MELTr
Home Vendors Search Download
Login
Vendors / Armis Security / Armis Security Platform / System Policy Violation Alert
Armis Security logo

Event type

System Policy Violation Alert

Security policy breach detection and alerting

System policy violation alerts generated by the Armis Security Platform when devices violate configured security policies, including unauthorized device-to-device communications, protocol violations, and network boundary breaches

JSON 36 fields Medium Generator

security policy-violation device-security network-security iot threat-detection compliance
Preview Sample View Schema
CLI Install
meltr templates install armis

Overview

What this event covers

Armis Security Platform alerts generated when devices violate configured security policies, including workstation-to-workstation connections, unauthorized protocols, and boundary violations.

When generated

  • ›Device-to-device communication violates policy rules
  • ›Unauthorized protocol usage detected
  • ›Network boundary violations occur
  • ›SMB, RDP, SSH, or other lateral movement protocols used inappropriately
  • ›IoT or unmanaged devices communicate with restricted endpoints
  • ›Device risk levels exceed thresholds

Security relevance

High

Compliance

NIST Cybersecurity Framework HIPAA (device security) PCI DSS (network segmentation) GDPR (data protection) SOC 2

Frequency notes

Policy violations occur regularly in enterprise environments, with higher frequency during business hours when device activity peaks. Frequency varies based on policy strictness and network complexity.

Resources

Docs and tools

Armis Security Platform Documentation official Armis Policy Management Guide official Armis Alert Response Best Practices reference Armis API Documentation official Armis Security Platform Agentless device security and visibility platform Armis Integration Hub Integrations with SIEM, SOAR, and security tools

Generation

Configuration

Base frequency
30 events/hour
Time patterns
business_hours night_hours weekend
Business hours
2.5x
Night hours
0.8x
Weekend
0.4x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

id
Integer Required

Unique alert identifier assigned by Armis platform

Source: random_int(1000000, 9999999)

Example 1043631
type
String Required

Alert type classification in Armis system

Source: Static value

Example SYSTEM_POLICY_VIOLATION
Values
  • SYSTEM_POLICY_VIOLATION Policy rule violation detected
  • THREAT_DETECTION Security threat identified
  • ANOMALY_DETECTION Behavioral anomaly detected
title
String Required

Human-readable alert title describing the violation

Source: random_choice(['WorkStation to Workstation SMB Connection', 'Unauthorized Device Access', ...])

Example WorkStation to Workstation SMB Connection
policy
Object Required

Detailed policy information including rules, actions, owner, and configuration

Source: Complex nested object with policy metadata

policy.id
Integer Required

Unique policy identifier

Source: random_int(10000, 99999)

Example 15244
policy.owner
String Required

Email address of policy owner/creator

Source: registry.get_random_user().email

Format Email address
Example security@company.com
policy.actionType
String Required

Severity level of alert action

Example ALERT_HIGH
Values
  • ALERT_CRITICAL Critical severity alert
  • ALERT_HIGH High severity alert
  • ALERT_MEDIUM Medium severity alert
  • ALERT_LOW Low severity alert
policy.rules
Object Required

Policy rule definitions in Armis Query Language (AQL)

Source: Generated AQL rule syntax

Example {"and": ["endpointA:(device:(type:'Personal Computers')) protocol:SMB"]}
policy.labels
Array Optional

Policy categorization labels

Source: random_choice([['threats', 'value_pack'], ['security', 'network'], ...])

Example ["threats", "value_pack"]
policy.timezone
String Required

Timezone for policy evaluation

Source: registry.get_organization_field('timezone')

Format IANA timezone identifier
Example America/Chicago
status
String Required

Current alert handling status

Source: random_choice(['UNHANDLED', 'IN_PROGRESS', 'RESOLVED', 'SUPPRESSED'])

Example UNHANDLED
Values
  • UNHANDLED Alert has not been reviewed
  • IN_PROGRESS Alert is being investigated
  • RESOLVED Alert has been resolved
  • SUPPRESSED Alert has been suppressed
content
String Required

Detailed alert description with recommended remediation actions in markdown format

Source: Generated markdown content with sensor information

Example The Armis security platform has detected a violation...
sources
Array Required

Source devices that initiated the policy violation

Source: Array of device objects with full metadata

sources[].id
Integer Required

Unique device identifier in Armis platform

Source: random_int(100000, 999999)

Example 756766
sources[].ip
String Optional

IPv4 address of source device

Source: random_private_ip()

Format IPv4 address
Example 10.113.4.81
sources[].ipv6
String Optional

IPv6 address of source device

Source: fake.ipv6()

Format IPv6 address
Example fe80::a5ea:1e79:5848:5df3
sources[].name
String Required

Hostname or device name

Source: registry.get_random_device().hostname

Format FQDN or hostname
Example ws-1hc3773.mclane.mclaneco.com
sources[].type
String Required

Device type classification

Source: random_choice(['PERSONAL_COMPUTER', 'SERVER', 'LAPTOP', 'WORKSTATION'])

Example PERSONAL_COMPUTER
Values
  • PERSONAL_COMPUTER Desktop workstation
  • SERVER Server device
  • LAPTOP Mobile laptop
  • NETWORK_DEVICE Network infrastructure
  • IoT_DEVICE Internet of Things device
sources[].model
String Optional

Device hardware model

Source: random_choice(['OptiPlex', 'Latitude', 'ThinkPad', ...])

Example OptiPlex
sources[].riskLevel
Integer Required

Armis-calculated device risk score (1-100)

Source: random_int(1, 100)

Example 80
sources[].identifier
String Optional

Device hardware identifier (typically MAC address)

Source: fake.mac_address() | upper

Format MAC address (uppercase, colon-separated)
Example A4:BB:6D:51:45:55
sources[].dataSources
Array Required

List of data sources providing device information

Source: random_choice of common integration sources

Example ["Active Directory", "CrowdStrike", "Microsoft Intune"]
sources[].boundaries
Array Required

Network boundaries/segments the device belongs to

Source: Generated network boundary names

Example ["FS Charlotte - CE"]
sources[].site
Object Required

Physical site information for the device

Source: Object with name and location fields

sources[].sensor
Object Required

Armis sensor that detected this device

Source: Object with sensor name and type

severity
String Required

Alert severity level

Source: random_choice(['HIGH', 'MEDIUM', 'CRITICAL', 'LOW'])

Example HIGH
Values
  • CRITICAL Critical severity requiring immediate attention
  • HIGH High severity requiring prompt response
  • MEDIUM Medium severity for review
  • LOW Low severity informational
riskLevel
Integer Required

Overall risk level of the alert (1-10)

Source: random_int(1, 10)

Example 9
timestamp
String Required

Alert generation timestamp

Source: now() | iso8601

Format ISO 8601 with timezone offset
Example 2025-12-20T20:26:27.348+00:00
activities
Array Required

Network activities that triggered the policy violation

Source: Array of activity objects with violation details

activities[].type
String Required

Activity type classification

Source: Static value

Example NETWORK_POLICY_VIOLATION
activities[].decision_data
Object Required

Technical details of the violation (port, protocol, device IDs)

Source: Object with port, protocol, server_device_id, client_device_id

destinations
Array Required

Destination devices involved in the policy violation

Source: Array of device objects (similar structure to sources)

classification
String Required

Security classification category

Source: random_choice(['Security - Other', 'Security - Network', ...])

Example Security - Other
relatedDevices
Array Required

All devices involved in the alert (sources + destinations)

Source: Combined array of source and destination devices

mitreAttackLabels
Array Optional

MITRE ATT&CK framework labels if applicable

Source: Empty array (populated for specific threat types)

Example []
hostname
String Required

Organization hostname/domain identifier

Source: registry.get_organization_field('domain') | sanitized

Example mclane