Armis SOAR Integration

This document details the tools provided by the Armis SOAR integration.

Tools

armis_ping

Test connectivity to the Armis with parameters provided at the integration configuration page on the Marketplace tab.

Parameters:

• case_id (str, required): The ID of the case.
• alert_group_identifiers (List[str], required): Identifiers for the alert groups.
• target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
• scope (str, optional, default="All entities"): Defines the scope for the action.

armis_update_alert_status

Update status of the alert in Armis.

Parameters:

• case_id (str, required): The ID of the case.
• alert_group_identifiers (List[str], required): Identifiers for the alert groups.
• alert_id (str, required): Specify the id of the alert for which you want to update status.
• status (Optional[List[str]], optional, default=None): Specify what status should be set for the alert.
• target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
• scope (str, optional, default="All entities"): Defines the scope for the action.

armis_enrich_entities

Enrich entities using information from Armis. Supported entities: IP, Mac Address.

Parameters:

• case_id (str, required): The ID of the case.
• alert_group_identifiers (List[str], required): Identifiers for the alert groups.
• create_endpoint_insight (Optional[bool], optional, default=None): If enabled, action will create an insight containing information about the endpoints.
• target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
• scope (str, optional, default="All entities"): Defines the scope for the action.

armis_list_alert_connections

List connections related to the alert in Armis.

Parameters:

• case_id (str, required): The ID of the case.
• alert_group_identifiers (List[str], required): Identifiers for the alert groups.
• alert_id (str, required): Specify the id of the alert for which you want to pull connections data.
• lowest_severity_to_fetch (Optional[List[str]], optional, default=None): Specify the lowest severity of the connections that should be used when fetching them.
• max_connections_to_return (Optional[str], optional, default=None): Specify how many connections to return. Default: 50.
• target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
• scope (str, optional, default="All entities"): Defines the scope for the action.