Forum Discussion

Chenuka's avatar
Chenuka
Occasional Reader
Oct 22, 2026

Microsoft Sentinel Armis Connector

Hi all,   In our environment, we use Armis and collect Armis activity, alert, and device logs in Microsoft Sentinel. For this, we use the Microsoft-released Armis connector from Content Hub. The co...
apis
data collection
integration
siem
Jamony's avatar
Jamony
MCT
Oct 22, 2026

The current Microsoft connector reference still lists Armis Alerts Activities and Armis Devices as Azure Functions connectors, supported by Armis Corporation. Its “DCR support: Yes” entry specifically refers to workspace transformation DCRs; that does not prove the connector has migrated its ingestion transport to the Logs Ingestion API or CCF.
Check the installed solution version and the connector’s actual ingestion endpoint, then ask Armis support for its supported migration package and timetable. I cannot confirm a released Armis CCF replacement from that reference alone.
Microsoft’s transition notice explicitly says connectors and tables relying on the HTTP Data Collector API stopped being eligible for Sentinel incident support on September 14, 2026. Being installed from Content Hub does not create an exception.
Plan a supported DCR-based ingestion migration, testing table names, schemas, parsers, and dependent detection rules before switching over. Keep connector-specific support ownership separate from support for other Sentinel platform issues.