Armis Centrix API

Overview

This API is for managing threats to an organization identified by Abnormal Security. The organization should be integrated with Abnormal Security and enabled for real-time detection of malicious emails.

This API uses Bearer authentication to retrieve events through paginated API calls.

Configuration

Parameters

• API endpoint - Domain (domain)

Secrets

• Secret key (armis_key)

Open the Secret fields and click New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

Learn more about secrets in Onum in this article.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the fields, or simply paste the given YAML:

Config as YAML

Toggle this ON to enable a free text field where you can paste your YAML.

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: "2006-01-02T15:04:05"
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: ${parameters.domain}/api/v1/access_token/
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
        - name: Accept
          value: application/json
      bodyType: urlEncoded
      bodyParams:
        - name: secret_key
          value: ${secrets.armis_key}
    tokenPath: ".data.access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: ''
      suffix: ''
withEnumerationPhase: false
collectionPhase:
  paginationType: offsetLimit
  limit: 200
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/api/v1/search/
    queryParams:
      - name: aql
        value: in:alerts after:${temporalWindow.from} before:${temporalWindow.to}
      - name: from
        value: ${pagination.offset}
      - name: length
        value: ${pagination.limit}
  output:
    select: ".data.results"
    map: "."
    outputMode: element

Manually configure

Click Create labels to move on to the next step and define the required Labels if needed.