Forum Discussion
Microsoft Sentinel Armis Connector
Hi all,
In our environment, we use Armis and collect Armis activity, alert, and device logs in Microsoft Sentinel. For this, we use the Microsoft-released Armis connector from Content Hub. The connector uses an Azure Function app to collect logs from Armis via the REST API. However, the connector uses the legacy HTTP Data Collector API, which Microsoft has deprecated, and support ended in September 2026.
My questions:
- Has Microsoft released a DCR-based or CCF connector for collecting Armis logs? I couldn't find any newly released connector in Content Hub.
- If an issue occurs on the connector side, is Microsoft support still available, given that Microsoft hasn't released a new connector to migrate to?
1 Reply
The current Microsoft connector reference still lists Armis Alerts Activities and Armis Devices as Azure Functions connectors, supported by Armis Corporation. Its “DCR support: Yes” entry specifically refers to workspace transformation DCRs; that does not prove the connector has migrated its ingestion transport to the Logs Ingestion API or CCF.
Check the installed solution version and the connector’s actual ingestion endpoint, then ask Armis support for its supported migration package and timetable. I cannot confirm a released Armis CCF replacement from that reference alone.
Microsoft’s transition notice explicitly says connectors and tables relying on the HTTP Data Collector API stopped being eligible for Sentinel incident support on September 14, 2026. Being installed from Content Hub does not create an exception.
Plan a supported DCR-based ingestion migration, testing table names, schemas, parsers, and dependent detection rules before switching over. Keep connector-specific support ownership separate from support for other Sentinel platform issues.
