![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Armis.svg\")
",
- "Description": "The [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.",
- "Parsers":[
- "Parsers/ArmisActivities.yaml",
- "Parsers/ArmisDevice.yaml",
- "Parsers/ArmisAlerts.yaml"
- ],
- "Data Connectors": [
- "Data Connectors/ArmisAlertsActivities/ArmisAlertsActivities_API_FunctionApp.json",
- "Data Connectors/ArmisDevice/ArmisDevice_API_FunctionApp.json"
- ],
- "Playbooks":[
- "Playbooks/ArmisUpdateAlertStatus/azuredeploy.json"
- ],
- "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Armis",
- "Version": "3.2.0",
- "Metadata": "SolutionMetadata.json",
- "TemplateSpec": true,
- "Is1PConnector": false
- }
\ No newline at end of file
+ "Name": "Armis",
+ "Author": "Armis - support@armis.com",
+ "Logo": "",
+ "Description": "The [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.",
+ "Parsers": [
+ "Parsers/ArmisActivities.yaml",
+ "Parsers/ArmisDevice.yaml",
+ "Parsers/ArmisAlerts.yaml",
+ "Parsers/ArmisAuditLogs.yaml"
+ ],
+ "Data Connectors": [
+ "Data Connectors/ArmisAlertsActivities/ArmisAlertsActivities_API_FunctionApp.json",
+ "Data Connectors/ArmisDevice/ArmisDevice_API_FunctionApp.json",
+ "Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json"
+ ],
+ "Playbooks": [
+ "Playbooks/ArmisUpdateAlertStatus/azuredeploy.json"
+ ],
+ "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Armis",
+ "Version": "3.3.0",
+ "Metadata": "SolutionMetadata.json",
+ "TemplateSpec": true,
+ "Is1PConnector": false
+}
diff --git a/Solutions/Armis/Package/3.3.0.zip b/Solutions/Armis/Package/3.3.0.zip
new file mode 100644
index 00000000000..4cc4e30c1d6
Binary files /dev/null and b/Solutions/Armis/Package/3.3.0.zip differ
diff --git a/Solutions/Armis/Package/createUiDefinition.json b/Solutions/Armis/Package/createUiDefinition.json
index cd3cf342081..d80965d4f34 100644
--- a/Solutions/Armis/Package/createUiDefinition.json
+++ b/Solutions/Armis/Package/createUiDefinition.json
@@ -6,7 +6,7 @@
"config": {
"isWizard": false,
"basics": {
- "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Armis/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.\n\n**Data Connectors:** 2, **Parsers:** 3, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Armis/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.\n\n**Data Connectors:** 3, **Parsers:** 4, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
@@ -71,14 +71,14 @@
}
},
{
- "name": "dataconnectors-parser-text",
+ "name": "dataconnectors3-text",
"type": "Microsoft.Common.TextBlock",
"options": {
- "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel."
+ "text": "This Solution installs the data connector for Armis Audit Logs (via Codeless Connector Framework). You can get Armis Audit Logs (via Codeless Connector Framework) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
}
},
{
- "name": "dataconnectors-link2",
+ "name": "dataconnectors-link3",
"type": "Microsoft.Common.TextBlock",
"options": {
"link": {
diff --git a/Solutions/Armis/Package/mainTemplate.json b/Solutions/Armis/Package/mainTemplate.json
index 53104dc61f9..2190f7db1f4 100644
--- a/Solutions/Armis/Package/mainTemplate.json
+++ b/Solutions/Armis/Package/mainTemplate.json
@@ -2,7 +2,7 @@
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata": {
- "author": "{Armis - support@armis.com}",
+ "author": "Armis - support@armis.com",
"comments": "Solution template for Armis"
},
"parameters": {
@@ -27,13 +27,27 @@
"metadata": {
"description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
}
+ },
+ "resourceGroupName": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().name]",
+ "metadata": {
+ "description": "resource group name where Microsoft Sentinel is setup"
+ }
+ },
+ "subscription": {
+ "type": "string",
+ "defaultValue": "[last(split(subscription().id, '/'))]",
+ "metadata": {
+ "description": "subscription id where Microsoft Sentinel is setup"
+ }
}
},
"variables": {
- "email": "support@armis.com}",
+ "email": "support@armis.com",
"_email": "[variables('email')]",
"_solutionName": "Armis",
- "_solutionVersion": "3.2.0",
+ "_solutionVersion": "3.3.0",
"solutionId": "armisinc1668090987837.armis-solution",
"_solutionId": "[variables('solutionId')]",
"parserObject1": {
@@ -57,6 +71,13 @@
"parserVersion3": "1.0.1",
"parserContentId3": "ArmisAlerts-Parser"
},
+ "parserObject4": {
+ "_parserName4": "[concat(parameters('workspace'),'/','ArmisAuditLogs')]",
+ "_parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ArmisAuditLogs')]",
+ "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ArmisAuditLogs-Parser')))]",
+ "parserVersion4": "1.0.0",
+ "parserContentId4": "ArmisAuditLogs-Parser"
+ },
"uiConfigId1": "ArmisAlertsActivities",
"_uiConfigId1": "[variables('uiConfigId1')]",
"dataConnectorContentId1": "ArmisAlertsActivities",
@@ -75,6 +96,14 @@
"dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]",
"dataConnectorVersion2": "1.0.0",
"_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]",
+ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+ "dataConnectorCCPVersion": "3.3.0",
+ "_dataConnectorContentIdConnectorDefinition3": "ArmisAuditLogCCPConnectorDefinition",
+ "dataConnectorTemplateNameConnectorDefinition3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition3')))]",
+ "_dataConnectorContentIdConnections3": "ArmisAuditLogCCPConnectorDefinitionConnections",
+ "dataConnectorTemplateNameConnections3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections3')))]",
+ "dataCollectionEndpointId3": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]",
+ "blanks": "[replace('b', 'b', '')]",
"ArmisUpdateAlertStatus": "ArmisUpdateAlertStatus",
"_ArmisUpdateAlertStatus": "[variables('ArmisUpdateAlertStatus')]",
"playbookVersion1": "1.0",
@@ -82,9 +111,7 @@
"_playbookContentId1": "[variables('playbookContentId1')]",
"playbookId1": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId1'))]",
"playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId1'))))]",
- "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
"_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]",
- "blanks": "[replace('b', 'b', '')]",
"_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
},
"resources": [
@@ -97,7 +124,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "ArmisActivities Data Parser with template version 3.2.0",
+ "description": "ArmisActivities Data Parser with template version 3.3.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('parserObject1').parserVersion1]",
@@ -106,7 +133,7 @@
"resources": [
{
"name": "[variables('parserObject1')._parserName1]",
- "apiVersion": "2022-10-01",
+ "apiVersion": "2025-07-01",
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
"location": "[parameters('workspace-location')]",
"properties": {
@@ -143,7 +170,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -171,7 +198,7 @@
},
{
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
- "apiVersion": "2022-10-01",
+ "apiVersion": "2025-07-01",
"name": "[variables('parserObject1')._parserName1]",
"location": "[parameters('workspace-location')]",
"properties": {
@@ -209,7 +236,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -229,7 +256,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "ArmisDevice Data Parser with template version 3.2.0",
+ "description": "ArmisDevice Data Parser with template version 3.3.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('parserObject2').parserVersion2]",
@@ -238,7 +265,7 @@
"resources": [
{
"name": "[variables('parserObject2')._parserName2]",
- "apiVersion": "2022-10-01",
+ "apiVersion": "2025-07-01",
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
"location": "[parameters('workspace-location')]",
"properties": {
@@ -275,7 +302,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -303,7 +330,7 @@
},
{
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
- "apiVersion": "2022-10-01",
+ "apiVersion": "2025-07-01",
"name": "[variables('parserObject2')._parserName2]",
"location": "[parameters('workspace-location')]",
"properties": {
@@ -341,7 +368,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -361,7 +388,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "ArmisAlerts Data Parser with template version 3.2.0",
+ "description": "ArmisAlerts Data Parser with template version 3.3.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('parserObject3').parserVersion3]",
@@ -370,7 +397,7 @@
"resources": [
{
"name": "[variables('parserObject3')._parserName3]",
- "apiVersion": "2022-10-01",
+ "apiVersion": "2025-07-01",
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
"location": "[parameters('workspace-location')]",
"properties": {
@@ -407,7 +434,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -435,7 +462,7 @@
},
{
"type": "Microsoft.OperationalInsights/workspaces/savedSearches",
- "apiVersion": "2022-10-01",
+ "apiVersion": "2025-07-01",
"name": "[variables('parserObject3')._parserName3]",
"location": "[parameters('workspace-location')]",
"properties": {
@@ -473,7 +500,139 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Armis Corporation",
+ "email": "support@armis.com",
+ "tier": "Partner",
+ "link": "https://support.armis.com/"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('parserObject4').parserTemplateSpecName4]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "ArmisAuditLogs Data Parser with template version 3.3.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('parserObject4').parserVersion4]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[variables('parserObject4')._parserName4]",
+ "apiVersion": "2025-07-01",
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for ArmisAuditLogs",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "ArmisAuditLogs",
+ "query": "let ArmisAuditLogs_view = view () {\n ArmisAuditLog_CL\n | extend\n EventVendor=\"ArmisAuditLogs\",\n EventProduct=\"ArmisAuditLogs\",\n Action = column_ifexists('action', ''),\n AdditionalInfo = column_ifexists('additionalInfo', ''),\n EventTime = column_ifexists('eventTime', ''),\n Id = column_ifexists('id', ''),\n TimeUtc = column_ifexists('timeUtc', ''),\n Trigger = column_ifexists('trigger', ''),\n User = column_ifexists('user', ''),\n UserIp = column_ifexists('userIp', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Action,\n AdditionalInfo,\n EventTime,\n Id,\n TimeUtc,\n Trigger,\n User,\n UserIp\n};\nArmisAuditLogs_view\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject4')._parserId4]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ArmisAuditLogs')]",
+ "contentId": "[variables('parserObject4').parserContentId4]",
+ "kind": "Parser",
+ "version": "[variables('parserObject4').parserVersion4]",
+ "source": {
+ "name": "Armis",
+ "kind": "Solution",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Armis",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Armis Corporation",
+ "email": "support@armis.com",
+ "tier": "Partner",
+ "link": "https://support.armis.com/"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('parserObject4').parserContentId4]",
+ "contentKind": "Parser",
+ "displayName": "Parser for ArmisAuditLogs",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]",
+ "version": "[variables('parserObject4').parserVersion4]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "[variables('parserObject4')._parserName4]",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for ArmisAuditLogs",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "ArmisAuditLogs",
+ "query": "let ArmisAuditLogs_view = view () {\n ArmisAuditLog_CL\n | extend\n EventVendor=\"ArmisAuditLogs\",\n EventProduct=\"ArmisAuditLogs\",\n Action = column_ifexists('action', ''),\n AdditionalInfo = column_ifexists('additionalInfo', ''),\n EventTime = column_ifexists('eventTime', ''),\n Id = column_ifexists('id', ''),\n TimeUtc = column_ifexists('timeUtc', ''),\n Trigger = column_ifexists('trigger', ''),\n User = column_ifexists('user', ''),\n UserIp = column_ifexists('userIp', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Action,\n AdditionalInfo,\n EventTime,\n Id,\n TimeUtc,\n Trigger,\n User,\n UserIp\n};\nArmisAuditLogs_view\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject4')._parserId4]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ArmisAuditLogs')]",
+ "contentId": "[variables('parserObject4').parserContentId4]",
+ "kind": "Parser",
+ "version": "[variables('parserObject4').parserVersion4]",
+ "source": {
+ "kind": "Solution",
+ "name": "Armis",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -493,7 +652,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "Armis data connector with template version 3.2.0",
+ "description": "Armis data connector with template version 3.3.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('dataConnectorVersion1')]",
@@ -664,7 +823,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -709,7 +868,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -878,7 +1037,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "Armis data connector with template version 3.2.0",
+ "description": "Armis data connector with template version 3.3.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('dataConnectorVersion2')]",
@@ -1030,7 +1189,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -1075,7 +1234,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -1216,6 +1375,673 @@
}
}
},
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition3'), variables('dataConnectorCCPVersion'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition3')]",
+ "displayName": "Armis Audit Logs (via Codeless Connector Framework)",
+ "contentKind": "DataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorCCPVersion')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "ArmisAuditLogCCPConnectorDefinition",
+ "title": "Armis Audit Logs (via Codeless Connector Framework)",
+ "publisher": "Armis",
+ "descriptionMarkdown": "The [Armis](https://www.armis.com/) Audit Logs data connector enables you to ingest audit logs from your Armis instance into Microsoft Sentinel through the Armis REST API using the Codeless Connector Framework (CCF). The connector polls for new audit logs every 15 minutes.",
+ "graphQueriesTableName": "ArmisAuditLog_CL",
+ "graphQueries": [
+ {
+ "metricName": "Total Audit Logs Ingested",
+ "legend": "Armis Audit Logs",
+ "baseQuery": "ArmisAuditLog_CL"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "Get a sample of Armis Audit Logs",
+ "query": "ArmisAuditLog_CL\n| take 10"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "ArmisAuditLog_CL",
+ "lastDataReceivedQuery": "ArmisAuditLog_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors",
+ "value": null
+ }
+ ],
+ "availability": {
+ "isPreview": true
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "write": true,
+ "read": true,
+ "delete": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "name": "Armis Base URL",
+ "description": "The URL of your Armis instance (for example, https://your-tenant.armis.com)."
+ },
+ {
+ "name": "Armis Secret Key",
+ "description": "An Armis API secret key, created in Armis under Settings -> API Management."
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "title": "STEP 1 - Configuration steps for the Armis API",
+ "description": "Follow these instructions to create an Armis API secret key.",
+ "instructions": [
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "1. Log into your Armis instance\n2. Navigate to **Settings -> API Management**\n3. If the secret key has not already been created, press the **Create** button to create the secret key\n4. To access the secret key, press the **Show** button\n5. The secret key can now be copied and used during the Armis Audit Logs connector configuration"
+ }
+ }
+ ]
+ },
+ {
+ "title": "STEP 2 - Connect Armis Audit Logs to Microsoft Sentinel",
+ "description": "Provide the following details to start collecting Armis audit logs:\n\n1. **Armis Base URL** - The URL of your Armis instance, for example `https://your-tenant.armis.com`, without a trailing slash.\n2. **Armis Secret Key** - The API secret key created in STEP 1.",
+ "instructions": [
+ {
+ "type": "Textbox",
+ "parameters": {
+ "label": "Armis Base URL",
+ "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)",
+ "type": "text",
+ "name": "armisBaseUrl",
+ "validations": {
+ "required": true
+ }
+ }
+ },
+ {
+ "type": "Textbox",
+ "parameters": {
+ "label": "Armis Secret Key",
+ "placeholder": "Enter your Armis Secret Key",
+ "type": "password",
+ "name": "armisSecretKey",
+ "validations": {
+ "required": true
+ }
+ }
+ },
+ {
+ "parameters": {
+ "label": "toggle",
+ "name": "toggle"
+ },
+ "type": "ConnectionToggleButton"
+ }
+ ]
+ },
+ {
+ "title": "STEP 3 - Validate data collection",
+ "description": "Confirm that Armis audit logs are flowing into Microsoft Sentinel.",
+ "instructions": [
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "1. **Check the connection status**: Once connected, the connector shows as **Connected** on this page.\n2. **Validate the data**: Use the sample queries on this page to confirm that audit logs are being received. The connector polls every 15 minutes, so the first logs can take a few minutes to appear."
+ }
+ }
+ ]
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition3'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition3')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "Armis",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Armis Corporation",
+ "email": "support@armis.com",
+ "tier": "Partner",
+ "link": "https://support.armis.com/"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections3')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "ArmisAuditLogDCR",
+ "apiVersion": "2022-06-01",
+ "type": "Microsoft.Insights/dataCollectionRules",
+ "location": "[parameters('workspace-location')]",
+ "kind": "[variables('blanks')]",
+ "properties": {
+ "dataCollectionEndpointId": "[variables('dataCollectionEndpointId3')]",
+ "streamDeclarations": {
+ "Custom-ArmisAuditLog_CL": {
+ "columns": [
+ {
+ "name": "id",
+ "type": "real"
+ },
+ {
+ "name": "time",
+ "type": "datetime"
+ },
+ {
+ "name": "timeUtc",
+ "type": "datetime"
+ },
+ {
+ "name": "action",
+ "type": "string"
+ },
+ {
+ "name": "additionalInfo",
+ "type": "dynamic"
+ },
+ {
+ "name": "trigger",
+ "type": "string"
+ },
+ {
+ "name": "user",
+ "type": "string"
+ },
+ {
+ "name": "userIp",
+ "type": "string"
+ }
+ ]
+ }
+ },
+ "destinations": {
+ "logAnalytics": [
+ {
+ "workspaceResourceId": "[variables('workspaceResourceId')]",
+ "name": "clv2ws1"
+ }
+ ]
+ },
+ "dataFlows": [
+ {
+ "streams": [
+ "Custom-ArmisAuditLog_CL"
+ ],
+ "destinations": [
+ "clv2ws1"
+ ],
+ "transformKql": "source | extend TimeGenerated = now() | project-rename eventTime = ['time']",
+ "outputStream": "Custom-ArmisAuditLog_CL"
+ }
+ ]
+ }
+ },
+ {
+ "name": "ArmisAuditLog_CL",
+ "apiVersion": "2022-10-01",
+ "type": "Microsoft.OperationalInsights/workspaces/tables",
+ "location": "[parameters('workspace-location')]",
+ "kind": null,
+ "properties": {
+ "schema": {
+ "name": "ArmisAuditLog_CL",
+ "columns": [
+ {
+ "name": "TimeGenerated",
+ "type": "Datetime"
+ },
+ {
+ "name": "id",
+ "type": "real"
+ },
+ {
+ "name": "eventTime",
+ "type": "datetime"
+ },
+ {
+ "name": "timeUtc",
+ "type": "datetime"
+ },
+ {
+ "name": "action",
+ "type": "string"
+ },
+ {
+ "name": "additionalInfo",
+ "type": "dynamic"
+ },
+ {
+ "name": "trigger",
+ "type": "string"
+ },
+ {
+ "name": "user",
+ "type": "string"
+ },
+ {
+ "name": "userIp",
+ "type": "string"
+ }
+ ]
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition3'),'-', variables('dataConnectorCCPVersion'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "ArmisAuditLogCCPConnectorDefinition",
+ "title": "Armis Audit Logs (via Codeless Connector Framework)",
+ "publisher": "Armis",
+ "descriptionMarkdown": "The [Armis](https://www.armis.com/) Audit Logs data connector enables you to ingest audit logs from your Armis instance into Microsoft Sentinel through the Armis REST API using the Codeless Connector Framework (CCF). The connector polls for new audit logs every 15 minutes.",
+ "graphQueriesTableName": "ArmisAuditLog_CL",
+ "graphQueries": [
+ {
+ "metricName": "Total Audit Logs Ingested",
+ "legend": "Armis Audit Logs",
+ "baseQuery": "ArmisAuditLog_CL"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "Get a sample of Armis Audit Logs",
+ "query": "ArmisAuditLog_CL\n| take 10"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "ArmisAuditLog_CL",
+ "lastDataReceivedQuery": "ArmisAuditLog_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors",
+ "value": null
+ }
+ ],
+ "availability": {
+ "isPreview": true
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "write": true,
+ "read": true,
+ "delete": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "name": "Armis Base URL",
+ "description": "The URL of your Armis instance (for example, https://your-tenant.armis.com)."
+ },
+ {
+ "name": "Armis Secret Key",
+ "description": "An Armis API secret key, created in Armis under Settings -> API Management."
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "title": "STEP 1 - Configuration steps for the Armis API",
+ "description": "Follow these instructions to create an Armis API secret key.",
+ "instructions": [
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "1. Log into your Armis instance\n2. Navigate to **Settings -> API Management**\n3. If the secret key has not already been created, press the **Create** button to create the secret key\n4. To access the secret key, press the **Show** button\n5. The secret key can now be copied and used during the Armis Audit Logs connector configuration"
+ }
+ }
+ ]
+ },
+ {
+ "title": "STEP 2 - Connect Armis Audit Logs to Microsoft Sentinel",
+ "description": "Provide the following details to start collecting Armis audit logs:\n\n1. **Armis Base URL** - The URL of your Armis instance, for example `https://your-tenant.armis.com`, without a trailing slash.\n2. **Armis Secret Key** - The API secret key created in STEP 1.",
+ "instructions": [
+ {
+ "type": "Textbox",
+ "parameters": {
+ "label": "Armis Base URL",
+ "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)",
+ "type": "text",
+ "name": "armisBaseUrl",
+ "validations": {
+ "required": true
+ }
+ }
+ },
+ {
+ "type": "Textbox",
+ "parameters": {
+ "label": "Armis Secret Key",
+ "placeholder": "Enter your Armis Secret Key",
+ "type": "password",
+ "name": "armisSecretKey",
+ "validations": {
+ "required": true
+ }
+ }
+ },
+ {
+ "parameters": {
+ "label": "toggle",
+ "name": "toggle"
+ },
+ "type": "ConnectionToggleButton"
+ }
+ ]
+ },
+ {
+ "title": "STEP 3 - Validate data collection",
+ "description": "Confirm that Armis audit logs are flowing into Microsoft Sentinel.",
+ "instructions": [
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "1. **Check the connection status**: Once connected, the connector shows as **Connected** on this page.\n2. **Validate the data**: Use the sample queries on this page to confirm that audit logs are being received. The connector polls every 15 minutes, so the first logs can take a few minutes to appear."
+ }
+ }
+ ]
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition3'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition3')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "Armis",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Armis Corporation",
+ "email": "support@armis.com",
+ "tier": "Partner",
+ "link": "https://support.armis.com/"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections3')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections3'), variables('dataConnectorCCPVersion'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnections3')]",
+ "displayName": "Armis Audit Logs (via Codeless Connector Framework)",
+ "contentKind": "ResourcesDataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorCCPVersion')]",
+ "parameters": {
+ "guidValue": {
+ "defaultValue": "[[newGuid()]",
+ "type": "securestring"
+ },
+ "innerWorkspace": {
+ "defaultValue": "[parameters('workspace')]",
+ "type": "securestring"
+ },
+ "connectorDefinitionName": {
+ "defaultValue": "Armis Audit Logs (via Codeless Connector Framework)",
+ "type": "securestring",
+ "minLength": 1
+ },
+ "workspace": {
+ "defaultValue": "[parameters('workspace')]",
+ "type": "securestring"
+ },
+ "dcrConfig": {
+ "defaultValue": {
+ "dataCollectionEndpoint": "data collection Endpoint",
+ "dataCollectionRuleImmutableId": "data collection rule immutableId"
+ },
+ "type": "object"
+ },
+ "armisBaseUrl": {
+ "defaultValue": "armisBaseUrl",
+ "type": "securestring",
+ "minLength": 1
+ },
+ "armisSecretKey": {
+ "defaultValue": "armisSecretKey",
+ "type": "securestring",
+ "minLength": 1
+ }
+ },
+ "variables": {
+ "_dataConnectorContentIdConnections3": "[variables('_dataConnectorContentIdConnections3')]"
+ },
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections3')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections3'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnections3')]",
+ "kind": "ResourcesDataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "Armis",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Armis Corporation",
+ "email": "support@armis.com",
+ "tier": "Partner",
+ "link": "https://support.armis.com/"
+ }
+ }
+ },
+ {
+ "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'ArmisAuditLogPoller', parameters('guidValue'))]",
+ "apiVersion": "2023-02-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "RestApiPoller",
+ "properties": {
+ "connectorDefinitionName": "ArmisAuditLogCCPConnectorDefinition",
+ "dcrConfig": {
+ "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
+ "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
+ "streamName": "Custom-ArmisAuditLog_CL"
+ },
+ "dataType": "ArmisAuditLog_CL",
+ "auth": {
+ "type": "APIKey",
+ "apiKey": "[[parameters('armisSecretKey')]",
+ "apiKeyName": "secret_key"
+ },
+ "request": {
+ "apiEndpoint": "[[concat(parameters('armisBaseUrl'), '/api/v1/access_token/')]",
+ "httpMethod": "POST",
+ "rateLimitQPS": 2,
+ "retryCount": 3,
+ "timeoutInSeconds": 120,
+ "queryWindowInMin": 15,
+ "headers": {
+ "Accept": "application/json",
+ "User-Agent": "Sentinel-ArmisAuditLog"
+ },
+ "queryParameters": {
+ "secret_key": "[[parameters('armisSecretKey')]"
+ }
+ },
+ "response": {
+ "eventsJsonPaths": [
+ "$.data"
+ ],
+ "format": "json"
+ },
+ "stepInfo": {
+ "stepType": "Nested",
+ "nextSteps": [
+ {
+ "stepId": "fetchArmisAuditLog",
+ "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project access_token = tostring(res.access_token)"
+ }
+ ]
+ },
+ "stepCollectorConfigs": {
+ "fetchArmisAuditLog": {
+ "shouldJoinNestedData": false,
+ "auth": {
+ "AuthType": "APIKey",
+ "APIKey": "$access_token$",
+ "APIKeyName": "Authorization"
+ },
+ "request": {
+ "apiEndpoint": "[[concat(parameters('armisBaseUrl'), '/api/v1/search/')]",
+ "httpMethod": "GET",
+ "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss",
+ "queryParameters": {
+ "aql": "in:auditLog timeFrame:\"16 Minutes\"",
+ "orderBy": "time",
+ "includeTotal": "true"
+ },
+ "headers": {
+ "Accept": "application/json",
+ "User-Agent": "Sentinel-ArmisAuditLog",
+ "Authorization": "$access_token$"
+ },
+ "rateLimitQPS": 2,
+ "paginatedCallsPerSecond": 2,
+ "retryCount": 3,
+ "timeoutInSeconds": 60
+ },
+ "paging": {
+ "pagingType": "NextPageToken",
+ "nextPageTokenJsonPath": "$.data.next",
+ "nextPageParaName": "from",
+ "pageSize": 10000,
+ "pageSizeParaName": "length"
+ },
+ "response": {
+ "eventsJsonPaths": [
+ "$.data.results"
+ ],
+ "format": "json"
+ }
+ }
+ },
+ "isActive": true
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections3'),'-', variables('dataConnectorCCPVersion'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ }
+ },
{
"type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
"apiVersion": "2023-04-01-preview",
@@ -1225,7 +2051,7 @@
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
],
"properties": {
- "description": "ArmisUpdateAlertStatus Playbook with template version 3.2.0",
+ "description": "ArmisUpdateAlertStatus Playbook with template version 3.3.0",
"mainTemplate": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "[variables('playbookVersion1')]",
@@ -1727,7 +2553,7 @@
"sourceId": "[variables('_solutionId')]"
},
"author": {
- "name": "{Armis",
+ "name": "Armis",
"email": "[variables('_email')]"
},
"support": {
@@ -1789,12 +2615,12 @@
"apiVersion": "2023-04-01-preview",
"location": "[parameters('workspace-location')]",
"properties": {
- "version": "3.2.0",
+ "version": "3.3.0",
"kind": "Solution",
"contentSchemaVersion": "3.0.0",
"displayName": "Armis",
"publisherDisplayName": "Armis Corporation",
- "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Armis Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.
\nData Connectors: 2, Parsers: 3, Playbooks: 1
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Armis Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.
\nData Connectors: 3, Parsers: 4, Playbooks: 1
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1807,7 +2633,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -1834,6 +2660,11 @@ "contentId": "[variables('parserObject3').parserContentId3]", "version": "[variables('parserObject3').parserVersion3]" }, + { + "kind": "Parser", + "contentId": "[variables('parserObject4').parserContentId4]", + "version": "[variables('parserObject4').parserVersion4]" + }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", @@ -1844,6 +2675,11 @@ "contentId": "[variables('_dataConnectorContentId2')]", "version": "[variables('dataConnectorVersion2')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections3')]", + "version": "[variables('dataConnectorCCPVersion')]" + }, { "kind": "Playbook", "contentId": "[variables('_ArmisUpdateAlertStatus')]", diff --git a/Solutions/Armis/Package/testParameters.json b/Solutions/Armis/Package/testParameters.json index e55ec41a9ac..554801e41b7 100644 --- a/Solutions/Armis/Package/testParameters.json +++ b/Solutions/Armis/Package/testParameters.json @@ -20,5 +20,19 @@ "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } } diff --git a/Solutions/Armis/Parsers/ArmisAuditLogs.yaml b/Solutions/Armis/Parsers/ArmisAuditLogs.yaml new file mode 100644 index 00000000000..36ab34c0451 --- /dev/null +++ b/Solutions/Armis/Parsers/ArmisAuditLogs.yaml @@ -0,0 +1,36 @@ +id: f9ed5836-f370-4656-a996-3df1f91d9b0f +Function: + Title: Parser for ArmisAuditLogs + Version: '1.0.0' + LastUpdated: '2026-10-29' +Category: Microsoft Sentinel Parser +FunctionName: ArmisAuditLogs +FunctionAlias: ArmisAuditLogs +FunctionQuery: | + let ArmisAuditLogs_view = view () { + ArmisAuditLog_CL + | extend + EventVendor="ArmisAuditLogs", + EventProduct="ArmisAuditLogs", + Action = column_ifexists('action', ''), + AdditionalInfo = column_ifexists('additionalInfo', ''), + EventTime = column_ifexists('eventTime', ''), + Id = column_ifexists('id', ''), + TimeUtc = column_ifexists('timeUtc', ''), + Trigger = column_ifexists('trigger', ''), + User = column_ifexists('user', ''), + UserIp = column_ifexists('userIp', '') + | project + TimeGenerated, + EventVendor, + EventProduct, + Action, + AdditionalInfo, + EventTime, + Id, + TimeUtc, + Trigger, + User, + UserIp + }; + ArmisAuditLogs_view diff --git a/Solutions/Armis/ReleaseNotes.md b/Solutions/Armis/ReleaseNotes.md index 352fb9c5ea7..a5e4395832f 100644 --- a/Solutions/Armis/ReleaseNotes.md +++ b/Solutions/Armis/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.3.0 | 23-10-2026 | Added Armis Audit Logs data connector (via Codeless Connector Framework) (Preview).| | 3.2.0 | 05-12-2025 | Log Ingestion Support.| | 3.1.1 | 19-05-2025 | Updated Armis AlertActivity and Armis Device Data connectors to add keyvault for storing Armis Access Token and Severity parameter in AlertActivity.| | 3.1.0 | 11-09-2024 | Updated Armis Alerts Data connector to ingest Armis Activities associated with only Armis Alerts.|