Add alert evidence from Armis to Drata controls

This Tines story automatically pulls unhandled alerts from Armis and uploads them as external evidence to the matching alert controls in Drata, eliminating manual evidence collection ahead of compliance audits.

---

What you'll see:

• Enter a Drata Workspace ID via a Tines Page to trigger the workflow
• Fetch unhandled alerts from Armis across the last 14 days
• Retrieve all Drata controls associated with alerts using a free-text search
• Handle paginated API responses automatically to ensure all controls are captured
• Split the controls list so each control is processed individually
• Upload the Armis alert data as external evidence to each matching Drata control, stamped with today's date and a one-year renewal schedule

---

Perfect for:

• Compliance teams managing audit cycles: Automatically keep Drata controls populated with up-to-date alert evidence without manual file uploads
• GRC teams maintaining continuous compliance: Ensure alert-related controls always reflect real activity from your security tooling
• Security engineers supporting audit readiness: Remove the manual handoff between security alert data and compliance documentation

---

Requirements:

• Armis — connected via API Secret Key (armis credential)
• Drata — connected via API key with read and write access for Controls, Users, and Personnel scopes (drata credential)
• Armis base URL — stored as a Tines resource (armis_baseurl)
• Your Drata Workspace ID — entered manually when running the story