Armis


Version	0.10.1 Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. (View all)
Managed integration release status	GA
Subscription level What's this?	Basic
Developed by What's this?	Elastic
Ingestion method(s)	API
Minimum Kibana version(s)	9.0.0 8.18.0

Important - Managed integrations on Elastic Cloud Hosted

You can use this integration as an Elastic Managed integration on Elastic Cloud Hosted deployments running this version or later.

The Armis integration v0.10.1 is in technical preview

To use pre-release integrations, go to the Integrations page in Kibana, scroll down, and toggle on the Display beta integrations option.

Overview

Armis is an enterprise-class security platform designed to provide visibility and protection for managed, unmanaged, and IoT devices. It enables organizations to detect threats, manage vulnerabilities, and enforce security policies across their network.

Use this integration to collect and parse data from your Armis instance.

Compatibility

This module has been tested against the Armis API version v1. Armis documents v1 as a supported API. v3 does not replace the device, alert, and vulnerability search calls this integration uses.

How it works

The Elastic Agent uses the CEL input to poll the Armis API v1. Each data stream authenticates with POST /api/v1/access_token/ using the secret key, then sends the access token in the Authorization header.

Devices call GET /api/v1/search/ with in:devices, ordered by lastSeen. The next poll starts from the latest lastSeen value.
Alerts call GET /api/v1/search/ with in:alerts and a statusChangeTime window.
Vulnerabilities call GET /api/v1/search/ with in:vulnerabilities and a lastDetected window, then GET /api/v1/vulnerability-match/ for the devices where those vulnerabilities were detected.

Search requests follow data.next until the page is exhausted. Ingest pipelines map the response to ECS and keep the Armis fields under armis.*. The alert and device data streams also install a latest transform so the dashboards show the current record for each alert and device.

What data does this integration collect?

The Armis integration collects three types of logs.

Devices: Fetches the latest updates for all devices monitored by Armis.
Alerts: Gathers alerts associated with all devices monitored by Armis.
Vulnerabilities: Retrieves detected vulnerabilities and possible mitigation steps across all devices monitored by Armis.

Note:

The vulnerability data stream retrieves information by first fetching vulnerabilities and then identifying the devices where these vulnerabilities were detected, using a chained call between the vulnerability search and vulnerability match endpoints.

Supported use cases

Review the device inventory, including host identity, addresses, and operating system, on the Devices dashboard. Device documents set host.id and host.name, which Elastic Security can use to build host entities.
Investigate Armis alerts. Alert documents set event.kind to alert.
Review detected vulnerabilities and the devices they match, including the CVE identifier and severity, on the Vulnerabilities dashboard.

What do I need to use this integration?

Agent-based installation

Elastic Agent must be installed and enrolled in Fleet. For more details, check the Elastic Agent installation instructions.

You also need an Armis secret key from Settings > Asset Management & Security > API Management, and the base URL of the Armis API.

Elastic Managed enabled integration

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

How do I deploy this integration?

Fleet-managed Elastic Agent and Elastic Managed (agentless) deployment are both supported.

Collect logs through REST API

Log in to your Armis portal.
Navigate to the Settings tab.
Select Asset Management & Security.
Go to API Management and generate a Secret Key.

Enable the integration in Elastic

In Kibana navigate to Management > Integrations.
In the search bar, type Armis.
Select the Armis integration and add it.
Add all the required integration configuration parameters, including the URL and Secret Key, to enable data collection.
- URL: Base URL of the Armis API.
- Secret Key: Secret key generated in Armis.
- Interval: Time between polls. The default is 5m for each data stream.
- Initial Interval: How far back the first poll looks. The default is 24h.
- Page Size: Number of records per search request. The default is 2000 for alerts and devices, and 89 for vulnerabilities. Vulnerability match requests place the returned ids on the query string, so that page size is smaller.
Save the integration.

Validation

After the integration is saved, confirm that data is arriving:

In Fleet, confirm the Armis integration is healthy.
In Discover, open logs-armis.device-*, logs-armis.alert-*, and logs-armis.vulnerability-*. The first poll runs as soon as the policy is applied and looks back the Initial Interval; later polls run every Interval.
Open the Armis Devices, Alerts, and Vulnerabilities dashboards. The Devices and Alerts dashboards read the latest-transform destination.
If a data stream returns no documents, check the Elastic Agent logs for errors from the CEL input and refer to Troubleshooting.

Data retention

The alert and device data streams can hold repeated copies of the same records across polling intervals.

The package bounds the growth of these source data streams with a retention that depends on the deployment type:

Data stream	Self-managed and Elastic Cloud Hosted (ILM policy)	Serverless (data stream lifecycle)
`logs-armis.alert-*`	`logs-armis.alert-default_policy`: roll over after 30d, delete 30d after rollover	delete 30d after rollover
`logs-armis.device-*`	`logs-armis.device-default_policy`: roll over after 30d, delete 30d after rollover	delete 30d after rollover

On self-managed and Elastic Cloud Hosted deployments the ILM policy applies. The data stream lifecycle shipped with the package is not used there. ILM counts the delete age from the rollover of a backing index, so a document can remain for up to the rollover age plus the delete age. On Serverless, ILM is not available and the data stream lifecycle applies instead. It also works per backing index: Elasticsearch rolls the write index over automatically on age, size, or document count, and deletes a backing index once the retention has passed since it rolled over. A document therefore stays for the retention plus up to one rollover interval. The rollover age is derived from the retention and is an implementation detail that Elasticsearch may change. Where the package installs a transform, the transform's destination indices are not affected by either.

To keep data for a different period:

Self-managed and Elastic Cloud Hosted: edit the ILM policy in Kibana under Stack Management → Index Lifecycle Policies, or with PUT _ilm/policy/<policy name>. A package upgrade reinstalls the package's ILM policies, so check your change after upgrading.
Serverless: set the retention on the data stream, for example PUT _data_stream/logs-armis.alert-default/_lifecycle with the body {"data_retention": "90d"}. Replace default with your namespace.

Limitations

In the vulnerability data stream, our filtering mechanism for the vulnerability search API relies specifically on the lastDetected field. This means that when a user takes action on a vulnerability and lastDetected updates, only then will the event for that vulnerability be retrieved. Initially, we assumed this field would always have a value and could be used as a cursor timestamp for fetching data between intervals. However, due to inconsistencies in the API response, we observed cases where lastDetected is null.

Troubleshooting

If you get the following errors in the vulnerability data stream, reduce the page size in your request.

Common errors:
- 502 Bad Gateway
- 414 Request-URI Too Large
If you encounter issues in the alert data stream, particularly during the initial data fetch, reduce the initial interval.

Example error:
- The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

Performance and scaling

Each data stream polls on its own interval. The default is 5 minutes. Alert and device searches request 2000 records per page. Vulnerability search requests 89 records per page, then requests the matching devices. One integration policy per Armis tenant is enough for all three streams.

If a request returns 502 or 414, lower the page size. If the first alert collection fails because the initial window is too large, shorten the Initial Interval. Raise the interval when the tenant is large and the API cannot keep up with the default poll rate.

The alert and device latest transforms keep one current document per alert or device. Size the cluster for the source data streams plus those destination indices. Source retention is described in Data retention.

{
    "@timestamp": "2025-03-29T00:12:57.306Z",
    "agent": {
        "ephemeral_id": "b8961f6d-527f-4e75-a54e-4440c07d7ff7",
        "id": "6e0e7fed-f6da-48e7-aa1c-3ae3eb605196",
        "name": "elastic-agent-41603",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "armis": {
        "alert": {
            "activity_uuids": [
                "6f3d6d3a-6732-44cc-9d63-10a38277fb15"
            ],
            "affected_devices_count": 1,
            "alert_id": "61",
            "classification": "Security - Other",
            "description": "The Armis security platform has detected a violation of a policy and generated an alert.",
            "device_ids": [
                "854"
            ],
            "severity": "Critical",
            "status": "Unhandled",
            "status_change_time": "2025-03-29T00:12:57.306Z",
            "time": "2025-03-29T00:12:57.306Z",
            "title": "[Risk] Device Susceptible to Ransomware",
            "type": "System Policy Violation"
        }
    },
    "data_stream": {
        "dataset": "armis.alert",
        "namespace": "53950",
        "type": "logs"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "6e0e7fed-f6da-48e7-aa1c-3ae3eb605196",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "intrusion_detection"
        ],
        "dataset": "armis.alert",
        "id": "61",
        "ingested": "2025-05-23T09:34:03Z",
        "kind": "alert",
        "original": "{\"activityUUIDs\":[\"6f3d6d3a-6732-44cc-9d63-10a38277fb15\"],\"affectedDevicesCount\":1,\"alertId\":61,\"classification\":\"Security - Other\",\"connectionIds\":[],\"description\":\"The Armis security platform has detected a violation of a policy and generated an alert.\",\"destinationEndpoints\":[],\"deviceIds\":[854],\"lastAlertUpdateTime\":null,\"mitreAttackLabels\":null,\"policyId\":null,\"policyLabels\":null,\"policyTitle\":null,\"severity\":\"Critical\",\"sourceEndpoints\":[],\"status\":\"Unhandled\",\"statusChangeTime\":\"2025-03-29T00:12:57.306928+00:00\",\"time\":\"2025-03-29T00:12:57.306928+00:00\",\"title\":\"[Risk] Device Susceptible to Ransomware\",\"type\":\"System Policy Violation\"}",
        "severity": 99,
        "type": [
            "info"
        ]
    },
    "host": {
        "id": [
            "854"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "The Armis security platform has detected a violation of a policy and generated an alert.",
    "observer": {
        "product": "Asset Management and Security",
        "vendor": "Armis"
    },
    "related": {
        "hosts": [
            "854"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "armis-alert"
    ]
}

Exported fields

Field	Description	Type
@timestamp	Event timestamp.	date
armis.alert.activity_uuids		keyword
armis.alert.affected_devices_count		long
armis.alert.alert_id		keyword
armis.alert.classification		keyword
armis.alert.connection_ids		keyword
armis.alert.description		keyword
armis.alert.destination_endpoint_details	Structured destination endpoint objects returned by Armis.	flattened
armis.alert.destination_endpoints	String destination endpoint values. Structured endpoints are stored in destination_endpoint_details.	keyword
armis.alert.device_ids		keyword
armis.alert.friendly_name		keyword
armis.alert.last_alert_update_time		date
armis.alert.mitre_attack_labels		keyword
armis.alert.policy_id		keyword
armis.alert.policy_labels		keyword
armis.alert.policy_title		keyword
armis.alert.severity		keyword
armis.alert.source_endpoint_details	Structured source endpoint objects returned by Armis.	flattened
armis.alert.source_endpoints	String source endpoint values. Structured endpoints are stored in source_endpoint_details.	keyword
armis.alert.status		keyword
armis.alert.status_change_time		date
armis.alert.time		date
armis.alert.title		keyword
armis.alert.type		keyword
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset.	constant_keyword
event.module	Event module.	constant_keyword
input.type	Type of filebeat input.	keyword
labels.is_transform_source	Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering.	constant_keyword
log.offset	Log offset.	long

Device

This is the device dataset.

Example

An example event for device looks as following:

Example

{
    "@timestamp": "2025-03-29T10:43:55.988Z",
    "agent": {
        "ephemeral_id": "79a5a547-4482-4565-8d97-c4beaef9ec06",
        "id": "6c6c935d-c274-485e-9f33-edc5f6e46f26",
        "name": "elastic-agent-72754",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "armis": {
        "device": {
            "boundaries": "Corporate",
            "business_impact": "Unassigned",
            "category": "Network Equipment",
            "data_sources": [
                {
                    "first_seen": "2024-10-09T05:09:02.988Z",
                    "last_seen": "2025-03-29T10:43:55.988Z",
                    "name": "Knowledge Base",
                    "types": [
                        "Traffic Inspection",
                        "Data Analysis"
                    ]
                }
            ],
            "display_title": "Test",
            "first_seen": "2024-10-09T05:09:02.988Z",
            "id": "1154",
            "ip_address": [
                "89.160.20.128"
            ],
            "last_seen": "2025-03-29T10:43:55.988Z",
            "mac_address": [
                "50:76:AF:D3:3F:AB"
            ],
            "manufacturer": "Test Manufacturer",
            "model": "Test Model",
            "name": "Test Name",
            "names": [
                "Test Names"
            ],
            "operating_system": "Windows",
            "operating_system_version": "Server 2016",
            "purdue_level": 4,
            "risk_level": 10,
            "sensor": {
                "name": "test Enterprise",
                "type": "test LAN Controller"
            },
            "site": {
                "location": "Zurich",
                "name": "Zurich Enterprise"
            },
            "tags": [
                "Misconfigurations"
            ],
            "type": "Switches",
            "type_enum": "SWITCH",
            "visibility": "Full"
        }
    },
    "data_stream": {
        "dataset": "armis.device",
        "namespace": "69402",
        "type": "logs"
    },
    "device": {
        "manufacturer": "Test Manufacturer",
        "model": {
            "name": "Test Model"
        }
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "6c6c935d-c274-485e-9f33-edc5f6e46f26",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "dataset": "armis.device",
        "ingested": "2025-05-23T09:34:53Z",
        "kind": "event",
        "original": "{\"accessSwitch\":null,\"boundaries\":\"Corporate\",\"businessImpact\":\"Unassigned\",\"category\":\"Network Equipment\",\"customProperties\":{},\"dataSources\":[{\"firstSeen\":\"2024-10-09T05:09:02.988081+00:00\",\"instances\":[],\"lastSeen\":\"2025-03-29T10:43:55.988081+00:00\",\"name\":\"Knowledge Base\",\"types\":[\"Traffic Inspection\",\"Data Analysis\"]}],\"displayTitle\":\"Test\",\"firstSeen\":\"2024-10-09T05:09:02.988081+00:00\",\"id\":1154,\"ipAddress\":\"89.160.20.128\",\"ipv6\":[],\"lastSeen\":\"2025-03-29T10:43:55.988081+00:00\",\"macAddress\":\"50:76:AF:D3:3F:AB\",\"manufacturer\":\"Test Manufacturer\",\"model\":\"Test Model\",\"name\":\"Test Name\",\"names\":\"Test Names\",\"operatingSystem\":\"Windows\",\"operatingSystemVersion\":\"Server 2016\",\"protections\":[],\"purdueLevel\":4,\"riskLevel\":10,\"sensor\":{\"name\":\"test Enterprise\",\"type\":\"test LAN Controller\"},\"site\":{\"location\":\"Zurich\",\"name\":\"Zurich Enterprise\"},\"tags\":[\"Misconfigurations\"],\"type\":\"Switches\",\"typeEnum\":\"SWITCH\",\"userIds\":[],\"visibility\":\"Full\"}",
        "start": "2024-10-09T05:09:02.988Z",
        "type": [
            "info"
        ]
    },
    "host": {
        "id": "1154",
        "ip": [
            "89.160.20.128"
        ],
        "mac": [
            "50-76-AF-D3-3F-AB"
        ],
        "name": [
            "test names"
        ],
        "os": {
            "family": "windows",
            "type": "windows",
            "version": "Server 2016"
        },
        "risk": {
            "static_score": 10
        },
        "type": "Network Equipment"
    },
    "input": {
        "type": "cel"
    },
    "observer": {
        "product": "Asset Management and Security",
        "vendor": "Armis"
    },
    "related": {
        "hosts": [
            "test names"
        ],
        "ip": [
            "89.160.20.128"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "armis-device"
    ]
}

Exported fields

Field	Description	Type
@timestamp	Event timestamp.	date
armis.device.access_switch		keyword
armis.device.boundaries		keyword
armis.device.business_impact		keyword
armis.device.category		keyword
armis.device.custom_properties		flattened
armis.device.data_sources.first_seen		date
armis.device.data_sources.instances.first_seen		date
armis.device.data_sources.instances.last_seen		date
armis.device.data_sources.instances.name		keyword
armis.device.data_sources.last_seen		date
armis.device.data_sources.name		keyword
armis.device.data_sources.types		keyword
armis.device.display_title		keyword
armis.device.first_seen		date
armis.device.id		keyword
armis.device.ip_address		ip
armis.device.ip_v6		ip
armis.device.last_seen		date
armis.device.mac_address		keyword
armis.device.manufacturer		keyword
armis.device.model		keyword
armis.device.name		keyword
armis.device.names		keyword
armis.device.operating_system		keyword
armis.device.operating_system_version		keyword
armis.device.protections.creation_time		date
armis.device.protections.device_id		keyword
armis.device.protections.last_seen_time		date
armis.device.protections.protection_name		keyword
armis.device.purdue_level		double
armis.device.risk_level		long
armis.device.sensor.name		keyword
armis.device.sensor.type		keyword
armis.device.site.location		keyword
armis.device.site.name		keyword
armis.device.tags		keyword
armis.device.type		keyword
armis.device.type_enum		keyword
armis.device.user_ids		keyword
armis.device.visibility		keyword
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset.	constant_keyword
event.module	Event module.	constant_keyword
input.type	Type of filebeat input.	keyword
labels.is_transform_source	Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering.	constant_keyword
log.offset	Log offset.	long

Vulnerability

This is the vulnerability dataset.

Example

An example event for vulnerability looks as following:

Example

{
    "@timestamp": "2025-04-03T10:38:59.297Z",
    "agent": {
        "ephemeral_id": "9a91aa96-816b-428a-8fc8-b3fef827ea46",
        "id": "d9276d97-c6ed-47e9-b06a-987409dc7ee8",
        "name": "elastic-agent-32198",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "armis": {
        "vulnerability": {
            "affected_devices_count": 13,
            "attack_complexity": "Low",
            "attack_vector": "Network",
            "availability_impact": "High",
            "confidentiality_impact": "High",
            "cve_uid": "CVE-2024-44148",
            "cvss_score": 10,
            "description": "This issue was addressed with improved validation of file attributes.",
            "epss_percentile": 0.31,
            "epss_score": 0.00139,
            "exploitability_score": 3.9,
            "first_detected": "2025-04-03T09:18:31.915Z",
            "has_remediation_info": "No",
            "id": "CVE-2024-44148",
            "impact_score": 6,
            "integrity_impact": "High",
            "last_detected": "2025-04-03T10:38:59.372Z",
            "num_of_exploits": 0,
            "number_of_threat_actors": 0,
            "privileges_required": "None",
            "published_date": "2024-09-17T00:15:50.617Z",
            "scope": "Changed",
            "score": 10,
            "severity": "Critical",
            "status": "Open",
            "type": "OS",
            "user_interaction": "None",
            "vulnerability_match": {
                "confidence_level": "High",
                "cve_uid": "CVE-2024-44148",
                "device_id": "109",
                "first_detected": "2025-04-03T10:38:59.297Z",
                "has_remediation_info": "No",
                "last_detected": "2025-04-03T10:38:59.297Z",
                "match_criteria_string": "OS",
                "status": "Open",
                "status_source": "Discovered by Armis"
            }
        }
    },
    "data_stream": {
        "dataset": "armis.vulnerability",
        "namespace": "56787",
        "type": "logs"
    },
    "device": {
        "id": "109"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "d9276d97-c6ed-47e9-b06a-987409dc7ee8",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "dataset": "armis.vulnerability",
        "ingested": "2025-05-23T09:35:42Z",
        "kind": "event",
        "original": "{\"affectedDevicesCount\":13,\"attackComplexity\":\"Low\",\"attackVector\":\"Network\",\"availabilityImpact\":\"High\",\"avmRating\":null,\"avmRatingManualChangeReason\":null,\"avmRatingManualChangedBy\":\"\",\"avmRatingManualUpdateTime\":null,\"botnets\":null,\"cisaDueDate\":null,\"commonName\":null,\"confidentialityImpact\":\"High\",\"cveUid\":\"CVE-2024-44148\",\"cvssScore\":10,\"cvssScoreV4\":null,\"description\":\"This issue was addressed with improved validation of file attributes.\",\"epssPercentile\":0.31,\"epssScore\":0.00139,\"exploitabilityScore\":3.9,\"firstDetected\":\"2025-04-03T09:18:31.915543+00:00\",\"firstReferencePublishDate\":null,\"firstWeaponizedReferencePublishDate\":null,\"hasRansomware\":null,\"hasRemediationInfo\":\"No\",\"id\":\"CVE-2024-44148\",\"impactScore\":6,\"integrityImpact\":\"High\",\"isWeaponized\":null,\"lastDetected\":\"2025-04-03T10:38:59.372389+00:00\",\"latestExploitUpdate\":null,\"numOfExploits\":0,\"numberOfThreatActors\":0,\"privilegesRequired\":\"None\",\"publishedDate\":\"2024-09-17T00:15:50.617000+00:00\",\"reportedByGoogleZeroDays\":null,\"scope\":\"Changed\",\"score\":10,\"severity\":\"Critical\",\"status\":\"Open\",\"threatActors\":null,\"threatTags\":null,\"type\":\"OS\",\"userInteraction\":\"None\",\"vulnerability_match\":{\"advisoryId\":null,\"avmRating\":null,\"confidenceLevel\":\"High\",\"confidenceLevelDescription\":null,\"cveUid\":\"CVE-2024-44148\",\"deviceId\":109,\"firstDetected\":\"2025-04-03T10:38:59.297015+00:00\",\"hasRemediationInfo\":\"No\",\"lastDetected\":\"2025-04-03T10:38:59.297015+00:00\",\"matchCriteriaString\":\"OS\",\"recommendedSteps\":null,\"remediationTypes\":null,\"status\":\"Open\",\"statusChangeReason\":null,\"statusSource\":\"Discovered by Armis\"}}",
        "start": "2025-04-03T09:18:31.915Z",
        "type": [
            "info"
        ]
    },
    "host": {
        "id": "109"
    },
    "input": {
        "type": "cel"
    },
    "message": "This issue was addressed with improved validation of file attributes.",
    "observer": {
        "product": "Asset Management and Security",
        "vendor": "Armis"
    },
    "related": {
        "hosts": [
            "109"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "armis-vulnerability"
    ],
    "threat": {
        "indicator": {
            "last_seen": "2025-04-03T10:38:59.297Z"
        }
    },
    "vulnerability": {
        "category": [
            "Network"
        ],
        "description": "This issue was addressed with improved validation of file attributes.",
        "id": "CVE-2024-44148",
        "scanner": {
            "vendor": "Armis"
        },
        "score": {
            "base": 10
        },
        "severity": "Critical"
    }
}

Exported fields

Field	Description	Type
@timestamp	Event timestamp.	date
armis.vulnerability.affected_devices_count		long
armis.vulnerability.attack_complexity		keyword
armis.vulnerability.attack_vector		keyword
armis.vulnerability.availability_impact		keyword
armis.vulnerability.avm_rating		keyword
armis.vulnerability.avm_rating_manual_change_reason		keyword
armis.vulnerability.avm_rating_manual_changed_by		keyword
armis.vulnerability.avm_rating_manual_update_time		date
armis.vulnerability.botnets		keyword
armis.vulnerability.cisa_due_date		date
armis.vulnerability.common_name		keyword
armis.vulnerability.confidentiality_impact		keyword
armis.vulnerability.cve_uid		keyword
armis.vulnerability.cvss_score		double
armis.vulnerability.cvss_score_v4		keyword
armis.vulnerability.description		keyword
armis.vulnerability.epss_percentile		double
armis.vulnerability.epss_score		double
armis.vulnerability.exploitability_score		double
armis.vulnerability.first_detected		date
armis.vulnerability.first_reference_publish_date		date
armis.vulnerability.first_weaponized_reference_publish_date		date
armis.vulnerability.has_ransomware		boolean
armis.vulnerability.has_remediation_info		keyword
armis.vulnerability.id		keyword
armis.vulnerability.impact_score		double
armis.vulnerability.integrity_impact		keyword
armis.vulnerability.is_weaponized		boolean
armis.vulnerability.last_detected		date
armis.vulnerability.latest_exploit_update		date
armis.vulnerability.num_of_exploits		long
armis.vulnerability.number_of_threat_actors		long
armis.vulnerability.privileges_required		keyword
armis.vulnerability.published_date		date
armis.vulnerability.reported_by_google_zero_days		boolean
armis.vulnerability.scope		keyword
armis.vulnerability.score		double
armis.vulnerability.severity		keyword
armis.vulnerability.status		keyword
armis.vulnerability.threat_actors		keyword
armis.vulnerability.threat_tags		keyword
armis.vulnerability.type		keyword
armis.vulnerability.user_interaction		keyword
armis.vulnerability.vulnerability_match.advisory_id		keyword
armis.vulnerability.vulnerability_match.avm_rating		keyword
armis.vulnerability.vulnerability_match.confidence_level		keyword
armis.vulnerability.vulnerability_match.confidence_level_description		keyword
armis.vulnerability.vulnerability_match.cve_uid		keyword
armis.vulnerability.vulnerability_match.device_id		keyword
armis.vulnerability.vulnerability_match.first_detected		date
armis.vulnerability.vulnerability_match.has_remediation_info		keyword
armis.vulnerability.vulnerability_match.last_detected		date
armis.vulnerability.vulnerability_match.match_criteria_string		keyword
armis.vulnerability.vulnerability_match.recommended_steps		keyword
armis.vulnerability.vulnerability_match.remediation_types		keyword
armis.vulnerability.vulnerability_match.status		keyword
armis.vulnerability.vulnerability_match.status_change_reason		keyword
armis.vulnerability.vulnerability_match.status_source		keyword
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset.	constant_keyword
event.module	Event module.	constant_keyword
input.type	Type of filebeat input.	keyword
labels.is_transform_source	Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering.	constant_keyword
log.offset	Log offset.	long

Inputs used in this integration

CEL input: Polls the Armis API v1 and paginates each search response.

APIs used to collect data

POST /api/v1/access_token/: Exchanges the secret key for an access token.
GET /api/v1/search/: Collects devices (in:devices), alerts (in:alerts), and vulnerabilities (in:vulnerabilities).
GET /api/v1/vulnerability-match/: Collects the devices matched to the vulnerabilities returned by search.

Screenshots

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.

Changelog

Version	Details	Minimum Kibana version
0.10.1	Bug fix (View pull request) Preserve structured alert endpoints without conflicting with existing keyword mappings.	9.0.0 8.18.0
0.10.0	Bug fix (View pull request) Skip null device and alert timestamps when advancing the collection cursor. Bug fix (View pull request) Advance the vulnerability cursor from the latest non-null lastDetected value. Enhancement (View pull request) Store a 30-day time range on the Vulnerabilities dashboard. Enhancement (View pull request) Map Armis CVSS scores, MITRE labels, and alert categories to ECS. armis.vulnerability.cvss_score is copied to vulnerability.score.base and removed unless preserve_duplicate_custom_fields is enabled.	9.0.0 8.18.0
0.9.2	Enhancement (View pull request) Align the README with the integration documentation guidelines.	9.0.0 8.18.0
0.9.1	Bug fix (View pull request) Allow multiple namespaces in the latest alert and device transforms. Bug fix (View pull request) Guard CEL collection against null API results.	9.0.0 8.18.0
0.9.0	Enhancement (View pull request) Document the retention applied to source data streams on stateful and Serverless deployments, and how to change it.	9.0.0 8.18.0
0.8.0	Enhancement (View pull request) Use links panel in Dashboards. Enhancement (View pull request) Document Elastic Managed deployments as generally available.	9.0.0 8.18.0
0.7.0	Enhancement (View pull request) Add tags to ingest pipeline processors and add `preserve_original_event` to pipeline-level `on_failure` handlers.	9.0.0 8.18.0
0.6.1	Enhancement (View pull request) Set agentless deployment mode `release` field to `ga`.	9.0.0 8.18.0
0.6.0	Enhancement (View pull request) Publish Agentless to Elastic Managed integrations name change.	9.0.0 8.18.0
0.5.0	Enhancement (View pull request) Use new `release` field for agentless deployment mode to establish as beta.	9.0.0 8.18.0
0.4.2	Bug fix (View pull request) Change page_size/batch_size variable type from text to integer for Fleet input validation.	9.0.0 8.18.0
0.4.1	Bug fix (View pull request) Downgrade the `format_version` to the minimum version that supports all the necessary features for the package.	9.0.0 8.18.0
0.4.0	Enhancement (View pull request) Improve documentation to align with new guidelines.	9.0.0 8.18.0
0.3.0	Enhancement (View pull request) Use `terminate` processor instead of `fail` processor to handle agent errors.	9.0.0 8.18.0
0.2.0	Enhancement (View pull request) Remove duplicated installation instructions from the documentation.	9.0.0 8.18.0
0.1.1	Bug fix (View pull request) Add temporary processor to remove the fields added by the Agentless policy.	9.0.0 8.18.0
0.1.0	Enhancement (View pull request) Initial release.	9.0.0 8.18.0