Articles in this section

Integrating StorageGuard with Armis

Avatar
Oz Gabriely
  • Updated

[ Applies to ] StorageGuard 10.1 and later   /   Armis Centrix   /   Settings > Interfaces > Security Integrations

StorageGuard can enrich your Armis Centrix asset inventory with the security posture of your storage and backup systems. Each matching asset in Armis gets its configuration compliance level, the number of open findings, and a link to the full risk details in StorageGuard. Your security team sees storage and backup risk in the same inventory it already uses for every other device, without switching tools.

How the integration works

  1. StorageGuard connects to Armis on a schedule, on demand, or when triggered through the StorageGuard API.
  2. StorageGuard identifies the storage and backup assets in the Armis inventory that it also monitors.
  3. StorageGuard enriches each of those assets in Armis with the following information.
Information added What it tells you
Compliance level Whether the asset complies with your organization's target configuration baseline, industry hardening guidelines, and the standards, frameworks, and regulations that apply to it.
Finding counts The number of open vulnerabilities, security misconfigurations, and compliance findings StorageGuard has identified for the asset.
StorageGuard link A link to the asset's page in StorageGuard, where you can drill down into its risk level, findings, compliance, and baseline drift.

Note: StorageGuard only adds information to assets that already exist in Armis. It doesn't create or delete Armis assets.

Before you begin

  • An Armis Centrix tenant, and its URL.
  • An Armis user or service account for the integration, with API access and permission to read and update assets.
  • The API secret key for that account.
  • Outbound HTTPS access from the StorageGuard master server to your Armis tenant.
  • A StorageGuard account with administrative privileges.
  • Storage and backup systems already scanned by StorageGuard, so there is data to send.

Tip: Use a dedicated service account for the integration rather than a personal account, so the integration keeps working when people change roles.

Add the Armis integration

  1. In StorageGuard, go to the Settings tab and select Interfaces > Security Integrations.
  2. Click Add Security Integration.
  3. Fill in the fields as described in the following table.
  4. Select Enabled to activate the integration.
  5. Click Save.
Field Required Description
Name Required A name that identifies the integration.
Integration Type Required Select Armis.
Description Optional A description of the integration, for example which Armis tenant it connects to.
Enabled Optional Select to activate the integration. Clear it to pause synchronization without deleting the configuration.
Tenant URL Required The URL of your Armis Centrix tenant, for example https://yourcompany.armis.com.
Client ID (Email) Required The email address of the Armis user or service account the integration authenticates as.
Secret Key Required The API secret key for that account.
Enrich Devices Optional Select to add the compliance level, finding counts, and StorageGuard link to matching storage and backup assets in Armis. If you clear it, StorageGuard doesn't update Armis assets.

When data is synchronized

After you enable the integration, StorageGuard sends updated information to Armis:

  • On a schedule, as part of StorageGuard's scheduled analysis tasks.
  • On demand, when you run the synchronization manually.
  • Through the API, when your own automation triggers it.

The information in Armis reflects StorageGuard's most recent analysis. A finding you fix on a system stops being counted in Armis after the next scan and synchronization.

Verify the integration

  1. Run a synchronization, or wait for the next scheduled analysis to finish.
  2. In Armis Centrix, open a storage or backup asset that StorageGuard monitors.
  3. Confirm that the asset shows the StorageGuard compliance level and finding counts.
  4. Click the StorageGuard link and confirm that the asset's page opens in StorageGuard.

Edit, disable, or remove the integration

You manage the integration from Settings > Interfaces > Security Integrations:

  • Edit the integration to change its settings, for example to enter a new secret key after you rotate it in Armis.
  • Disable it by clearing Enabled. StorageGuard stops sending updates, and the configuration is kept.
  • Remove it to delete the configuration from StorageGuard.

Troubleshooting

Symptom Likely cause Resolution
StorageGuard can't authenticate to Armis The Client ID or Secret Key is wrong, or the secret key was revoked or rotated. Create a new secret key in Armis and update it in the integration.
StorageGuard can't connect to Armis The Tenant URL is wrong, or the master server can't reach it. Check the URL. Confirm that the master server allows outbound HTTPS to your tenant, including through any proxy.
No Armis assets are enriched The integration isn't enabled, Enrich Devices is cleared, no synchronization has run yet, or Armis has no assets that match the systems StorageGuard monitors. Check Enabled and Enrich Devices, run a synchronization, and confirm that the systems exist in the Armis inventory.
Some assets aren't enriched Those assets don't match a system StorageGuard monitors, or StorageGuard hasn't scanned them yet. Check that the system is on-boarded and has been scanned in StorageGuard.
The StorageGuard link doesn't open The user's browser can't reach the StorageGuard server, or the user has no StorageGuard account. Open the link from a network that can reach StorageGuard, and sign in with a StorageGuard account.

[ Still need help? ]

If assets still aren't enriched, submit a request and include the integration name, the error message, and the name of an asset that should have been enriched.

Related articles

Comments

0 comments

Please sign in to leave a comment.