ARMSCyber

Purpose

The integration uses an ARMS Console email address and password to obtain a short-lived JSON Web Token (JWT). AirMDR automatically re-authenticates when the token expires.

Supported Versions

Component	Supported version
ARMS Cyber	Current cloud-hosted ARMS Cyber Console
ARMS API	GraphQL API exposed through the ARMS Console
AirMDR	AirMDR cloud integration supporting ARMS Cyber
Transport protocol	HTTPS

Contact the AirMDR Integration team before configuring a self-hosted, private, or region-specific ARMS deployment.

ARMS Cyber is delivered as a cloud service. A publicly documented product-version compatibility matrix is not currently available.

Authentication

The integration requires the following values:

AirMDR field	Source	Example
Base URL	ARMS Console URL assigned to your organization	`https://console.armscyber.app`
Email	Email address of the dedicated ARMS Console user	`airmdr-integration@example.com`
Password	Password configured for the dedicated user	Stored securely; never add it to documentation
GraphQL endpoint	Added automatically by AirMDR	`<base-url>/graphql`

Enter only the ARMS Console Base URL. Do not add /login, /security, or /graphql unless instructed by the AirMDR Integration team.

Role-based access requirements

Assign a required role (For example: read-only) for integrations that retrieve tenant, device, and event information.
Assign the user to every tenant that AirMDR must monitor.
Do not grant tenant-management or user-management permissions.
Grant device-update permission only if the update_arms_device_status skill will be used.
Do not grant tenant-creation or user-creation permissions because AirMDR does not use those API operations.

Pre-requisites

Users must have Administrator access to the ARMS Cyber UI with sufficient privileges to create users and assign roles.

An active ARMS Cyber tenant and access to the ARMS Cyber Console.

Setup Steps

Open the ARMS Console URL provided during your ARMS Cyber onboarding. For example: https://console.armscyber.app
The ARMS login page displays the following options:
- Email Address
- Password
- Login
- Login with SSO
Sign in using an ARMS administrator account.
The URL https://armscyber.ai/security/ is the public ARMS Security Statement page. It is not the Base URL for this integration.

Copy the Base URL

The Base URL is the root address of the ARMS Console. It is not created separately.

After signing in, review the URL in the browser address bar.
Copy only the scheme and hostname.

Remove any page path, query parameter, or trailing slash.
For example:

Console address displayed in browser	Base URL to enter
`https://console.armscyber.app/login?redirect_to=/`	`https://console.armscyber.app`
`https://arms.example.com/devices`	`https://arms.example.com`
`https://arms.example.com/tenants/123`	`https://arms.example.com`

Do not enter:
https://armscyber.ai/security/ https://console.armscyber.app/login https://console.armscyber.app/graphql

Create a dedicated AirMDR UserName - ARMS user management

In the ARMS Console, open the administration or settings menu.
Select the option used to manage console users. Depending on the ARMS Console version, this option may appear as:
- Users
- User Management
- Access Management
- Organization Settings
Select Add User, Create User, or Invite User.
SME confirmation required: Verify the exact navigation path and button names in an authenticated ARMS tenant before publication.
In the user-creation screen, enter a recognizable name. For example: AirMDR Integration.
Enter a dedicated email address. For example: airmdr-integration@example.com
Avoid using an individual employee’s email address.
Assign the user to every ARMS tenant that AirMDR must query.
Select a read-only role or the least-privileged equivalent.
Create or invite the user.
Queries return only the tenants assigned to this user. When no tenant is specified, some device and event queries may use the user’s first assigned tenant.

Configure the password

The password configuration depends on how ARMS creates users.

If ARMS sends an invitation

Open the invitation sent to the dedicated integration mailbox.
Follow the activation link.
Create a strong, unique password.
Store the password in an approved enterprise password manager.

If the administrator sets the password

Enter a strong, unique initial password.
Save the user.
Complete any mandatory first-login password change before configuring AirMDR.
Store the final password in an approved password manager.
If ARMS requires SSO-only authentication for the user, confirm with ARMS whether password-based API authentication can be enabled for a dedicated service user. The AirMDR connection form requires an email address and password.

Verify the dedicated user created for AirMDR

Sign out of the administrator account.
Open the ARMS Console login page.
Enter the dedicated user’s email address and password.
Select Login.
Confirm that the user can view the required tenants.
Confirm that the user cannot access unnecessary administrative operations.
Sign out after completing the verification.

ARMS Cyber Credential Reference Table

AirMDR Field	What to Enter	Where to Get It in the ARMS Cyber UI	Example
Base URL	Root URL of your ARMS Cyber Console. Do not include `/login`, `/graphql`, or other paths.	Sign in to the ARMS Cyber Console and copy the scheme and hostname from the browser address bar.	`https://console.armscyber.app`
Email	Email address of the dedicated ARMS Console user created for AirMDR.	In the ARMS Cyber Console, navigate to Administration/Settings → Users and open the dedicated AirMDR user.	`airmdr-integration@example.com`
Password	Password configured for the dedicated ARMS Console user.	Set during user creation or through the invitation/activation email. The password is not displayed later in the ARMS Cyber UI.	`••••••••••••`

AirMDR automatically adds the /graphql endpoint to the Base URL. The exact user-management navigation labels may vary depending on the ARMS Cyber Console version.

Configure Tines in AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select ADMIN → Integrations.
Use the search option, enter the keyword “ARMS Cyber”, select the Connections tab, and click + New Connection button.

Use the following values in the AirMDR integration configuration screen:

AirMDR Field	Description	Example
Instance	Unique name for the ARMS Cyber connection	`ARMS-Cyber-Production`
Organization	AirMDR organization associated with the integration	`AirMDR Organization`
Description	Purpose of the connection	`ARMS Cyber production integration`
Base URL	Root URL of the ARMS Cyber Console. Do not include `/login` or `/graphql`.	`https://console.armscyber.app`
Email	Email address of the dedicated ARMS Console user created for AirMDR	`airmdr-integration@example.com`
Password	Password configured for the dedicated ARMS Console user	`<ARMS_USER_PASSWORD>`

Expand Advanced Configuration if required. (Optional)

In Remote Agent, select an AirMDR Remote Agent only when the ARMS Cyber Console is self-hosted, privately accessible, or must be reached through an approved private network route.
In Expiry, select the date on which AirMDR should treat the stored ARMS Cyber credentials as expired, according to your organization’s password-rotation policy..

The AirMDR Expiry setting is a connection-management control. It does not automatically change or rotate the password of the dedicated user in ARMS Cyber.

After rotating the password in ARMS Cyber, update the connection with the new password in AirMDR.

Click Save.

Skills provided by this Integration

Tenant and Device Discovery

Skill	Description	Access Type
Get ARMS Tenants	Lists the ARMS tenants available to the authenticated user, including licence status, subscription details, and user and device limits. Use this skill to obtain the tenant UUID required by tenant-scoped device and event skills.	Read-only
Get ARMS Devices	Retrieves ARMS devices and their agent status. Use this skill to resolve a hostname or IP address to a device UUID, review the installed agent and operating-system versions, or identify devices that have stopped reporting based on their last heartbeat.	Read-only

Threat Investigation and Monitoring

Skill	Description	Access Type
Get ARMS Events	Searches ARMS security events for a tenant or device. The skill supports full-text searches across event descriptions using values such as hostname, process name, file path, or file hash. It returns information including severity, category, threat type, mitigation status, and affected host.	Read-only
Get ARMS Device Actions	Lists actions performed by ARMS on devices, including file-restoration jobs and agent commands, with their current status. Use this skill to confirm whether remediation completed or identify actions that remain scheduled or in progress.	Read-only

Device Response Actions

Skill	Description	Access Type
Update ARMS Device Status	Enables or disables a device in ARMS. Disabling a device stops ARMS from managing the associated agent. Verify the device UUID using Get ARMS Devices before running this skill.	Read and write

This skill changes the device state in the ARMS Console. Grant the integration user permission to update devices only when this response capability is required.

Advanced GraphQL Operations

Skill	Description	Access Type
Execute ARMS GraphQL Query	Runs a custom query or mutation against the ARMS Console GraphQL endpoint. Use it to access supported schema objects or fields that are not covered by the standard ARMS skills, such as users, user roles, event types, observable groups, or custom field selections.	Depends on the query or mutation

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → ARMS Cyber Integration page.
Select the Skills tab and click on the required listed skills.

Additional Information

🧰 Error Handling

Error	Possible cause	Resolution
Authentication failed	Incorrect email or password	Verify the dedicated user credentials and update the AirMDR connection
Unable to connect	Incorrect Base URL or blocked HTTPS traffic	Enter only the root console URL and allow outbound TCP 443
Endpoint not found	`/graphql` was manually added or the URL contains another path	Remove `/graphql`, `/login`, and other paths from the Base URL
No tenant data returned	User is not assigned to the required tenant	Update the user’s tenant memberships in ARMS
Partial data returned	User can access only some required tenants	Compare the assigned tenants with the intended integration scope
Permission denied	The assigned role lacks a required read permission	Add only the missing permission and retest
Device-status update fails	User has read-only access	Grant device-update permission only when this action is required
Login works but API authentication fails	SSO-only account or API authentication restriction	Confirm password-based API access with ARMS Support
Connection stopped after password rotation	AirMDR contains the old password	Update the saved AirMDR connection immediately after rotation
Account disabled or locked	Failed logins, policy enforcement, or account deactivation	Reactivate or unlock the dedicated user and test the connection

🔄 Monitoring & Logs

AirMDR monitoring

Review the connection status and execution history in the AirMDR integration interface. Monitor for:

Authentication failures
Connection timeouts
GraphQL request failures
Insufficient-permission errors
Missing tenant or device data
Device-update failures

ARMS monitoring

Review the ARMS Console audit or activity logs, if available for the assigned role and subscription. Search for:

Login attempts by the dedicated AirMDR user
API authentication activity
Requests associated with the integration user
Role or tenant-membership changes

ARMS states that it monitors and logs various cloud services, but the public Security Statement does not identify a customer-facing log location.

Illustrative log entries

The following examples are illustrative. Actual AirMDR log formats may differ:

INFO  ARMS authentication completed successfully
INFO  ARMS GraphQL request completed tenant_id=<tenant-id>
WARN  ARMS tenant not accessible to the configured user
ERROR ARMS authentication failed: invalid credentials
ERROR ARMS GraphQL request failed: insufficient permissions

🛑 Security & Access Best Practices

✅ Do

Create a dedicated ARMS Console user for AirMDR.
Apply least-privilege access.
Use read-only access unless device-status updates are required.
Assign only the tenants that AirMDR must access.
Store the password in an approved enterprise password manager.
Use a strong, unique password.
Rotate credentials according to organizational policy.
Use HTTPS endpoints only.
Remove credentials from screenshots and diagnostic logs.
Review access periodically.

❌ Don’t

Using a personal employee account.
Sharing credentials across multiple integrations.
Granting user-management or tenant-management permissions.
Entering the public ARMS website or Security Statement URL as the Base URL.
Manually adding /login or /graphql to the Base URL.
Sending passwords through email, Slack, or support tickets.
Logging passwords, JWTs, or session information.
Granting device-update access when only read operations are required.

👉 Support & Maintenance

📧 Contact AirMDR Support through your designated support channel.
🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
🔄 Reconnect in AirMDR immediately when secrets are changed.

🛑 Data Flow & Security

Data flow

Direction	Data exchanged
AirMDR → Tines	Authenticated API requests required by the selected Tines skill
Tines → AirMDR	API responses containing permitted team, story, case, event, record, status, or execution information
AirMDR → Tines	Create, update, or execution requests only when supported by the selected skill and permitted by the API key

The exact information exchanged depends on the AirMDR skill being executed and the permissions assigned to the Tines API key.

Authentication flow

AirMDR sends an HTTPS request to the configured Tines tenant domain.
The Tines API key is supplied in the request authentication header.
Tines validates the key and its associated user, service account, team role, or tenant permissions.
Tines processes the request only when the key has access to the requested resource.
The API response is returned to AirMDR over HTTPS.

Encryption

Tines requires authenticated API communication over HTTPS.
Tines states that customer personal data is encrypted in transit using at least TLS 1.2.
Tines states that customer personal data stored at rest is encrypted using AES-256.
AirMDR should store the API key as a secret and must not expose it in skill inputs, logs, screenshots, or exported troubleshooting data.

Ports and endpoints

Requirement	Value
Protocol	HTTPS
Outbound port	TCP 443
Base endpoint	`https://<tenant-domain>`
API endpoint pattern	`https://<tenant-domain>/api/v1/...` or `/api/v2/...`
Authentication	Bearer token or `X-User-Token` header

No inbound connection from Tines is required for standard AirMDR-initiated API requests. If a supported workflow uses Tines webhooks, configure and secure the required inbound webhook separately

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Purpose

Supported Versions

Authentication

Pre-requisites

Setup Steps

If ARMS sends an invitation

If the administrator sets the password

ARMS Cyber Credential Reference Table

Configure Tines in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

AirMDR monitoring

ARMS monitoring

Illustrative log entries

✅ Do

❌ Don’t

Data flow

Authentication flow

Encryption

Ports and endpoints

​Purpose

​Supported Versions

​Authentication

​Pre-requisites

​Setup Steps

​If ARMS sends an invitation

​If the administrator sets the password

​ARMS Cyber Credential Reference Table

​Configure Tines in AirMDR Integrations Dashboard

​Skills provided by this Integration

​Additional Information

​AirMDR monitoring

​ARMS monitoring

​Illustrative log entries

​✅ Do

​❌ Don’t

​Data flow

​Authentication flow

​Encryption

​Ports and endpoints

Purpose

Supported Versions

Authentication

Pre-requisites

Setup Steps

If ARMS sends an invitation

If the administrator sets the password

ARMS Cyber Credential Reference Table

Configure Tines in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

AirMDR monitoring

ARMS monitoring

Illustrative log entries

✅ Do

❌ Don’t

Data flow

Authentication flow

Encryption

Ports and endpoints