-11","2020-10-10"],"threat.cve.published[gt]":["2020-11-11","2020-10-10"],"threat.cve.published[eq]":["2020-11-11","2020-10-10"],"threat.cve.matchStatus":["OPEN","IGNORED"],"threat.cve.matchStatus[ne]":["OPEN","IGNORED"],"threat.cve.matchStatus[eq]":["OPEN","IGNORED"],"threat.cve.weaponized":[true,false],"threat.cve.weaponized[eq]":[true,false],"threat.cve.hasRansomware":[true,false],"threat.cve.hasRansomware[eq]":[true,false],"threat.cve.reportedByGoogleZeroDays":[true,false],"threat.cve.reportedByGoogleZeroDays[eq]":[true,false],"threat.cve.cisaDueDate":["2020-11-11","2020-10-10"],"threat.cve.cisaDueDate[lt]":["2020-11-11","2020-10-10"],"threat.cve.cisaDueDate[le]":["2020-11-11","2020-10-10"],"threat.cve.cisaDueDate[ge]":["2020-11-11","2020-10-10"],"threat.cve.cisaDueDate[gt]":["2020-11-11","2020-10-10"],"threat.cve.cisaDueDate[eq]":["2020-11-11","2020-10-10"],"threat.cve.numberOfReferences":[3,5],"threat.cve.numberOfReferences[lt]":[3,5],"threat.cve.numberOfReferences[le]":[3,5],"threat.cve.numberOfReferences[ge]":[3,5],"threat.cve.numberOfReferences[gt]":[3,5],"threat.cve.numberOfReferences[ne]":[3,5],"threat.cve.numberOfReferences[eq]":[3,5],"threat.cve.numberOfThreatActors":[3,5],"threat.cve.numberOfThreatActors[lt]":[3,5],"threat.cve.numberOfThreatActors[le]":[3,5],"threat.cve.numberOfThreatActors[ge]":[3,5],"threat.cve.numberOfThreatActors[gt]":[3,5],"threat.cve.numberOfThreatActors[ne]":[3,5],"threat.cve.numberOfThreatActors[eq]":[3,5]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | object | Output field: items |
items.timestamp | string | Output field: items.timestamp |
items.industry | string | Output field: items.industry |
items.group | string | Output field: items.group |
items.category | string | Output field: items.category |
items.type | string | Type of the resource |
items.brand | string | Output field: items.brand |
items.model | string | Output field: items.model |
items.osName | string | Name of the resource |
items.osVersion | string | Output field: items.osVersion |
items.osTitle | string | Output field: items.osTitle |
items.share | number | Output field: items.share |
items.avgRisk | number | Output field: items.avgRisk |
items.bucket | number | Output field: items.bucket |
count | number | Count value |
Output Example
{"status_code":200,"reason":"OK","json_body":{"items":{"timestamp":"2022-11-01","industry":"Accommodation and Food Services","group":"IoT","category":"Automotives","type":"ATMs","brand":"a.k.a manufacturer","model":"MacBook Pro (15-inch, 2019)","osName":"macOs","osVersion":"11.6.4","osTitle":"macOS 11","share":10,"avgRisk":20,"bucket":10},"count":100}}
search_threat
Search Threat
Endpoint
- URL: /api/v1/threat/_search
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.from | number | Optional | Parameters for the search_threat action |
parameters.length | number | Optional | Parameters for the search_threat action |
parameters.groupBy | array | Optional | Parameters for the search_threat action |
parameters.calculate | array | Optional | Parameters for the search_threat action |
parameters.orderBy | array | Optional | Parameters for the search_threat action |
parameters.timestamp | array | Optional | Parameters for the search_threat action |
parameters.timestamp[lt] | array | Optional | Parameters for the search_threat action |
parameters.timestamp[le] | array | Optional | Parameters for the search_threat action |
parameters.timestamp[ge] | array | Optional | Parameters for the search_threat action |
parameters.timestamp[gt] | array | Optional | Parameters for the search_threat action |
parameters.timestamp[eq] | array | Optional | Parameters for the search_threat action |
parameters.type | array | Optional | Parameters for the search_threat action |
parameters.type[ne] | array | Optional | Parameters for the search_threat action |
parameters.type[eq] | array | Optional | Parameters for the search_threat action |
parameters.host | array | Optional | Parameters for the search_threat action |
parameters.host[like] | array | Optional | Parameters for the search_threat action |
parameters.host[nlike] | array | Optional | Parameters for the search_threat action |
parameters.host[eq] | array | Optional | Parameters for the search_threat action |
parameters.host[ne] | array | Optional | Parameters for the search_threat action |
parameters.direction | array | Optional | Parameters for the search_threat action |
parameters.direction[ne] | array | Optional | Parameters for the search_threat action |
parameters.direction[eq] | array | Optional | Parameters for the search_threat action |
parameters.cve.id | array | Optional | Parameters for the search_threat action |
parameters.cve.id[like] | array | Optional | Parameters for the search_threat action |
parameters.cve.id[nlike] | array | Optional | Parameters for the search_threat action |
Input Example
{"parameters":{"from":0,"length":10,"groupBy":["timestamp","industry"],"calculate":["share","bucket"],"orderBy":["timestamp","industry"],"timestamp":["2022-11-01","2020-10-10"],"timestamp[lt]":["2022-11-01","2020-10-10"],"timestamp[le]":["2022-11-01","2020-10-10"],"timestamp[ge]":["2022-11-01","2020-10-10"],"timestamp[gt]":["2022-11-01","2020-10-10"],"timestamp[eq]":["2022-11-01","2020-10-10"],"type":["Personal Computers","Alarms"],"type[ne]":["Personal Computers","Alarms"],"type[eq]":["Personal Computers","Alarms"],"host":["61.3.74.12"],"host[like]":["61.3.74.12"],"host[nlike]":["61.3.74.12"],"host[eq]":["61.3.74.12"],"host[ne]":["61.3.74.12"],"direction":["Inbound","Outbound"],"direction[ne]":["Inbound","Outbound"],"direction[eq]":["Inbound","Outbound"],"cve.id":["CVE-2020-1599"],"cve.id[like]":["CVE-2020-1599"],"cve.id[nlike]":["CVE-2020-1599"],"cve.id[eq]":["CVE-2020-1599"],"cve.id[ne]":["CVE-2020-1599"],"cve.description":["Windows Spoofing Vulnerability"],"cve.description[like]":["Windows Spoofing Vulnerability"],"cve.description[nlike]":["Windows Spoofing Vulnerability"],"cve.description[eq]":["Windows Spoofing Vulnerability"],"cve.description[ne]":["Windows Spoofing Vulnerability"],"cve.severity":["MEDIUM","HIGH"],"cve.severity[lt]":["MEDIUM","HIGH"],"cve.severity[le]":["MEDIUM","HIGH"],"cve.severity[ge]":["MEDIUM","HIGH"],"cve.severity[gt]":["MEDIUM","HIGH"],"cve.severity[ne]":["MEDIUM","HIGH"],"cve.severity[eq]":["MEDIUM","HIGH"],"cve.score":[5.5,7.5],"cve.score[lt]":[5.5,7.5],"cve.score[le]":[5.5,7.5],"cve.score[ge]":[5.5,7.5],"cve.score[gt]":[5.5,7.5],"cve.score[ne]":[5.5,7.5],"cve.score[eq]":[5.5,7.5],"cve.published":["2020-11-11","2020-10-10"],"cve.published[lt]":["2020-11-11","2020-10-10"],"cve.published[le]":["2020-11-11","2020-10-10"],"cve.published[ge]":["2020-11-11","2020-10-10"],"cve.published[gt]":["2020-11-11","2020-10-10"],"cve.published[eq]":["2020-11-11","2020-10-10"],"cve.matchStatus":["OPEN","IGNORED"],"cve.matchStatus[ne]":["OPEN","IGNORED"],"cve.matchStatus[eq]":["OPEN","IGNORED"],"cve.weaponized":[true,false],"cve.weaponized[eq]":[true,false],"cve.hasRansomware":[true,false],"cve.hasRansomware[eq]":[true,false],"cve.reportedByGoogleZeroDays":[true,false],"cve.reportedByGoogleZeroDays[eq]":[true,false],"cve.cisaDueDate":["2020-11-11","2020-10-10"],"cve.cisaDueDate[lt]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[le]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[ge]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[gt]":["2020-11-11","2020-10-10"],"cve.cisaDueDate[eq]":["2020-11-11","2020-10-10"],"cve.numberOfReferences":[3,5],"cve.numberOfReferences[lt]":[3,5],"cve.numberOfReferences[le]":[3,5],"cve.numberOfReferences[ge]":[3,5],"cve.numberOfReferences[gt]":[3,5],"cve.numberOfReferences[ne]":[3,5],"cve.numberOfReferences[eq]":[3,5],"cve.numberOfThreatActors":[3,5],"cve.numberOfThreatActors[lt]":[3,5],"cve.numberOfThreatActors[le]":[3,5],"cve.numberOfThreatActors[ge]":[3,5],"cve.numberOfThreatActors[gt]":[3,5],"cve.numberOfThreatActors[ne]":[3,5],"cve.numberOfThreatActors[eq]":[3,5],"device.industry":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"device.industry[ne]":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"device.industry[eq]":["Accommodation and Food Services","Arts, Entertainment, and Recreation"],"device.group":["IT","OT"],"device.group[ne]":["IT","OT"],"device.group[eq]":["IT","OT"],"device.category":["Computers","Displays"],"device.category[ne]":["Computers","Displays"],"device.category[eq]":["Computers","Displays"],"device.type":["Personal Computers","Alarms"],"device.type[ne]":["Personal Computers","Alarms"],"device.type[eq]":["Personal Computers","Alarms"],"device.brand":["Apple"],"device.brand[like]":["Apple"],"device.brand[nlike]":["Apple"],"device.brand[eq]":["Apple"],"device.brand[ne]":["Apple"],"device.model":["MacBook Pro (15-inch, 2019)"],"device.model[like]":["MacBook Pro (15-inch, 2019)"],"device.model[nlike]":["MacBook Pro (15-inch, 2019)"],"device.model[eq]":["MacBook Pro (15-inch, 2019)"],"device.model[ne]":["MacBook Pro (15-inch, 2019)"],"device.osName":["macOS"],"device.osName[like]":["macOS"],"device.osName[nlike]":["macOS"],"device.osName[eq]":["macOS"],"device.osName[ne]":["macOS"],"device.osVersion":["11.6.4"],"device.osVersion[like]":["11.6.4"],"device.osVersion[nlike]":["11.6.4"],"device.osVersion[eq]":["11.6.4"],"device.osVersion[ne]":["11.6.4"],"device.osTitle":["macOS 11"],"device.osTitle[like]":["macOS 11"],"device.osTitle[nlike]":["macOS 11"],"device.osTitle[eq]":["macOS 11"],"device.osTitle[ne]":["macOS 11"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | object | Output field: items |
items.timestamp | string | Output field: items.timestamp |
items.type | string | Type of the resource |
items.host | string | Output field: items.host |
items.direction | string | Output field: items.direction |
items.cve.id | array | Unique identifier |
items.cve.description | string | Output field: items.cve.description |
items.cve.severity | string | Output field: items.cve.severity |
items.cve.score | number | Score value |
items.cve.published | string | Output field: items.cve.published |
items.cve.matchStatus | string | Status value |
items.cve.weaponized | boolean | Output field: items.cve.weaponized |
items.cve.hasRansomware | boolean | Output field: items.cve.hasRansomware |
items.cve.reportedByGoogleZeroDays | boolean | Output field: items.cve.reportedByGoogleZeroDays |
items.cve.cisaDueDate | string | Date value |
items.cve.numberOfReferences | number | Output field: items.cve.numberOfReferences |
items.cve.numberOfThreatActors | number | Output field: items.cve.numberOfThreatActors |
items.device.industry | string | Output field: items.device.industry |
items.device.group | string | Output field: items.device.group |
items.device.category | string | Output field: items.device.category |
items.device.type | string | Type of the resource |
items.device.brand | string | Output field: items.device.brand |
items.device.model | string | Output field: items.device.model |
Output Example
{"status_code":200,"reason":"OK","json_body":{"items":{"timestamp":"2022-11-01","type":"Malware Communication","host":"https://docs.ic.armis.com/","direction":"Inbound","cve.id":[],"cve.description":"CVE","cve.severity":"CRITICAL","cve.score":5.5,"cve.published":"2022-11-01","cve.matchStatus":"DISMISS","cve.weaponized":true,"cve.hasRansomware":true,"cve.reportedByGoogleZeroDays":true,"cve.cisaDueDate":"2022-11-01","cve.numberOfReferences":5},"count":100,"total":200,"next":10,"prev":10}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |