[Armis][CCF] - Audit Log Data Connector

.script/tests/KqlvalidationsTests/CustomTables/ArmisAuditLog_CL.json

@@ -0,0 +1,41 @@
+{
+    "Name": "ArmisAuditLog_CL",
+    "Properties": [
+        {
+            "Name": "TimeGenerated",
+            "Type": "datetime"
+        },
+        {
+            "Name": "id",
+            "Type": "real"
+        },
+        {
+            "Name": "eventTime",
+            "Type": "datetime"
+        },
+        {
+            "Name": "timeUtc",
+            "Type": "datetime"
+        },
+        {
+            "Name": "action",
+            "Type": "string"
+        },
+        {
+            "Name": "additionalInfo",
+            "Type": "dynamic"
+        },
+        {
+            "Name": "trigger",
+            "Type": "string"
+        },
+        {
+            "Name": "user",
+            "Type": "string"
+        },
+        {
+            "Name": "userIp",
+            "Type": "string"
+        }
+    ]
+}

Sample Data/Custom/Armis/ArmisAuditLog_IngestedLogs.csv

@@ -0,0 +1,6 @@
+TimeGenerated [UTC],id,eventTime,timeUtc,action,additionalInfo,trigger,user,userIp,TenantId,Type,_ResourceId
+"10/23/2026, 9:30:32.481 AM",1001,"10/23/2026, 9:15:32.481 AM","10/23/2026, 9:15:32.481 AM",User logged in,"{""authMethod"":""SAML""}",Web UI,admin@example.com,192.0.2.10,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL,
+"10/23/2026, 9:33:05.220 AM",1002,"10/23/2026, 9:18:05.220 AM","10/23/2026, 9:18:05.220 AM",API secret key viewed,"{""keyName"":""sentinel-integration""}",Web UI,admin@example.com,192.0.2.10,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL,
+"10/23/2026, 9:39:47.903 AM",1003,"10/23/2026, 9:24:47.903 AM","10/23/2026, 9:24:47.903 AM",Policy created,"{""policyName"":""Block Unmanaged Devices"",""policyId"":42}",Web UI,secops@example.com,198.51.100.23,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL,
+"10/23/2026, 9:46:12.045 AM",1004,"10/23/2026, 9:31:12.045 AM","10/23/2026, 9:31:12.045 AM",User role changed,"{""targetUser"":""analyst@example.com"",""newRole"":""Read Only""}",API,secops@example.com,198.51.100.23,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL,
+"10/23/2026, 9:55:59.667 AM",1005,"10/23/2026, 9:40:59.667 AM","10/23/2026, 9:40:59.667 AM",User logged out,{},Web UI,admin@example.com,192.0.2.10,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL,

Sample Data/Custom/Armis/ArmisAuditLog_RawLogs.json

@@ -0,0 +1,71 @@
+{
+  "data": {
+    "count": 5,
+    "next": null,
+    "prev": null,
+    "results": [
+      {
+        "id": 1001,
+        "time": "2026-10-23T09:15:32.481922+00:00",
+        "timeUtc": "2026-10-23T09:15:32.481922",
+        "action": "User logged in",
+        "additionalInfo": {
+          "authMethod": "SAML"
+        },
+        "trigger": "Web UI",
+        "user": "admin@example.com",
+        "userIp": "192.0.2.10"
+      },
+      {
+        "id": 1002,
+        "time": "2026-10-23T09:18:05.220117+00:00",
+        "timeUtc": "2026-10-23T09:18:05.220117",
+        "action": "API secret key viewed",
+        "additionalInfo": {
+          "keyName": "sentinel-integration"
+        },
+        "trigger": "Web UI",
+        "user": "admin@example.com",
+        "userIp": "192.0.2.10"
+      },
+      {
+        "id": 1003,
+        "time": "2026-10-23T09:24:47.903551+00:00",
+        "timeUtc": "2026-10-23T09:24:47.903551",
+        "action": "Policy created",
+        "additionalInfo": {
+          "policyName": "Block Unmanaged Devices",
+          "policyId": 42
+        },
+        "trigger": "Web UI",
+        "user": "secops@example.com",
+        "userIp": "198.51.100.23"
+      },
+      {
+        "id": 1004,
+        "time": "2026-10-23T09:31:12.045880+00:00",
+        "timeUtc": "2026-10-23T09:31:12.045880",
+        "action": "User role changed",
+        "additionalInfo": {
+          "targetUser": "analyst@example.com",
+          "newRole": "Read Only"
+        },
+        "trigger": "API",
+        "user": "secops@example.com",
+        "userIp": "198.51.100.23"
+      },
+      {
+        "id": 1005,
+        "time": "2026-10-23T09:40:59.667204+00:00",
+        "timeUtc": "2026-10-23T09:40:59.667204",
+        "action": "User logged out",
+        "additionalInfo": {},
+        "trigger": "Web UI",
+        "user": "admin@example.com",
+        "userIp": "192.0.2.10"
+      }
+    ],
+    "total": 5
+  },
+  "success": true
+}

Sample Data/Custom/Armis/ArmisAuditLog_Schema.csv

@@ -0,0 +1,13 @@
+ColumnName,ColumnOrdinal,DataType,ColumnType
+TimeGenerated,0,System.DateTime,datetime
+id,1,System.Double,real
+eventTime,2,System.DateTime,datetime
+timeUtc,3,System.DateTime,datetime
+action,4,System.String,string
+additionalInfo,5,System.Object,dynamic
+trigger,6,System.String,string
+user,7,System.String,string
+userIp,8,System.String,string
+TenantId,9,System.String,string
+Type,10,System.String,string
+_ResourceId,11,System.String,string

Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json

@@ -0,0 +1,132 @@
+{
+  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+  "apiVersion": "2022-09-01-preview",
+  "name": "ArmisAuditLogCCPConnectorDefinition",
+  "location": "{{location}}",
+  "kind": "Customizable",
+  "properties": {
+    "connectorUiConfig": {
+      "id": "ArmisAuditLogCCPConnectorDefinition",
+      "title": "Armis Audit Logs (via Codeless Connector Framework)",
+      "publisher": "Armis",
+      "descriptionMarkdown": "The [Armis](https://www.armis.com/) Audit Logs data connector enables you to ingest audit logs from your Armis instance into Microsoft Sentinel through the Armis REST API using the Codeless Connector Framework (CCF). The connector polls for new audit logs every 15 minutes.",
+      "graphQueriesTableName": "ArmisAuditLog_CL",
+      "graphQueries": [
+        {
+          "metricName": "Total Audit Logs Ingested",
+          "legend": "Armis Audit Logs",
+          "baseQuery": "ArmisAuditLog_CL"
+        }
+      ],
+      "sampleQueries": [
+        {
+          "description": "Get a sample of Armis Audit Logs",
+          "query": "ArmisAuditLog_CL\n| take 10"
+        }
+      ],
+      "dataTypes": [
+        {
+          "name": "ArmisAuditLog_CL",
+          "lastDataReceivedQuery": "ArmisAuditLog_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+        }
+      ],
+      "connectivityCriteria": [
+        {
+          "type": "HasDataConnectors",
+          "value": null
+        }
+      ],
+      "availability": {
+        "isPreview": true
+      },
+      "permissions": {
+        "resourceProvider": [
+          {
+            "provider": "Microsoft.OperationalInsights/workspaces",
+            "permissionsDisplayText": "Read and Write permissions are required.",
+            "providerDisplayName": "Workspace",
+            "scope": "Workspace",
+            "requiredPermissions": {
+              "write": true,
+              "read": true,
+              "delete": true
+            }
+          }
+        ],
+        "customs": [
+          {
+            "name": "Armis Base URL",
+            "description": "The URL of your Armis instance (for example, https://your-tenant.armis.com)."
+          },
+          {
+            "name": "Armis Secret Key",
+            "description": "An Armis API secret key, created in Armis under Settings -> API Management."
+          }
+        ]
+      },
+      "instructionSteps": [
+        {
+          "title": "STEP 1 - Configuration steps for the Armis API",
+          "description": "Follow these instructions to create an Armis API secret key.",
+          "instructions": [
+            {
+              "type": "Markdown",
+              "parameters": {
+                "content": "1. Log into your Armis instance\n2. Navigate to **Settings -> API Management**\n3. If the secret key has not already been created, press the **Create** button to create the secret key\n4. To access the secret key, press the **Show** button\n5. The secret key can now be copied and used during the Armis Audit Logs connector configuration"
+              }
+            }
+          ]
+        },
+        {
+          "title": "STEP 2 - Connect Armis Audit Logs to Microsoft Sentinel",
+          "description": "Provide the following details to start collecting Armis audit logs:\n\n1. **Armis Base URL** - The URL of your Armis instance, for example `https://your-tenant.armis.com`, without a trailing slash.\n2. **Armis Secret Key** - The API secret key created in STEP 1.",
+          "instructions": [
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "Armis Base URL",
+                "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)",
+                "type": "text",
+                "name": "armisBaseUrl",
+                "validations": {
+                  "required": true
+                }
+              }
+            },
+            {
+              "type": "Textbox",
+              "parameters": {
+                "label": "Armis Secret Key",
+                "placeholder": "Enter your Armis Secret Key",
+                "type": "password",
+                "name": "armisSecretKey",
+                "validations": {
+                  "required": true
+                }
+              }
+            },
+            {
+              "parameters": {
+                "label": "toggle",
+                "name": "toggle"
+              },
+              "type": "ConnectionToggleButton"
+            }
+          ]
+        },
+        {
+          "title": "STEP 3 - Validate data collection",
+          "description": "Confirm that Armis audit logs are flowing into Microsoft Sentinel.",
+          "instructions": [
+            {
+              "type": "Markdown",
+              "parameters": {
+                "content": "1. **Check the connection status**: Once connected, the connector shows as **Connected** on this page.\n2. **Validate the data**: Use the sample queries on this page to confirm that audit logs are being received. The connector polls every 15 minutes, so the first logs can take a few minutes to appear."
+              }
+            }
+          ]
+        }
+      ]
+    }
+  }
+}

Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_DCR.json

@@ -0,0 +1,69 @@
+[
+  {
+    "name": "ArmisAuditLogDCR",
+    "apiVersion": "2021-09-01-preview",
+    "type": "Microsoft.Insights/dataCollectionRules",
+    "location": "{{location}}",
+    "properties": {
+      "dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
+      "streamDeclarations": {
+        "Custom-ArmisAuditLog_CL": {
+          "columns": [
+            {
+              "name": "id",
+              "type": "real"
+            },
+            {
+              "name": "time",
+              "type": "datetime"
+            },
+            {
+              "name": "timeUtc",
+              "type": "datetime"
+            },
+            {
+              "name": "action",
+              "type": "string"
+            },
+            {
+              "name": "additionalInfo",
+              "type": "dynamic"
+            },
+            {
+              "name": "trigger",
+              "type": "string"
+            },
+            {
+              "name": "user",
+              "type": "string"
+            },
+            {
+              "name": "userIp",
+              "type": "string"
+            }
+          ]
+        }
+      },
+      "destinations": {
+        "logAnalytics": [
+          {
+            "workspaceResourceId": "{{workspaceResourceId}}",
+            "name": "clv2ws1"
+          }
+        ]
+      },
+      "dataFlows": [
+        {
+          "streams": [
+            "Custom-ArmisAuditLog_CL"
+          ],
+          "destinations": [
+            "clv2ws1"
+          ],
+          "transformKql": "source | extend TimeGenerated = now() | project-rename eventTime = ['time']",
+          "outputStream": "Custom-ArmisAuditLog_CL"
+        }
+      ]
+    }
+  }
+]