ARIA Packet Intelligence

The ARIA Cybesecurity Solutions Software-Defined Security (SDS) platform integrates with Cortex XSOAR to add robustness when responding to incidents. The combination of ARIA hardware, in the form of a Secure Intelligent Adapter (SIA), and software, specifically Packet Intelligence and SDS orchestrator (SDSo), provides the elements required to react instantly when an incident is detected. When integrated with the ARIA solution, you can create playbooks that instruct one or more SIAs to add, modify, or delete rules automatically. These rule changes, which take effect immediately, can block conversations, redirect packets to a recorder or VLAN, or perform a variety of other actions.

Network Security · ARIAPacketIntelligence

Configuration parameters

  • sdso — SDSo Base URL (e.g. http://<IP address or FQDN of SDSo Node>:7443) (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (30)

  • aria-alert-conversation

    Adds a rule that generates an alert when a conversation that matches the specified 5-tuple values is detected.

  • aria-alert-dest-port

    Creates a rule that generates an alert when traffic destined for one or more ports is detected.

  • aria-alert-dest-subnet

    Creates a rule that generates an alert when traffic destined for a specific IP address or range of IP addresses is detected.

  • aria-alert-src-port

    Creates a rule that generates an alert when traffic originating from one or more ports is detected.

  • aria-alert-src-subnet

    Adds a rule that generates an alert when traffic originating from a specific IP address or range of IP addresses is detected.

  • aria-block-conversation

    Creates a rule that drops all packets that match the specified 5-tuple values.

  • aria-block-dest-port

    Creates a rule that blocks packets destined for one or more specified ports.

  • aria-block-dest-subnet

    Adds a rule that blocks packets destined for a specific IP address or range of IP addresses.

  • aria-block-src-port

    Adds a rule that blocks packets originating from one or more specific ports.

  • aria-block-src-subnet

    Adds a rule that blocks packets originating from a specific IP address or range of IP addresses.

  • aria-mute-alert-conversation

    Removes a named rule from the 5-tuple logic block, disabling the alerts.

  • aria-mute-alert-dest-port

    Removes a named rule from the destination port logic block, disabling the alerts.

  • aria-mute-alert-dest-subnet

    Removes a named rule from the destination subnet logic block, disabling the alerts.

  • aria-mute-alert-src-port

    Removes a named rule from the source port logic block, disabling the alerts.

  • aria-mute-alert-src-subnet

    Removes a named rule from the source subnet logic block, disabling the alerts.

  • aria-record-conversation

    Creates a rule that redirects a conversation that matches 5-tuple values to the Packet Recorder. Packets are tagged with the VID specified in the instance.

  • aria-record-dest-port

    Adds a rule that redirects traffic that is destined for one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.

  • aria-record-dest-subnet

    Creates a rule that redirects traffic destined for a specific IP address or range of IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.

  • aria-record-src-port

    Adds a rule that redirects traffic originating from one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.

  • aria-record-src-subnet

    Creates a rule that redirects traffic originating from one or more specific IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.

  • aria-stop-recording-conversation

    Removes the named rule from the 5-tuple block. This stops redirecting traffic to the Packet Recorder.

  • aria-stop-recording-dest-port

    Removes a named rule from the destination port logic block. This stops redirecting traffic to the Packet Recorder.

  • aria-stop-recording-dest-subnet

    Removes a named rule from the destination subnet logic block. This stops redirecting traffic to the Packet Recorder.

  • aria-stop-recording-src-port

    Removes a named rule from the source port logic block. This stops redirecting traffic to the Packet Recorder.

  • aria-stop-recording-src-subnet

    Removes a named rule from the source subnet logic block. This stops redirecting traffic to the Packet Recorder.

  • aria-unblock-conversation

    Deletes a named rule from the 5-tuple logic block. This allows the previously blocked conversation to resume.

  • aria-unblock-dest-port

    Removes a named rule from the destination port logic block. This allows the previously blocked traffic to resume.

  • aria-unblock-dest-subnet

    Removes a named rule from the destination subnet logic block. This allows the previously blocked traffic to resume.

  • aria-unblock-src-port

    Removes a named rule from the source port logic block. This allows the previously blocked traffic to resume.

  • aria-unblock-src-subnet

    Removes a named rule from the source subnet logic block. This allows the previously blocked traffic to resume.