Armis Service Graph Connector for ServiceNow — Basic Troubleshooting Before Opening a Case
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
an hour ago
What the connector is and how it works
The Service Graph Connector (SGC) for Armis is a CMDB ingestion tool. Its job is to take the asset inventory Armis has already discovered and ingest it into your ServiceNow CMDB as Configuration Items, following ServiceNow best practices — giving you a single, populated CMDB that includes the IT, IoT, OT, and medical assets Armis sees but traditional discovery tools typically miss.
Under the hood it uses ServiceNow's IntegrationHub ETL plugin, which is a low-code front end for two ServiceNow engines:
- RTE (Robust Transform Engine) — performs the data ingestion and transform efficiently.
- IRE (Identification & Reconciliation Engine) — overlays Armis data on top of your other discovery sources while minimising duplicate CIs.
The connector is available on the ServiceNow Store.
Full setup steps: ServiceNow Graph Connector Installation Guide.
Direction of flow matters: as an ingestion tool, the SGC pulls from Armis into ServiceNow. This is a different integration from ServiceNow (Pull), which pulls CMDB data into Armis. If your issue is missing enrichment inside the Armis console rather than missing CIs in the CMDB, you're likely looking at the wrong integration.
Start here: the two most common root causes
1. Credentials / API secret sharing
The guide is explicit that most of the integration is pre-configured — you only enter your Armis URL and API Secret — so if it isn't working, start with the credentials.
Do not reuse one Armis API secret across multiple integrations or instances. The Armis API uses an Access Token obtained from the Secret Key, and that token expires frequently. ServiceNow tracks the token expiry locally.
If two integrations share a secret, one integration's request invalidates the other's token, and ServiceNow's tracked expiry becomes wrong — producing intermittent, hard-to-diagnose failures.
Recommended practice is a dedicated Armis integration user and secret per app, per ServiceNow instance.
For example, with Dev/Test/Prod instances running both SGC and Vulnerability Response, you'd create six users/keys:
| ServiceNow instance | Users needed |
|---|---|
| Dev | ServiceNowSGCDevUser, ServiceNowVRDevUser |
| Test | ServiceNowSGCTestUser, ServiceNowVRTestUser |
| Production | ServiceNowSGCProdUser, ServiceNowVRProdUser |
Keys are created in the Armis console under Settings > API Management (Create, or Show if one already exists).
2. Timeouts
If requests are failing or hanging, adjust the REST message timeout, and reduce the API page size (see properties below).
Large page sizes against large asset counts are a common cause of timeouts.
Run the built-in connection test
Rather than guessing, use the validation step built into the Guided Setup:
- In the Guided Setup, go to the Validate Connection & Credentials – Test Load 20 Records step and click Configure. You'll be redirected to a Data Source record.
- Under Related Links on that record, click Test Load 20 Records.
- A healthy result shows State: Complete and Completion code: Success.
If it doesn't complete successfully, re-check the Armis URL and the API key configured in the first two Guided Setup steps before doing anything else.
Checking the outbound HTTPS calls
The connector runs entirely from your ServiceNow instance outbound to your Armis tenant over HTTPS. To confirm the calls are actually leaving and what they return, review ServiceNow's own outbound request logging:
- System Logs > Outbound HTTP Requests > — shows each REST call the instance made, the HTTP status returned, and the response time. This is where you'll see authentication failures (401/403 → credential or token problem), timeouts, and TLS/proxy errors.
- System Logs > Application Logs, filtered to the Armis application scope — shows the connector's own error and warning messages during import and transform.
- Import Set rows and the transform history — confirms whether records arrived but failed to transform, versus never arriving at all.
Enabling more verbose diagnostics for Outbound HTTP calls
In the Servicenow instance, go to System properties: sys_properties_list.do
From here search for these properties and set the flags accordingly:
- glide.outbound_http_log.override = true
- glide.outbound_http_log.override.level = ALL
Then reproduce the issue to record debugged HTTP activity and check the enhanced Outbound HTTP logs:
sys_outbound_http_log.do
It's then possible to see the content of requests and responses been sent to Armis to fetch data. This activity is seen after a successful 200 API call done for authentication.
Disable enhanced logs by reverting the two flags mentioned above.
Advanced configuration properties
These system properties control connector behaviour and are worth reviewing when data is arriving but incomplete or incorrect:
| Property | Purpose |
|---|---|
x_armis_cmdb.aql |
The default Armis device query |
x_armis_cmdb.aql_daily_time_frame |
AQL timeframe field for the daily import |
x_armis_cmdb.aql_monthly_time_frame |
AQL timeframe field for the monthly import |
x_armis_cmdb.import_fields |
List of fields retrieved from the Armis API |
x_armis_cmdb.page_length |
Page length for API responses — reduce if requests time out |
x_armis_cmdb.import_timeout |
API timeout for Flow Actions |
x_armis_cmdb.trim_fqdn |
Shortens FQDNs to short names |
x_armis_cmdb.import_armis_sites |
Allows new sites to be inserted during device imports |
x_armis_cmdb.mac_address_classes |
Classes for which @[MAC ADDRESS] is appended to CI names |
x_armis_cmdb.armis_site_map_fields |
Fields inherited from Armis Site Maps to corresponding CIs |
If specific CMDB fields are blank: check x_armis_cmdb.import_fields. Armis attribute names can differ between releases and between integration sources, so a field that returns null may simply be requested under an attribute name your instance doesn't populate. Confirm which attribute name actually carries the value in your Armis instance, then align import_fields accordingly.
Records aren't inserting into a particular class
A documented behaviour worth knowing before you raise a case: certain CMDB classes (for example HVAC) may not have IRE Identification Rules established. Without an Identification Rule, the IRE cannot insert CIs into that class at all. These rules may need to be added manually.
More broadly, the Armis-supported scope is the connection between your Armis instance and the population of your ServiceNow CMDB. ServiceNow-side customisations — class mappings, IRE rules, workspace/ACL behaviour — should be taken to ServiceNow expertise or ServiceNow Support.
Pre-requisite ordering (Vulnerability Response users)
If you're also deploying the Armis Vulnerability Response integration: run the device integration first. VR relies on the device records the Service Graph Connector populates in the CMDB for its mapping logic.
If the device import hasn't completed, VR will fail to map any imported records and the following is seen in the logs:
{"message":"The value \"['null']\" is invalid (not a valid device_ids).","success":false}
For example (see below parameter &device_ids=null)
VR additionally requires an Armis VMS license.
When to open a support case
Contact Armis Support if:
- Test Load 20 Records fails after you've verified the Armis URL and a dedicated, unshared API secret.
- Outbound HTTP Requests show successful 200 responses, but no CIs or incomplete CIs appear in the CMDB.
- Imports stall or time out consistently after reducing page length and raising the REST/import timeout.
- Expected Armis attributes are missing from the API response itself.
Please include:
- Connector version installed, and the ServiceNow instance type (Dev/Test/Prod).
- Whether the API secret is dedicated to this app and instance.
- The Test Load 20 Records result (State and Completion code).
- Relevant entries from Outbound HTTP Requests (status codes and timings) and Application Logs.
- The failing step from the flow execution detail, and any transform/IRE error text.
- Which CMDB classes or fields are affected, and any customisations made to
import_fields, the AQL, or the transform maps.
Use the in-app Contact Support module where available.
Reference articles
