Armis
You can integrate Armis with Sophos XDR so that it sends data to Sophos for analysis.
This page gives you an overview of the integration.
Armis product overview
Armis is an asset intelligence and security platform that provides visibility and security for all connected devices, including IoT, OT, and medical devices. It helps organizations discover, monitor, and secure their entire asset landscape, reducing cyber risk and ensuring operational resilience.
What we ingest
Sophos XDR collects Armis data over HTTPS by polling the Armis API. The following log categories are collected:
- Security alerts: Armis alerts raised for threats and risks detected across your connected devices.
Event and data types
All Armis events are normalized uniformly to third-party security alert telemetry. They include:
- Security alerts: Armis security alerts, including the alert type, threat name and type, severity, affected devices, and MITRE ATT&CK mapping.
Data provided by this integration
Data provided by Armis gets normalized to the following schemas:
thirdpartyalert
For more information about using schemas in Data Lake Search, see Schemas and logical types.