Data Export

This guide will highlight the steps involved in exporting data from Armis

⚠️

Data export is disabled by default. Once enabled, files are created daily at midnight UTC. Queries return URLs for the latest files.

The Need for Data Export

While Armis Centrix™ provides various methods for data consumption and analysis, you may sometimes need to export data for further analysis outside of the platform. This is especially useful for integrating Armis' data with your own proprietary datasets.

Exportable Entities

The Armis API allows you to extract information for the following entities:

EntityDescriptionSupported Time FramesDefault
applicationsInstalled applications across your devices2, 7, 14, 30 days30 days
device-delete-eventsRecords of device deletion operations2, 7, 14, 30, 90 days14 days
device-merge-eventsRecords of device merge operations2, 7, 14, 30, 90 days14 days
ip-connectionsNetwork connection data between devices1-7 days-
risk-factorsSecurity risks identified on devices2, 7, 14, 30 days30 days
vulnerabilitiesKnown vulnerabilities affecting devices2, 7, 14, 30 days30 days

Configurable Time Frames

Each time_frame_days value of an entity is exported separately. For example, applications with time_frame_days=7 and applications with time_frame_days=30 are two independent exports that are enabled, disabled, and read on their own. Omitting time_frame_days addresses the entity's default window.

When enabling data export for entities with configurable time frames, specify the time_frame_days parameter. For example, to export the last 90 days of device delete events, set time_frame_days to 90. For ip-connections, the time_frame_days parameter is accepted when reading to pick the aggregation date but cannot be set when enabling the export.

📘

All files are in Parquet file format, ideal for large data set. You can learn more about it here.

Example

Let's say you wish to export applications data from Armis Centrix™.

Step 1: enable export

Perquisites:

  1. Access token with scopesPERMISSION.REPORT.MANAGE.CREATE and PERMISSION.REPORT.MANAGE.DELETE.

Send the request

import requests

entity = "applications"
body = {"enabled": True}
access_token = "your_access_token_here"
headers = {
    "Authorization": f"Bearer {access_token}"
}

response = requests.patch(
    f"https://api.armis.com/v3/data-export/{entity}",
    json=body,
    headers=headers,
)

response.raise_for_status()

Detailed recipe

Step 2: wait for the files to be generated

Remember - when you enable data export for an entity, the first files will only be generated for the first time at the next midnight UTC (and on every following midnight UTC until disabled).

Step 3: Get the file URLs

⚠️

When you export data using this method, you gain access to all data for that entity. Therefore, the access token must have access to all data within the tenant, which in practice means access to all sites and boundaries.

Perquisites:

  1. Access token with scopesPERMISSION.REPORT.READ and FULL_VISIBILITY.

Send the request

import json
import requests

entity = "applications"
access_token = "your_access_token_here"
headers = {
    "Authorization": f"Bearer {access_token}"
}

response = requests.get(
    f"https://api.armis.com/v3/data-export/{entity}",
    headers=headers,
)
response.raise_for_status()
print(json.dumps(response.json(), indent=2))
{
  "urls_creation_time": "2025-09-08T00:00:00",
  "source_data_timestamp": "2025-09-07T00:00:00",
  "enabled": true,
  "urls": ["url1", "url2"],
  "file_format": "parquet"
}

Detailed recipe

Step 4: Open the files

Download and open the Parquet files from the provided URLs using tools like Trino, Pandas, etc.

⚠️

Links expire after 24 hours; download files promptly.



Did this page help you?