> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ARMSCyber

> The ARMS Cyber integration enables AirMDR to connect to the ARMS GraphQL API and retrieve security information associated with the tenants assigned to the integration user.

## Purpose

The integration uses an ARMS Console email address and password to obtain a short-lived JSON Web Token (JWT). AirMDR automatically re-authenticates when the token expires.

## Supported Versions

| Component          | Supported version                              |
| ------------------ | ---------------------------------------------- |
| ARMS Cyber         | Current cloud-hosted ARMS Cyber Console        |
| ARMS API           | GraphQL API exposed through the ARMS Console   |
| AirMDR             | AirMDR cloud integration supporting ARMS Cyber |
| Transport protocol | HTTPS                                          |

<Note>
  Contact the AirMDR Integration team before configuring a self-hosted, private, or region-specific ARMS deployment.
</Note>

<Info>
  ARMS Cyber is delivered as a cloud service. A publicly documented product-version compatibility matrix is not currently available.
</Info>

## Authentication

The integration requires the following values:

| AirMDR field         | Source                                           | Example                                        |
| -------------------- | ------------------------------------------------ | ---------------------------------------------- |
| **Base URL**         | ARMS Console URL assigned to your organization   | `https://console.armscyber.app`                |
| **Email**            | Email address of the dedicated ARMS Console user | `airmdr-integration@example.com`               |
| **Password**         | Password configured for the dedicated user       | Stored securely; never add it to documentation |
| **GraphQL endpoint** | Added automatically by AirMDR                    | `<base-url>/graphql`                           |

<Check>
  Enter only the ARMS Console Base URL. Do not add `/login`, `/security`, or `/graphql` unless instructed by the AirMDR Integration team.
</Check>

<Accordion title="Role-based access requirements">
  * Assign a required  role (For example: read-only) for integrations that retrieve tenant, device, and event information.
  * Assign the user to every tenant that AirMDR must monitor.
  * Do not grant tenant-management or user-management permissions.
  * Grant device-update permission only if the `update_arms_device_status` skill will be used.
  * Do not grant tenant-creation or user-creation permissions because AirMDR does not use those API operations.
</Accordion>

### Pre-requisites

> <Check>
>   Users must have Administrator access to the **ARMS Cyber** UI with sufficient privileges to create users and assign roles.
> </Check>
>
> <Check>
>   An active ARMS Cyber tenant and access to the **ARMS Cyber Console**.
> </Check>

## Setup Steps

<Steps>
  <Step title="Sign in to the ARMS Cyber Console">
    1. Open the ARMS Console URL provided during your ARMS Cyber onboarding. For example: [https://console.armscyber.app](https://console.armscyber.app)
    2. The ARMS login page displays the following options:
       * **Email Address**
       * **Password**
       * **Login**
       * **Login with SSO**
    3. Sign in using an ARMS administrator account.
           <Note>
             The URL `https://armscyber.ai/security/` is the public ARMS Security Statement page. It is not the Base URL for this integration.
           </Note>
  </Step>

  <Step title="Copy the Base URL">
    <Info>
      The Base URL is the root address of the ARMS Console. It is not created separately.
    </Info>

    1. After signing in, review the URL in the browser address bar.
    2. Copy only the scheme and hostname.
    3. Remove any page path, query parameter, or trailing slash.<br />For example:
       | Console address displayed in browser                | Base URL to enter               |
       | --------------------------------------------------- | ------------------------------- |
       | `https://console.armscyber.app/login?redirect_to=/` | `https://console.armscyber.app` |
       | `https://arms.example.com/devices`                  | `https://arms.example.com`      |
       | `https://arms.example.com/tenants/123`              | `https://arms.example.com`      |
           <Note>
             Do not enter:<br />[https://armscyber.ai/security/](https://armscyber.ai/security/)
             [https://console.armscyber.app/login](https://console.armscyber.app/login)
             [https://console.armscyber.app/graphql](https://console.armscyber.app/graphql)
           </Note>
  </Step>

  <Step title="Create a dedicated AirMDR UserName - ARMS user management">
    1. In the ARMS Console, open the administration or settings menu.
    2. Select the option used to manage console users.
       Depending on the ARMS Console version, this option may appear as:
       * **Users**
       * **User Management**
       * **Access Management**
       * **Organization Settings**
    3. Select **Add User**, **Create User**, or **Invite User**.
           <Check>
             **SME confirmation required:** Verify the exact navigation path and button names in an authenticated ARMS tenant before publication.
           </Check>
    4. In the user-creation screen, enter a recognizable name. For example: `AirMDR Integration`.
    5. Enter a dedicated email address. For example: [airmdr-integration@example.com](mailto:airmdr-integration@example.com)
    6. Avoid using an individual employee’s email address.
    7. Assign the user to every ARMS tenant that AirMDR must query.
    8. Select a read-only role or the least-privileged equivalent.
    9. Create or invite the user.
           <Note>
             Queries return only the tenants assigned to this user. When no tenant is specified, some device and event queries may use the user’s first assigned tenant.
           </Note>
  </Step>

  <Step title="Configure the password">
    The password configuration depends on how ARMS creates users.

    #### If ARMS sends an invitation

    1. Open the invitation sent to the dedicated integration mailbox.
    2. Follow the activation link.
    3. Create a strong, unique password.
    4. Store the password in an approved enterprise password manager.

    #### If the administrator sets the password

    1. Enter a strong, unique initial password.
    2. Save the user.
    3. Complete any mandatory first-login password change before configuring AirMDR.
    4. Store the final password in an approved password manager.
           <Note>
             If ARMS requires SSO-only authentication for the user, confirm with ARMS whether password-based API authentication can be enabled for a dedicated service user. The AirMDR connection form requires an email address and password.
           </Note>
  </Step>

  <Step title="Verify the dedicated user created for AirMDR">
    1. Sign out of the administrator account.
    2. Open the ARMS Console login page.
    3. Enter the dedicated user’s email address and password.
    4. Select **Login**.
    5. Confirm that the user can view the required tenants.
           <Check>
             Confirm that the user cannot access unnecessary administrative operations.
           </Check>
    6. Sign out after completing the verification.
  </Step>
</Steps>

### ARMS Cyber Credential Reference Table

| AirMDR Field | What to Enter                                                                             | Where to Get It in the ARMS Cyber UI                                                                                           | Example                          |
| ------------ | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------- |
| **Base URL** | Root URL of your ARMS Cyber Console. Do not include `/login`, `/graphql`, or other paths. | Sign in to the ARMS Cyber Console and copy the scheme and hostname from the browser address bar.                               | `https://console.armscyber.app`  |
| **Email**    | Email address of the dedicated ARMS Console user created for AirMDR.                      | In the ARMS Cyber Console, navigate to **Administration/Settings → Users** and open the dedicated AirMDR user.                 | `airmdr-integration@example.com` |
| **Password** | Password configured for the dedicated ARMS Console user.                                  | Set during user creation or through the invitation/activation email. The password is not displayed later in the ARMS Cyber UI. | `••••••••••••`                   |

<Note>
  AirMDR automatically adds the `/graphql` endpoint to the Base URL. The exact user-management navigation labels may vary depending on the ARMS Cyber Console version.
</Note>

### Configure Tines in AirMDR Integrations Dashboard

1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **ADMIN → Integrations**.
3. Use the search option, enter the keyword "**ARMS Cyber**", select the **Connections** tab, and click **+ New Connection** button.
4. Use the following values in the AirMDR integration configuration screen:

   | AirMDR Field     | Description                                                                | Example                             |
   | :--------------- | :------------------------------------------------------------------------- | :---------------------------------- |
   | **Instance**     | Unique name for the ARMS Cyber connection                                  | `ARMS-Cyber-Production`             |
   | **Organization** | AirMDR organization associated with the integration                        | `AirMDR Organization`               |
   | **Description**  | Purpose of the connection                                                  | `ARMS Cyber production integration` |
   | **Base URL**     | Root URL of the ARMS Cyber Console. Do not include `/login` or `/graphql`. | `https://console.armscyber.app`     |
   | **Email**        | Email address of the dedicated ARMS Console user created for AirMDR        | `airmdr-integration@example.com`    |
   | **Password**     | Password configured for the dedicated ARMS Console user                    | `<ARMS_USER_PASSWORD>`              |

   <Accordion title="Expand Advanced Configuration if required. (Optional)">
     1. In **Remote Agent**, select an AirMDR Remote Agent only when the ARMS Cyber Console is self-hosted, privately accessible, or must be reached through an approved private network route.
     2. In **Expiry**, select the date on which AirMDR should treat the stored ARMS Cyber credentials as expired, according to your organization’s password-rotation policy..

     <Note>
       The AirMDR **Expiry** setting is a connection-management control. It does not automatically change or rotate the password of the dedicated user in ARMS Cyber. <br /><br />After rotating the password in ARMS Cyber, update the connection with the new password in AirMDR.
     </Note>
   </Accordion>
5. Click **Save**.

### Skills provided by this Integration

<AccordionGroup>
  <Accordion title="Tenant and Device Discovery">
    | Skill                | Description                                                                                                                                                                                                                                                  | Access Type |
    | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- |
    | **Get ARMS Tenants** | Lists the ARMS tenants available to the authenticated user, including licence status, subscription details, and user and device limits. Use this skill to obtain the tenant UUID required by tenant-scoped device and event skills.                          | Read-only   |
    | **Get ARMS Devices** | Retrieves ARMS devices and their agent status. Use this skill to resolve a hostname or IP address to a device UUID, review the installed agent and operating-system versions, or identify devices that have stopped reporting based on their last heartbeat. | Read-only   |
  </Accordion>

  <Accordion title="Threat Investigation and Monitoring">
    | Skill                       | Description                                                                                                                                                                                                                                                                                         | Access Type |
    | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
    | **Get ARMS Events**         | Searches ARMS security events for a tenant or device. The skill supports full-text searches across event descriptions using values such as hostname, process name, file path, or file hash. It returns information including severity, category, threat type, mitigation status, and affected host. | Read-only   |
    | **Get ARMS Device Actions** | Lists actions performed by ARMS on devices, including file-restoration jobs and agent commands, with their current status. Use this skill to confirm whether remediation completed or identify actions that remain scheduled or in progress.                                                        | Read-only   |
  </Accordion>

  <Accordion title="Device Response Actions">
    | Skill                         | Description                                                                                                                                                                          | Access Type    |
    | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------- |
    | **Update ARMS Device Status** | Enables or disables a device in ARMS. Disabling a device stops ARMS from managing the associated agent. Verify the device UUID using **Get ARMS Devices** before running this skill. | Read and write |

    <Warning>
      This skill changes the device state in the ARMS Console. Grant the integration user permission to update devices only when this response capability is required.
    </Warning>
  </Accordion>

  <Accordion title="Advanced GraphQL Operations">
    | Skill                          | Description                                                                                                                                                                                                                                                             | Access Type                      |
    | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
    | **Execute ARMS GraphQL Query** | Runs a custom query or mutation against the ARMS Console GraphQL endpoint. Use it to access supported schema objects or fields that are not covered by the standard ARMS skills, such as users, user roles, event types, observable groups, or custom field selections. | Depends on the query or mutation |
  </Accordion>
</AccordionGroup>

<Tip>
  To view the details of Input Parameters and Output for the respective skills

  * Go to [AirMDR → ARMS Cyber](https://app.airmdr.com/integrationsv2/fa93b981-7239-4338-995f-ad1d93ebfb0a/skills?search=arms) Integration page.
  * Select the **Skills** tab and click on the required listed skills.
</Tip>

## Additional Information

<AccordionGroup>
  <Accordion title="🧰 Error Handling">
    | Error                                      | Possible cause                                                 | Resolution                                                             |
    | ------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------------------------- |
    | Authentication failed                      | Incorrect email or password                                    | Verify the dedicated user credentials and update the AirMDR connection |
    | Unable to connect                          | Incorrect Base URL or blocked HTTPS traffic                    | Enter only the root console URL and allow outbound TCP 443             |
    | Endpoint not found                         | `/graphql` was manually added or the URL contains another path | Remove `/graphql`, `/login`, and other paths from the Base URL         |
    | No tenant data returned                    | User is not assigned to the required tenant                    | Update the user’s tenant memberships in ARMS                           |
    | Partial data returned                      | User can access only some required tenants                     | Compare the assigned tenants with the intended integration scope       |
    | Permission denied                          | The assigned role lacks a required read permission             | Add only the missing permission and retest                             |
    | Device-status update fails                 | User has read-only access                                      | Grant device-update permission only when this action is required       |
    | Login works but API authentication fails   | SSO-only account or API authentication restriction             | Confirm password-based API access with ARMS Support                    |
    | Connection stopped after password rotation | AirMDR contains the old password                               | Update the saved AirMDR connection immediately after rotation          |
    | Account disabled or locked                 | Failed logins, policy enforcement, or account deactivation     | Reactivate or unlock the dedicated user and test the connection        |
  </Accordion>

  <Accordion title="🔄 Monitoring & Logs">
    ### AirMDR monitoring

    Review the connection status and execution history in the AirMDR integration interface. Monitor for:

    * Authentication failures
    * Connection timeouts
    * GraphQL request failures
    * Insufficient-permission errors
    * Missing tenant or device data
    * Device-update failures

    ### ARMS monitoring

    Review the ARMS Console audit or activity logs, if available for the assigned role and subscription. Search for:

    * Login attempts by the dedicated AirMDR user
    * API authentication activity
    * Requests associated with the integration user
    * Role or tenant-membership changes

    ARMS states that it monitors and logs various cloud services, but the public Security Statement does not identify a customer-facing log location.

    ### Illustrative log entries

    The following examples are illustrative. Actual AirMDR log formats may differ:

    ```text theme={null}
    INFO  ARMS authentication completed successfully
    INFO  ARMS GraphQL request completed tenant_id=<tenant-id>
    WARN  ARMS tenant not accessible to the configured user
    ERROR ARMS authentication failed: invalid credentials
    ERROR ARMS GraphQL request failed: insufficient permissions
    ```
  </Accordion>

  <Accordion title="🛑 Security & Access Best Practices">
    ### ✅ Do

    * Create a dedicated ARMS Console user for AirMDR.
    * Apply least-privilege access.
    * Use read-only access unless device-status updates are required.
    * Assign only the tenants that AirMDR must access.
    * Store the password in an approved enterprise password manager.
    * Use a strong, unique password.
    * Rotate credentials according to organizational policy.
    * Use HTTPS endpoints only.
    * Remove credentials from screenshots and diagnostic logs.
    * Review access periodically.

    ### ❌ Don’t

    * Using a personal employee account.
    * Sharing credentials across multiple integrations.
    * Granting user-management or tenant-management permissions.
    * Entering the public ARMS website or Security Statement URL as the Base URL.
    * Manually adding `/login` or `/graphql` to the Base URL.
    * Sending passwords through email, Slack, or support tickets.
    * Logging passwords, JWTs, or session information.
    * Granting device-update access when only read operations are required.
  </Accordion>

  <Accordion title="👉 Support & Maintenance">
    * 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
    * 🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
    * 🔄 **Reconnect in AirMDR immediately when secrets are changed.**
  </Accordion>

  <Accordion title="🛑 Data Flow & Security">
    ### Data flow

    | Direction      | Data exchanged                                                                                               |
    | :------------- | :----------------------------------------------------------------------------------------------------------- |
    | AirMDR → Tines | Authenticated API requests required by the selected Tines skill                                              |
    | Tines → AirMDR | API responses containing permitted team, story, case, event, record, status, or execution information        |
    | AirMDR → Tines | Create, update, or execution requests only when supported by the selected skill and permitted by the API key |

    The exact information exchanged depends on the AirMDR skill being executed and the permissions assigned to the Tines API key.

    ### Authentication flow

    1. AirMDR sends an HTTPS request to the configured Tines tenant domain.
    2. The Tines API key is supplied in the request authentication header.
    3. Tines validates the key and its associated user, service account, team role, or tenant permissions.
    4. Tines processes the request only when the key has access to the requested resource.
    5. The API response is returned to AirMDR over HTTPS.

    ### Encryption

    * Tines requires authenticated API communication over HTTPS.
    * Tines states that customer personal data is encrypted in transit using at least TLS 1.2.
    * Tines states that customer personal data stored at rest is encrypted using AES-256.
    * AirMDR should store the API key as a secret and must not expose it in skill inputs, logs, screenshots, or exported troubleshooting data.

    ### Ports and endpoints

    | Requirement          | Value                                                 |
    | :------------------- | :---------------------------------------------------- |
    | Protocol             | HTTPS                                                 |
    | Outbound port        | TCP 443                                               |
    | Base endpoint        | `https://<tenant-domain>`                             |
    | API endpoint pattern | `https://<tenant-domain>/api/v1/...` or `/api/v2/...` |
    | Authentication       | Bearer token or `X-User-Token` header                 |

    No inbound connection from Tines is required for standard AirMDR-initiated API requests. If a supported workflow uses Tines webhooks, configure and secure the required inbound webhook separately
  </Accordion>
</AccordionGroup>