Integrate Armis

You can integrate Armis with Sophos Central so that it sends data to Sophos for analysis.

This is an API-based integration. You need an API authorization key from Armis.

The key steps are as follows:

• Get a secret key and base URL from Armis.
• Configure an integration in Sophos Central.

Get a secret key and base URL from Armis

To get the secret key, do as follows:

1. Sign in to the Armis console.
2. Go to Settings > API management.
3. On the API Management page, click Create to create a secret key.
4. Click Show to show the key.
5. In API Secret Key, copy the key and save it. You'll need to use it later in Sophos Central.
6. Click OK.

The Armis base URL consists of your organization name or Armis instance name followed by the Armis domain. For example: https://my-organization.armis.com.

Next, you configure an integration in Sophos Central.

Configure an integration

To integrate Armis with Sophos Central, do as follows:

1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.

2. Click Armis.

   The Armis page opens. You can configure integrations here and see a list of any you've already configured.

3. In Data Ingest (Security Alerts), click Add Configuration.

   Note

   If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See Provide your domain and IP details.

4. In Integration steps, do as follows:

   1. Enter the Integration name and Integration description.
   2. Enter the Base URL you looked up earlier.
   3. Enter the Secret Key you got from Armis.

5. Click Save.

We create the integration and it appears in your list. If its status icon shows a green tick, your data will appear in the Sophos Data Lake after validation.