ARIA Packet Intelligence

commonfields:
  id: ARIA Packet Intelligence
  version: -1
name: ARIA Packet Intelligence
display: ARIA Packet Intelligence
category: Network Security
provider: AriaNetworks
description: 'The ARIA Cybesecurity Solutions Software-Defined Security (SDS)  platform integrates with Cortex XSOAR to add robustness when responding to incidents. The combination of ARIA hardware, in the form of a Secure Intelligent Adapter (SIA), and software, specifically Packet Intelligence and SDS orchestrator (SDSo), provides the elements required to react instantly when an incident is detected. When integrated with the ARIA solution, you can create playbooks that instruct one or more SIAs to add, modify, or delete rules automatically. These rule changes, which take effect immediately, can block conversations, redirect packets to a recorder or VLAN, or perform a variety of other actions.'
configuration:
- display: SDSo Base URL (e.g. http://<IP address or FQDN of SDSo Node>:7443)
  name: sdso
  defaultvalue: http://<IP address or FQDN of SDSo Node>:7443
  type: 0
  required: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: aria-block-conversation
    arguments:
    - name: src_ip
      required: true
      description: The source IP address.
    - name: src_port
      description: The source port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: target_ip
      required: true
      description: The destination IP address.
    - name: target_port
      description: The destination port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: protocol
      description: The protocol used for the packets (e.g., TCP).
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.BlockConversation.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.BlockConversation.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.BlockConversation.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that drops all packets that match the specified 5-tuple values.
  - name: aria-unblock-conversation
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.UnblockConversation.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.UnblockConversation.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.UnblockConversation.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Deletes a named rule from the 5-tuple logic block. This allows the previously blocked conversation to resume.
  - name: aria-record-conversation
    arguments:
    - name: src_ip
      required: true
      description: The source IP address.
    - name: src_port
      description: The source port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: target_ip
      required: true
      description: The destination IP address.
    - name: target_port
      description: The destination port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: protocol
      description: The protocol used for the packets (e.g., TCP) .
    - name: vlan_id
      required: true
      description: The VLAN ID that your network switch uses to forward packets to the Packet Recorder.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: sia_interface
      auto: PREDEFINED
      predefined:
      - A
      - B
      description: The letter of the interface on the SIA used for forwarding packets. Can be A or B. If omitted, interface A is used.
    - name: transport_type
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. Can be email or syslog.'
    - name: tti_index
      description: The index of the entry in the transport type table.
    - name: aio_index
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191. If the trigger_type is re-trigger-ms or re-triggersec, this is the total amount of time (in msecs or secs), respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.RecordConversation.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.RecordConversation.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.RecordConversation.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that redirects a conversation that matches 5-tuple values to the Packet Recorder. Packets are tagged with the VID specified in the instance.
  - name: aria-stop-recording-conversation
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.StopRecordingConversation.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.StopRecordingConversation.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.StopRecordingConversation.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes the named rule from the 5-tuple block. This stops redirecting traffic to the Packet Recorder.
  - name: aria-alert-conversation
    arguments:
    - name: src_ip
      required: true
      description: The source IP address.
    - name: src_port
      description: The source port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: target_ip
      required: true
      description: The destination IP address.
    - name: target_port
      description: The destination port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: protocol
      description: The protocol used for the packets (e.g., TCP) .
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: transport_type
      required: true
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. '
    - name: tti_index
      required: true
      description: The index of the entry in the transport type table.
    - name: aio_index
      required: true
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      required: true
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      required: true
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191. If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.AlertConversation.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.AlertConversation.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.AlertConversation.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Adds a rule that generates an alert when a conversation that matches the specified 5-tuple values is detected.
  - name: aria-mute-alert-conversation
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.MuteAlertConversation.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.MuteAlertConversation.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.MuteAlertConversation.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the 5-tuple logic block, disabling the alerts.
  - name: aria-block-dest-port
    arguments:
    - name: port_range
      required: true
      description: The destination port(s) to block. This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.BlockDestPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.BlockDestPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.BlockDestPort.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that blocks packets destined for one or more specified ports.
  - name: aria-unblock-dest-port
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.UnblockDestPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.UnblockDestPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.UnblockDestPort.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the destination port logic block. This allows the previously blocked traffic to resume.
  - name: aria-record-dest-port
    arguments:
    - name: port_range
      required: true
      description: The destination port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: vlan_id
      required: true
      description: The VLAN ID that your network switch uses to forward packets to the Packet Recorder.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: sia_interface
      auto: PREDEFINED
      predefined:
      - A
      - B
      description: The letter of the interface on the SIA used for forwarding packets. Can be A or B. If omitted, interface A is used.
    - name: transport_type
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. Can be email or syslog.'
    - name: tti_index
      description: The index of the entry in the transport type table.
    - name: aio_index
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.RecordDestPort.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.RecordDestPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.RecordDestPort.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Adds a rule that redirects traffic that is destined for one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.
  - name: aria-stop-recording-dest-port
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.StopRecordingDestPort.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.StopRecordingDestPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.StopRecordingDestPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the destination port logic block. This stops redirecting traffic to the Packet Recorder.
  - name: aria-alert-dest-port
    arguments:
    - name: port_range
      required: true
      description: The destination port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: transport_type
      required: true
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. '
    - name: tti_index
      required: true
      description: The index of the entry in the transport type table.
    - name: aio_index
      required: true
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      required: true
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      required: true
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.AlertDestPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.AlertDestPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.AlertDestPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that generates an alert when traffic destined for one or more ports is detected.
  - name: aria-mute-alert-dest-port
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.MuteAlertDestPort.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.MuteAlertDestPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.MuteAlertDestPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the destination port logic block, disabling the alerts.
  - name: aria-block-src-port
    arguments:
    - name: port_range
      required: true
      description: The source port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.BlockSrcPort.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.BlockSrcPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.BlockSrcPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Adds a rule that blocks packets originating from one or more specific ports.
  - name: aria-unblock-src-port
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.UnblockSrcPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.UnblockSrcPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.UnblockSrcPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the source port logic block. This allows the previously blocked traffic to resume.
  - name: aria-record-src-port
    arguments:
    - name: port_range
      required: true
      description: The source port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: vlan_id
      required: true
      description: The VLAN ID your network switch uses to forward packets to the Packet Recorder.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: sia_interface
      auto: PREDEFINED
      predefined:
      - A
      - B
      description: The letter of the interface on the SIA used for forwarding packets. Can be A or B. If omitted, interface A is used.
    - name: transport_type
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. Can be email or syslog.'
    - name: tti_index
      description: The index of the entry in the transport type table.
    - name: aio_index
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.RecordSrcPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.RecordSrcPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.RecordSrcPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Adds a rule that redirects traffic originating from one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.
  - name: aria-stop-recording-src-port
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.StopRecordingSrcPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.StopRecordingSrcPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.StopRecordingSrcPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the source port logic block. This stops redirecting traffic to the Packet Recorder.
  - name: aria-alert-src-port
    arguments:
    - name: port_range
      required: true
      description: The source port(s). This accepts a comma-separated list (e.g., “1, 3”), a range (e.g., “1-3”), or a combination (e.g., “1, 3-5”).
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: transport_type
      required: true
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. Can be email or syslog.'
    - name: tti_index
      required: true
      description: The index of the entry in the transport type table.
    - name: aio_index
      required: true
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      required: true
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      required: true
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.AlertSrcPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.AlertSrcPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.AlertSrcPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that generates an alert when traffic originating from one or more ports is detected.
  - name: aria-mute-alert-src-port
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.MuteAlertSrcPort.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.MuteAlertSrcPort.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.MuteAlertSrcPort.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the source port logic block, disabling the alerts.
  - name: aria-block-dest-subnet
    arguments:
    - name: target_ip
      required: true
      description: The IP address and mask of the destination IP address(es), in the format <IP_address>/<mask>. If the mask is omitted, a value of 32 is used.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.BlockDestSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.BlockDestSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.BlockDestSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Adds a rule that blocks packets destined for a specific IP address or range of IP addresses.
  - name: aria-unblock-dest-subnet
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.UnblockDestSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.UnblockDestSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.UnblockDestSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the destination subnet logic block. This allows the previously blocked traffic to resume.
  - name: aria-record-dest-subnet
    arguments:
    - name: target_ip
      required: true
      description: The IP address and mask of the destination IP address(es), in the format <IP_address>/<mask>. If the mask is omitted, a value of 32 is used.
    - name: vlan_id
      required: true
      description: The VLAN ID that your network switch uses to forward packets to the Packet Recorder.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: sia_interface
      auto: PREDEFINED
      predefined:
      - A
      - B
      description: The letter of the interface on the SIA used for forwarding packets. Can be A or B. If omitted, interface A is used.
    - name: transport_type
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. '
    - name: tti_index
      description: The index of the entry in the transport type table.
    - name: aio_index
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.RecordDestSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.RecordDestSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.RecordDestSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that redirects traffic destined for a specific IP address or range of IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.
  - name: aria-stop-recording-dest-subnet
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.StopRecordingDestSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.StopRecordingDestSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.StopRecordingDestSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the destination subnet logic block. This stops redirecting traffic to the Packet Recorder.
  - name: aria-alert-dest-subnet
    arguments:
    - name: target_ip
      required: true
      description: The IP address and mask of the destination IP address(es), in the format <IP_address>/<mask>. If the mask is omitted, a value of 32 is used.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: transport_type
      required: true
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. Can be email or syslog.'
    - name: tti_index
      required: true
      description: The index of the entry in the transport type table.
    - name: aio_index
      required: true
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      required: true
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      required: true
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.AlertDestSubnet.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.AlertDestSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.AlertDestSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that generates an alert when traffic destined for a specific IP address or range of IP addresses is detected.
  - name: aria-mute-alert-dest-subnet
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.MuteAlertDestSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.MuteAlertDestSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.MuteAlertDestSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the destination subnet logic block, disabling the alerts.
  - name: aria-block-src-subnet
    arguments:
    - name: src_ip
      required: true
      description: The IP address and mask of the source IP address(es), in the format <IP_address>/<mask>. If the mask is omitted, a value of 32 is used.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.BlockSrcSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.BlockSrcSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.BlockSrcSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Adds a rule that blocks packets originating from a specific IP address or range of IP addresses.
  - name: aria-unblock-src-subnet
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.UnblockSrcSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.UnblockSrcSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.UnblockSrcSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the source subnet logic block. This allows the previously blocked traffic to resume.
  - name: aria-record-src-subnet
    arguments:
    - name: src_ip
      required: true
      description: The IP address and mask of the source IP address(es), in the format <IP_address>/<mask>. If the mask is omitted, a value of 32 is used.
    - name: vlan_id
      required: true
      description: The VLAN ID your network switch uses to forward packets to the Packet Recorder.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: sia_interface
      auto: PREDEFINED
      predefined:
      - A
      - B
      description: The letter of the interface on the SIA used for forwarding packets. Can be A or B. If omitted, interface A is used.
    - name: transport_type
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. Can be email or syslog.'
    - name: tti_index
      description: The index of the entry in the transport type table.
    - name: aio_index
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.RecordSrcSubnet.Rule
      description: 'Specifies the name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.RecordSrcSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.RecordSrcSubnet.Endpoints
      description: 'Returns endpoints information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Creates a rule that redirects traffic originating from one or more specific IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.
  - name: aria-stop-recording-src-subnet
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.StopRecordingSrcSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.StopRecordingSrcSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.StopRecordingSrcSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the source subnet logic block. This stops redirecting traffic to the Packet Recorder.
  - name: aria-alert-src-subnet
    arguments:
    - name: src_ip
      required: true
      description: The IP address and mask of the source IP address(es), in the format <IP_address>/<mask>. If the mask is omitted, a value of 32 is used.
    - name: rule_name
      required: true
      description: The name of the rule to create.
    - name: transport_type
      required: true
      auto: PREDEFINED
      predefined:
      - email
      - syslog
      description: 'The type of notification to generate. '
    - name: tti_index
      required: true
      description: The index of the entry in the transport type table.
    - name: aio_index
      required: true
      description: The index of the entry in the alert information object table.
    - name: trigger_type
      required: true
      auto: PREDEFINED
      predefined:
      - one-shot
      - re-trigger-count
      - re-trigger-timed-ms
      - re-trigger-timed-sec
      description: 'The frequency of the alert. one-shot: The alert is triggered when the number of packets matching the criteria reaches the threshold specified in the trigger_value field. After the alert triggers, it is disabled until the flow expires or times out.  re-trigger-count: The alert is triggered when the number of packets that match the criteria reaches the threshold specified in the trigger_value field. The counter then resets to 0, and the alert is triggered again the next time the threshold is met. re-trigger-timed-ms: The alert is triggered, and then the application waits the amount of time (in msecs) defined in the trigger_value field. Once this time passes, the alert is triggered again. re-trigger-timed-sec: The alert is triggered, and then the application waits the amount of time (in seconds) defined in the trigger_value field. After this time passes, the alert is triggered again.'
    - name: trigger_value
      required: true
      description: The threshold that must be met before the alert is triggered. The value entered here depends on the trigger_type. If the trigger_type is one-shot or retrigger-count, this is the total number of packets that must be received before the alert is triggered. The valid range is 1-8191, If the trigger_type is re-trigger-ms or re-triggersec, this is the total number of msecs or secs, respectively, that must elapse before the alert is triggered again. The valid range is 1-8191.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.AlertSrcSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.AlertSrcSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.AlertSrcSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Adds a rule that generates an alert when traffic originating from a specific IP address or range of IP addresses is detected.
  - name: aria-mute-alert-src-subnet
    arguments:
    - name: rule_name
      required: true
      description: The name of the rule to delete.
    - name: rcs
      description: 'The remediation configuration string. Please refer to the integration documentation for more information.'
    outputs:
    - contextPath: Aria.MuteAlertSrcSubnet.Rule
      description: 'The name of the rule and the settings that define the rule.'
      type: string
    - contextPath: Aria.MuteAlertSrcSubnet.Status
      description: 'The state of the command, and the timestamp indicating when the command completed. Possible states include "Success", "Failure", or "Endpoint matching RCS not found".'
      type: string
    - contextPath: Aria.MuteAlertSrcSubnet.Endpoints
      description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.'
      type: string
    description: Removes a named rule from the source subnet logic block, disabling the alerts.
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
tests:
- No test
fromversion: 5.0.0