Who does what
Provider
- Hunt threats in Armis Centrix
- Investigate and enrich suspicious findings
- Tune policies and review investigation priorities
Your team
- Execute containment in connected controls
- Remediate and recover affected systems
- Maintain Armis context and wider SOC workflows
Coverage
- Network
- OT/ICS
- IoT
Details
Service scope
Best for Armis customers needing investigation help across unmanaged, OT and medical devices
Armis requirement
MTS works around Armis asset intelligence. Confirm the required Centrix subscription and current MTS package in the quote.
Containment authority
Centrix integrations can trigger response, but analyst execution is not established. Confirm who operates each control.
ServiceNow ownership
ServiceNow completed the Armis acquisition on 20 April 2026. Centrix remains available as a standalone solution.
Full service analysis
Armis Managed Threat Services investigates and enriches Centrix findings, hunts for threats and tunes detection policies. You retain containment, remediation and the broader SOC workflow.
- Your team owns
- Approve and execute containment through your connected security controls
- Remediate and recover affected systems
- Maintain asset context, integrations and business priorities
- Own the wider SOC workflow outside the contracted Armis scope
Why investigate and advise
The Managed Threat Service brief supports continuous threat hunting, human analysis, suspicious-activity review, policy tuning, weekly findings and support for active investigations. It does not prove that Armis analysts normally execute containment actions for the buyer.
Platform boundary
The service is tied to Armis Centrix. Public procurement material says Armis Asset Management and Security or Armis OT Security is required, so buyers should not treat MTS as a standalone managed SOC service.
Containment boundary
Armis Centrix can trigger actions through integrated NAC, firewall, endpoint, ticketing and SOAR tools. The public profile treats those as platform or buyer-control actions unless the contract states that Armis analysts execute them.
Current package and ownership
ServiceNow completed its Armis acquisition in April 2026. Public procurement catalogs list Managed Threat Services separately from platform licenses and resident engineers. Ask for the current service description and quote because older pricing uses different asset bands.
Pricing & contract
- Billing
- Per-asset, Custom
MTS and its required Armis platform are separate quote items. Confirm the covered asset band, service term, Foundations versus full MTS scope and any resident-engineer or support charges.
Tradeoffs & buying questions
Strengths
-
Analyst help with existing Armis findings
-
Threat hunting across connected assets
-
Detection-policy tuning and operational reviews
Considerations
-
Requires an Armis platform subscription
-
Your team retains containment and remediation
-
Full MTS, Foundations and resident-engineer scope need separate confirmation
Ask before buying
- Which findings do analysts investigate and what review cadence applies to our MTS package?
- Who executes containment through our integrated controls and which actions can be pre-approved?
- Does the quote cover full MTS or Foundations, which asset band and term apply and which Centrix licenses or resident-engineer services are separate?
Integrations
Other integrations
- Armis Centrix
Common questions
Is Armis Managed Threat Service an MDR service?
Not in the usual endpoint MDR sense. This profile treats it as a managed threat service for Armis Centrix because the public material centers on threat hunting, suspicious-activity review, alert enrichment, policy tuning and investigation support around Armis data.
Does Armis contain threats for the buyer?
Armis Centrix can trigger actions through integrated controls such as NAC, firewall, SOAR and ticketing systems. The Managed Threat Service material does not prove that Armis analysts normally execute those actions, so buyers should confirm response authority in the contract.
How is Armis Managed Threat Services priced?
MTS appears in public asset-band procurement lists. Older list prices and changing asset bands are not a reliable current service quote. Confirm the term and required Centrix licenses.
Company details
- Headquarters
- California, United States