id: armis
name: Armis
version: 1.0.0
description: "Armis (API v1) — device and asset visibility: search devices and alerts with AQL, read a device, and update an alert's status. Secret-key (token exchange) authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: search devices/alerts, get device, update alert status."
category: asset_management

# Per-instance configuration. The secret key is exchanged for a short-lived
# access token (sent as the 'Authorization' header).
config_schema:
  properties:
    base_url:
      type: string
      description: "Armis instance URL (e.g. https://yourtenant.armis.com)"
    secret_key:
      type: string
      description: "Armis secret key"
      x-soar-sensitive: true
  required:
    - base_url
    - secret_key

commands:
  - id: search_devices
    name: armis-search-devices
    description: "Search devices with an AQL expression."
    risk: read
    inputs_schema:
      properties:
        aql: { type: string, description: "AQL filter appended to 'in:devices' (e.g. riskLevel:High)" }
        length: { type: number, description: "Max results (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_device
    name: armis-get-device
    description: "Get a single device by ID."
    risk: read
    inputs_schema:
      properties:
        device_id: { type: string, description: "Device ID" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: search_alerts
    name: armis-search-alerts
    description: "Search alerts with an AQL expression."
    risk: read
    inputs_schema:
      properties:
        aql: { type: string, description: "AQL filter appended to 'in:alerts' (e.g. status:Unhandled)" }
        length: { type: number, description: "Max results (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: update_alert
    name: armis-update-alert
    description: "Update an alert's status."
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Alert ID" }
        status: { type: string, description: "New status (UNHANDLED, SUPPRESSED, or RESOLVED)" }
      required: [alert_id, status]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: armis-test-connection
    description: "Verify the secret key via the token exchange (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }