Armis Asset Intelligence Engine

A Universe of Assets

Core to Armis Centrix™ is our Asset Intelligence Engine. It is a giant, crowdsourced, cloud-based knowledge base—the largest in the world, tracking over three billion assets—and growing.

Each profile includes unique device information such as how often each asset communicates with other devices, over what protocols, how much data is typically transmitted, whether the asset is usually stationary, what software runs on each asset, etc. And we record and keep a history on everything each asset does.

Context Matters

With our Asset Intelligence Engine, Armis Centrix™ understands not only what the asset is and what it is doing, but what it should be doing. This is because we understand the context of each asset in its use in each environment.

After all, a tablet is not just a tablet. It may be used to check people in at an office lobby, to drive a video conferencing solution in a boardroom, or run a production line, or used by a doctor in an emergency room. Context is critical to know the correct behavioral profile of an asset.

Asset Insights Driving Security

These asset insights enable Armis Centrix™ to classify assets and detect threats with a high degree of accuracy. Armis Centrix™ compares real-time asset state and behavior to “known-good” baselines for similar assets we have seen in other environments. When an asset operates outside of its baseline, Armis Centrix™ issues an alert or can automatically disconnect or quarantine an asset.

Alerts can be triggered by a policy violation, a misconfiguration, or abnormal behavior like inappropriate connection requests or unexpected software running on an asset. The Armis Asset Intelligence Engine tracks all managed, unmanaged, and IoT assets Armis has seen across all our customers.

Threat Detection Engine

Armis Centrix™ cloud-based threat detection engine uses machine learning and artificial intelligence to detect when a device is operating outside of its normal “known good” baseline. This deviation can be caused by a device misconfiguration, a policy violation, abnormal behavior such as inappropriate connection requests or unusual software running on a device, or threat intelligence that indicates that the device has been compromised.