NetscoutAED

Use the Netscout Arbor Edge Defense integration to detect and stop both inbound threats and outbound malicious communication from compromised internal devices.

Network Security · Netscout Arbor Edge Defense - AED

Details

IDNetscoutAED
ProviderNetscout Systems
CategoryNetwork Security
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

The Netscout Arbor Edge Defense (AED) integration enables you to block and allow outbound and inbound traffic.

What does this pack do?

Using the Netscout AED integration you can:

  • Get, add, and remove hosts, countries, domains, and URLs from the inbound block list.
  • Get, add, and remove hosts from the inbound allow list.
  • Get, add, and remove hosts and countries from the outbound blaock list.
  • Get, add, and remove hosts from the outbound all.
  • Get and update the protection group (the IPv4 or IPv6 hosts that you need to protect).

Configure NetscoutAED in Cortex

Parameter Required  
Server URL True  
API Token If using 6.0.2 or lower version, put your API Key in the Password field, leave the User field empty. False
Trust any certificate (not secure) False  
Use system proxy settings False  

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

na-ed-outbound-blacklisted-countries-list

Gets the countries on the outbound block list. By default, 10 block listed countries are returned.

Base Command

na-ed-country-code-list

Gets a country or list of countries (country name and ISO-standardized country code).

Base Command

na-ed-country-code-list

Input

Argument Name Description Required
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results returned per page. Default: 10. Optional

Context Output

Path Type Description
NetscoutAED.Country.country_name String The country’s name.
NetscoutAED.Country.iso_code String The ISO-standardized country code.

Command Example

!na-ed-country-code-list limit=5

Context Example

{
    "NetscoutAED": {
        "Country": [
            {
                "country_name": "6to4 Relay Anycast",
                "iso_code": "XF"
            },
            {
                "country_name": "Afghanistan",
                "iso_code": "AF"
            },
            {
                "country_name": "Aland Islands",
                "iso_code": "AX"
            },
            {
                "country_name": "Albania",
                "iso_code": "AL"
            },
            {
                "country_name": "Algeria",
                "iso_code": "DZ"
            }
        ]
    }
}

Human Readable Output

Netscout AED Countries List

Country Name Iso Code
6to4 Relay Anycast XF
Afghanistan AF
Aland Islands AX
Albania AL
Algeria DZ

na-ed-outbound-blacklisted-countries-list

Input

Argument Name Description Required
country An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the “na-ed-country-code-list” command. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results returned per page. Default: 10. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistCountry.annotation String A message associated with each country in the outbound block list.
NetscoutAED.OutboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.OutboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "OutboundBlacklistCountry": [
            {
                "annotation": "example1",
                "country": "AZ",
                "update_time": "2021-04-13T13:06:43.000Z"
            },
            {
                "annotation": "example2",
                "country": "IS",
                "update_time": "2021-04-19T15:28:13.000Z"
            }
        ]
    }
}

Human Readable Output

Blacklisted Countries

Country Update Time Annotation
AZ 2021-04-13T13:06:43.000Z example1
IS 2021-04-19T15:28:13.000Z example2

na-ed-outbound-blacklisted-countries-add

Adds one or more countries to the outbound block list.

Base Command

na-ed-outbound-blacklisted-countries-add

Input

Argument Name Description Required
country An ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. Required
annotation A message to associate with each country that you add to the outbound block list. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistCountry.annotation String A message associated with each country in the outbound block list.
NetscoutAED.OutboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.OutboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example

!na-ed-outbound-blacklisted-countries-add country=AU

Context Example

{
    "NetscoutAED": {
        "OutboundBlacklistCountry": {
            "annotation": null,
            "country": "AU",
            "update_time": "2021-05-24T08:58:03.000Z"
        }
    }
}

Human Readable Output

Countries were successfully added to the outbound block listed list

Added Countries

Country Update Time
AU 2021-05-24T08:58:03.000Z

na-ed-outbound-blacklisted-countries-remove

Removes one or more countries from the outbound block list.

Base Command

na-ed-outbound-blacklisted-countries-remove

Input

Argument Name Description Required
country An ISO-standardized country code or a comma-separated list of ISO-standardized country codes to remove. Can be retrieved by running the “na-ed-country-code-list” command. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-outbound-blacklisted-countries-remove country=AU

Human Readable Output

Countries were successfully removed from the outbound block listed list

na-ed-inbound-blacklisted-countries-list

Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.

Base Command

na-ed-inbound-blacklisted-countries-list

Input

Argument Name Description Required
cid A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. Optional
pgid A comma-separated list of protection group IDs. Cannot be used with the cid parameter. Optional
country An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the “na-ed-country-code-list” command. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results returned per page. Default: 10. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistCountry.annotation Unknown List of messages associated with each country in the inbound block list.
NetscoutAED.InboundBlacklistCountry.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.InboundBlacklistCountry.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example

!na-ed-inbound-blacklisted-countries-list country=AM

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistCountry": {
            "annotation": [
                "example1"
            ],
            "cid": [],
            "country": "AM",
            "pgid": [
                52
            ],
            "update_time": "2021-04-19T15:36:00.000Z"
        }
    }
}

Human Readable Output

Blacklisted Countries

Country Update Time Annotation Pgid
AM 2021-04-19T15:36:00.000Z example1 52

na-ed-inbound-blacklisted-countries-add

Adds one or more countries to the inbound block list by pgid or cid.

Base Command

na-ed-inbound-blacklisted-countries-add

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
annotation A message to associate with each country that you add to the block list. Optional
country ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. Required

Context Output

Path Type Description
NetscoutAED.InboundBlacklistCountry.annotation Unknown List of messages associated with each country in the outbound block list.
NetscoutAED.InboundBlacklistCountry.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.InboundBlacklistCountry.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example

!na-ed-inbound-blacklisted-countries-add country=AU

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistCountry": {
            "annotation": [],
            "cid": [
                -1
            ],
            "country": "AU",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:57:58.000Z"
        }
    }
}

Human Readable Output

Countries were successfully added to the inbound block listed list

Added Countries

Country Cid Pgid Update Time
AU -1 -1 2021-05-24T08:57:58.000Z

na-ed-inbound-blacklisted-countries-remove

Removes one or more countries from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-countries-remove

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
country ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-countries-remove country=AU

Human Readable Output

Countries were successfully removed from the inbound block listed list

na-ed-outbound-blacklisted-hosts-list

Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.

Base Command

na-ed-outbound-blacklisted-hosts-list

Input

Argument Name Description Required
host_address Comma-separated list of IPv4 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistHost.annotation String A description of the host.
NetscoutAED.OutboundBlacklistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundBlacklistHost.update_time Date The time the host was last updated/set.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "OutboundBlacklistHost": [
            {
              "annotation": "",
              "host_address": "1.1.1.1",
              "update_time": "2021-05-24T08:58:07.000Z"
            },
            {
              "annotation": "",
              "host_address": "2.2.2.2",
              "update_time": "2021-05-24T08:58:07.000Z"
            }
        ]
    }
}

Human Readable Output

Blacklisted Hosts

Host Address Update Time
1.1.1.1 2021-05-24T08:58:07.000Z
2.2.2.2 2021-05-24T08:58:07.000Z

na-ed-outbound-blacklisted-hosts-add

Adds one or more hosts to the outbound block list.

Base Command

na-ed-outbound-blacklisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistHost.annotation String A description of the host.
NetscoutAED.OutboundBlacklistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundBlacklistHost.update_time Date The time the host was last updated/set

Command Example

!na-ed-outbound-blacklisted-hosts-add host_address=1.2.3.4

Context Example

{
    "NetscoutAED": {
        "OutboundBlacklistHost": {
            "annotation": "",
            "host_address": "1.2.3.4",
            "update_time": "2021-05-24T08:58:07.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the outbound block list list

New Hosts

Host Address Update Time
1.2.3.4 2021-05-24T08:58:07.000Z

na-ed-outbound-blacklisted-hosts-replace

Replaces all the hosts on the outbound block listed list.

Base Command

na-ed-outbound-blacklisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistHost.annotation String A description of the host.
NetscoutAED.OutboundBlacklistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundBlacklistHost.update_time Date The time the host was last updated/set.

Command Example

!na-ed-outbound-blacklisted-hosts-replace host_address=5.2.3.4

Context Example

{
    "NetscoutAED": {
        "OutboundBlacklistHost": {
            "annotation": "",
            "host_address": "5.2.3.4",
            "update_time": "2021-05-24T08:58:08.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully replaced in the outbound block list list

New Hosts

Host Address Update Time
5.2.3.4 2021-05-24T08:58:08.000Z

na-ed-outbound-blacklisted-hosts-remove

Removes one or more hosts or CIDRS from the outbound block list.

Base Command

na-ed-outbound-blacklisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR to remove, or a comma-separated list of IPv4 host addresses or CIDRs to remove. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-outbound-blacklisted-hosts-remove host_address=5.2.3.4

Human Readable Output

Hosts were successfully removed from the outbound block list list

na-ed-outbound-whitelisted-hosts-list

Gets the outbound allow listed hosts. By default, 10 hosts on allow list are returned.

Base Command

na-ed-outbound-whitelisted-hosts-list

Input

Argument Name Description Required
host_address Comma-separated list of IPv4 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit Maximal number of results to retrieve. Also sets the size of the returned page. Optional

Context Output

Path Type Description
NetscoutAED.OutboundWhitelistHost.annotation String A description of the host.
NetscoutAED.OutboundWhitelistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundWhitelistHost.update_time Date The time the host was last updated/set.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "OutboundWhitelistHost": {
            "annotation": "",
            "host_address": "4.4.4.4",
            "update_time": "2021-05-24T08:53:20.000Z"
        }
    }
}

Human Readable Output

Whitelisted Hosts

Host Address Update Time
4.4.4.4 2021-05-24T08:53:20.000Z

na-ed-outbound-whitelisted-hosts-add

Adds one or more hosts to the outbound allow listed list.

Base Command

na-ed-outbound-whitelisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to add. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundWhitelistHost.annotation String A description of the host.
NetscoutAED.OutboundWhitelistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundWhitelistHost.update_time Date The time the host was last updated/set.

Command Example

!na-ed-outbound-whitelisted-hosts-add host_address=3.3.3.3

Context Example

{
    "NetscoutAED": {
        "OutboundWhitelistHost": {
            "annotation": "",
            "host_address": "3.3.3.3",
            "update_time": "2021-05-24T08:58:19.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the outbound allow list list

New Hosts

Host Address Update Time
3.3.3.3 2021-05-24T08:58:19.000Z

na-ed-outbound-whitelisted-hosts-replace

Replaces all the hosts on the outbound allow listed list.

Base Command

na-ed-outbound-whitelisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to update. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundWhitelistHost.annotation String A description of the host.
NetscoutAED.OutboundWhitelistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundWhitelistHost.update_time Date The time the host was last updated/set.

Command Example

!na-ed-outbound-whitelisted-hosts-replace host_address=3.3.3.3,4.4.4.4

Context Example

{
    "NetscoutAED": {
        "OutboundWhitelistHost": [
            {
                "annotation": "",
                "host_address": "3.3.3.3",
                "update_time": "2021-05-24T08:58:21.000Z"
            },
            {
                "annotation": "",
                "host_address": "4.4.4.4",
                "update_time": "2021-05-24T08:58:21.000Z"
            }
        ]
    }
}

Human Readable Output

Hosts were successfully replaced in the outbound allow list list

New Hosts

Host Address Update Time
3.3.3.3 2021-05-24T08:58:21.000Z
4.4.4.4 2021-05-24T08:58:21.000Z

na-ed-protection-groups-update

Updates the settings for one or more protection groups.

Base Command

na-ed-protection-groups-update

Input

Argument Name Description Required
pgid List of protection group IDs. Required
active Set the protection group mode to active (true) or inactive (false). Default: true. Possible values are: true, false. Optional
protection_level The protection level (None = use the global protection level, low, medium, high). Default: low. Possible values are: None, low, medium, high. Optional
profiling Turn traffic profiling on (true) or off (false) for one or more of the protection groups. Possible values are: true, false. Optional
profiling_duration Required when profiling is set to true. Specify the number of days, from 1 to 14, over which profiling will run. Possible values are: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14. Optional

Context Output

Path Type Description
NetscoutAED.ProtectionGroup.active Boolean True if the protection group mode is active, false if inactive.
NetscoutAED.ProtectionGroup.bps_dropped Number Number of dropped bps.
NetscoutAED.ProtectionGroup.bps_passed Number Number of passed bps.
NetscoutAED.ProtectionGroup.bytes_dropped Number Number of dropped bytes.
NetscoutAED.ProtectionGroup.bytes_passed Unknown Number of passed bytes.
NetscoutAED.ProtectionGroup.description String Description of the protection group.
NetscoutAED.ProtectionGroup.name String Protection group name.
NetscoutAED.ProtectionGroup.packets_dropped Number Number of dropped packets.
NetscoutAED.ProtectionGroup.packets_passed Number Number of passed packets.
NetscoutAED.ProtectionGroup.pgid Number Protection group identifier.
NetscoutAED.ProtectionGroup.pps_passed Number Number of passed pps.
NetscoutAED.ProtectionGroup.pps_dropped Number Number of dropped pps.
NetscoutAED.ProtectionGroup.prefixes Unknown List of ‘,’ delimited prefixes belonging to the protection group.
NetscoutAED.ProtectionGroup.profiling Boolean A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
NetscoutAED.ProtectionGroup.profiling_duration Number The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
NetscoutAED.ProtectionGroup.profiling_start Date A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicates that profiling was never started.
NetscoutAED.ProtectionGroup.protection_level Unknown The protection level (None = use the global protection level, low, medium, high).
NetscoutAED.ProtectionGroup.server_name String The protection group’s server name.
NetscoutAED.ProtectionGroup.server_type Number The protection group’s server type.
NetscoutAED.ProtectionGroup.time_created Date The time when the protection group was created.

Command Example

!na-ed-protection-groups-update pgid=52 active=false

Context Example

{
    "NetscoutAED": {
        "ProtectionGroup": {
            "active": false,
            "bps_dropped": 0,
            "bps_passed": 0,
            "bytes_dropped": 0,
            "bytes_passed": 0,
            "description": "",
            "name": "test2",
            "packets_dropped": 0,
            "packets_passed": 0,
            "pgid": 52,
            "pps_dropped": 0,
            "pps_passed": 0,
            "prefixes": [
                "1.1.1.1/32"
            ],
            "profiling": false,
            "profiling_duration": 0,
            "profiling_start": 0,
            "protection_level": "global protection level",
            "server_name": "test2",
            "server_type": 35,
            "time_created": "2021-04-13T14:41:23.000Z"
        }
    }
}

Human Readable Output

Successfully updated the protection group object with protection group id: 52

Protection Groups

Name Pgid Protection Level Active Server Name Profiling Profiling Duration Time Created
test2 52 global protection level false test2 false 0 2021-04-13T14:41:23.000Z

na-ed-protection-groups-list

Gets a list of the protection groups.

Base Command

na-ed-protection-groups-list

Input

Argument Name Description Required
pgid Protection group identifier. Optional
name Protection group name. Optional
active Whether the protection group is active or not. Possible values are: true, false. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional

Context Output

Path Type Description
NetscoutAED.ProtectionGroup.active Boolean True if the protection group mode is active, false if inactive.
NetscoutAED.ProtectionGroup.bps_dropped Number Number of dropped bps.
NetscoutAED.ProtectionGroup.bps_passed Number Number of passed bps.
NetscoutAED.ProtectionGroup.bytes_dropped Number Number of dropped bytes.
NetscoutAED.ProtectionGroup.bytes_passed Unknown Number of passed bytes.
NetscoutAED.ProtectionGroup.description String Description of the protection group.
NetscoutAED.ProtectionGroup.name String Protection group name.
NetscoutAED.ProtectionGroup.packets_dropped Number Number of dropped packets.
NetscoutAED.ProtectionGroup.packets_passed Number Number of passed packets.
NetscoutAED.ProtectionGroup.pgid Number Protection group identifier.
NetscoutAED.ProtectionGroup.pps_passed Number Number of passed pps.
NetscoutAED.ProtectionGroup.pps_dropped Number Number of dropped pps.
NetscoutAED.ProtectionGroup.prefixes Unknown Comma-separated list of prefixes belonging to the protection group.
NetscoutAED.ProtectionGroup.profiling Boolean A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
NetscoutAED.ProtectionGroup.profiling_duration Number The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
NetscoutAED.ProtectionGroup.profiling_start Date A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicats that profiling was never started.
NetscoutAED.ProtectionGroup.protection_level Unknown The protection level (None = use the global protection level, low, medium, high).
NetscoutAED.ProtectionGroup.server_name String The protection group’s server name.
NetscoutAED.ProtectionGroup.server_type Number The protection group’s server type.
NetscoutAED.ProtectionGroup.time_created Date The time when the protection group was created.
NetscoutAED.ProtectionGroup.cid Number Central configuration ID.

Command Example

!na-ed-protection-groups-list active=true

Context Example

{
    "NetscoutAED": {
        "ProtectionGroup": {
            "active": false,
            "bps_dropped": 0,
            "bps_passed": 0,
            "bytes_dropped": 0,
            "bytes_passed": 0,
            "description": "",
            "name": "test2",
            "packets_dropped": 0,
            "packets_passed": 0,
            "pgid": 52,
            "pps_dropped": 0,
            "pps_passed": 0,
            "prefixes": [
                "1.1.1.1/32"
            ],
            "profiling": true,
            "profiling_duration": 0,
            "profiling_start": 0,
            "protection_level": "global protection level",
            "server_name": "test2",
            "server_type": 35,
            "time_created": "2021-04-13T14:41:23.000Z"
        }
    }
}

Human Readable Output

Protection Groups

Name Pgid Protection Level Active Server Name Profiling Profiling Duration Time Created
test2 52 global protection level true test2 false 0 2021-04-13T14:41:23.000Z

na-ed-inbound-blacklisted-hosts-list

Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.

Base Command

na-ed-inbound-blacklisted-hosts-list

Input

Argument Name Description Required
host_address List of ‘,’ delimited IPv4 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistHost.annotation Unknown List of messages associated with each host in the inbound block list.
NetscoutAED.InboundBlacklistHost.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundBlacklistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistHost.update_time Date The time that the host address was added to the list.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "InboundBlacklistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "1.1.1.1",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:13.000Z"
        }
    }
}

Human Readable Output

Blacklisted Hosts

Host Address Pgid Cid Update Time Annotation
1.1.1.1 -1 -1 2021-05-24T08:58:13.000Z  

na-ed-inbound-blacklisted-hosts-add

Adds one or more hosts to the inbound block listed list.

Base Command

na-ed-inbound-blacklisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistHost.annotation Unknown List of messages associated with each host in the inbound block list.
NetscoutAED.InboundBlacklistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundBlacklistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundBlacklistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistHostupdate_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-blacklisted-hosts-add host_address=1.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "1.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:13.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the inbound block list list

New Hosts

Host Address Pgid Cid Update Time Annotation
1.2.3.4 -1 -1 2021-05-24T08:58:13.000Z  

na-ed-inbound-blacklisted-hosts-replace

Replaces all the hosts on the inbound block list.

Base Command

na-ed-inbound-blacklisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistHost.annotation Unknown List of messages associated with each host in the inbound block list.
NetscoutAED.InboundBlacklistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundBlacklistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundBlacklistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistHost.update_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-blacklisted-hosts-replace host_address=5.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "5.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:15.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully replaced in the inbound block list list

New Hosts

Host Address Pgid Cid Update Time Annotation
5.2.3.4 -1 -1 2021-05-24T08:58:15.000Z  

na-ed-inbound-blacklisted-hosts-remove

Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-hosts-remove host_address=5.2.3.4

Human Readable Output

Hosts were successfully removed from the inbound block list list

na-ed-inbound-whitelisted-hosts-list

Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.

Base Command

na-ed-inbound-whitelisted-hosts-list

Input

Argument Name Description Required
host_address Comma-separated list of IPv4 or IPv6 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundWhitelistHost.annotation Unknown List of messages associated with each host in the inbound allow listed list.
NetscoutAED.InboundWhitelistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundWhitelistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundWhitelistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundWhitelistHost.update_time Date The time that the host address was added to the list.

Command Example


```json
{
    "NetscoutAED": {
        "InboundWhitelistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "2.2.2.2",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:25.000Z"
        }
    }
}

Human Readable Output

Whitelisted Hosts

Host Address Pgid Cid Update Time Annotation
2.2.2.2 -1 -1 2021-05-24T08:58:25.000Z  

na-ed-inbound-whitelisted-hosts-add

Adds one or more hosts to the inbound allow listed list.

Base Command

na-ed-inbound-whitelisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to add. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundWhitelistHost.annotation Unknown List of messages associated with each host in the inbound allow listed list.
NetscoutAED.InboundWhitelistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundWhitelistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundWhitelistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundWhitelistHost.update_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-whitelisted-hosts-add host_address=1.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundWhitelistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "1.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:25.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the inbound allow list list

New Hosts

Host Address Pgid Cid Update Time Annotation
1.2.3.4 -1 -1 2021-05-24T08:58:25.000Z  

na-ed-inbound-whitelisted-hosts-replace

Replaces all the hosts on the inbound allow list.

Base Command

na-ed-inbound-whitelisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to update. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundWhitelistHost.annotation Unknown List of messages associated with each host in the inbound allow listed list.
NetscoutAED.InboundWhitelistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundWhitelistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundWhitelistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundWhitelistHost.update_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-whitelisted-hosts-replace host_address=5.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundWhitelistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "5.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:26.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully replaced in the inbound allow list list

New Hosts

Host Address Pgid Cid Update Time Annotation
5.2.3.4 -1 -1 2021-05-24T08:58:26.000Z  

na-ed-inbound-whitelisted-hosts-remove

Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-whitelisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs to remove. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-whitelisted-hosts-remove host_address=5.2.3.4

Human Readable Output

Hosts were successfully removed from the inbound whitelist list

na-ed-inbound-blacklisted-domains-list

Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.

Base Command

na-ed-inbound-blacklisted-domains-list

Input

Argument Name Description Required
cid Comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. Optional
pgid Comma-separated list of protection group IDs. Cannot be used with the cid parameter. Optional
domain Comma-separated list of domains. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistDomain.annotation Unknown List of messages associated with each domain in the inbound block list.
NetscoutAED.InboundBlacklistDomain.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistDomain.domain String Domain name.
NetscoutAED.InboundBlacklistDomain.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistDomain.update_time Date The time that the domain was added to the list.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "InboundBlacklistDomain": [
            {
                "annotation": [
                    "try1"
                ],
                "cid": [
                    -1
                ],
                "domain": "sport.co.il",
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-15T16:00:24.000Z"
            },
            {
                "annotation": [],
                "cid": [
                    -1
                ],
                "domain": "sport.com",
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T17:25:26.000Z"
            },
            {
                "annotation": [],
                "cid": [
                    -1
                ],
                "domain": "ynet.com",
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T16:49:50.000Z"
            }
        ]
    }
}

Human Readable Output

Blacklisted Domains

Domain Pgid Cid Update Time Annotation
sport.co.il -1 -1 2021-03-15T16:00:24.000Z try1
sport.com -1 -1 2021-03-18T17:25:26.000Z  
ynet.com -1 -1 2021-03-18T16:49:50.000Z  

na-ed-inbound-blacklisted-domains-add

Adds one or more domains to the block list by pgid or cid.

Base Command

na-ed-inbound-blacklisted-domains-add

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
domain Domain name or a comma-separated list of domain names. Required
annotation A message to associate with each domain that you add to the block list. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistDomain.annotation Unknown List of messages associated with each domain in the inbound blaok list.
NetscoutAED.InboundBlacklistDomain.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistDomain.domain String Domain name.
NetscoutAED.InboundBlacklistDomain.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistDomain.update_time Unknown The time that the domain was added to the list.

Command Example

!na-ed-inbound-blacklisted-domains-add domain=goo.com

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistDomain": {
            "annotation": [],
            "cid": [
                -1
            ],
            "domain": "goo.com",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:34.000Z"
        }
    }
}

Human Readable Output

Domains were successfully added to the inbound block listed list

Added Domains

Domain Pgid Cid Update Time
goo.com -1 -1 2021-05-24T08:58:34.000Z

na-ed-inbound-blacklisted-domains-remove

Removes one or more domains from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-domains-remove

Input

Argument Name Description Required
domain Domain name or a comma-separated list of domain names. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-domains-remove domain=goo.com

Human Readable Output

Domains were successfully removed from the inbound block listed list

na-ed-inbound-blacklisted-urls-list

Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.

Base Command

na-ed-inbound-blacklisted-urls-list

Input

Argument Name Description Required
cid Comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. Optional
pgid Comma-separated list of protection group IDs. Cannot be used with the cid parameter. Optional
url Comma-separated list of URLs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit Maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistUrl.annotation Unknown List of messages associated with each URL in the inbound block list.
NetscoutAED.InboundBlacklistUrl.cid Unknown List of central configuration ID.s
NetscoutAED.InboundBlacklistUrl.url String URL address.
NetscoutAED.InboundBlacklistUrl.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistUrl.update_time Date The time that the domain was added to the list.

Command Example

!na-ed-inbound-blacklisted-urls-list limit=3

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistUrl": [
            {
                "annotation": [],
                "cid": [
                    -1
                ],
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T16:52:26.000Z",
                "url": "google.com"
            },
            {
                "annotation": [
                    "Google Maps"
                ],
                "cid": [
                    -1
                ],
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T18:08:39.000Z",
                "url": "maps.google.com"
            },
            {
                "annotation": [
                    "Google Maps"
                ],
                "cid": [
                    -1
                ],
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T18:08:27.000Z",
                "url": "maps.google.com/sport.com"
            }
        ]
    }
}

Human Readable Output

Blacklisted URLs

Url Pgid Cid Update Time Annotation
google.com -1 -1 2021-03-18T16:52:26.000Z  
maps.google.com -1 -1 2021-03-18T18:08:39.000Z Google Maps
maps.google.com/sport.com -1 -1 2021-03-18T18:08:27.000Z Google Maps

na-ed-inbound-blacklisted-urls-add

Adds one or more URLs to the block list by pgid or cid.

Base Command

na-ed-inbound-blacklisted-urls-add

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
url URL or a comma-separated list of URLs to add. Required
annotation A message to associate with each URL that you add to the block list. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistUrl.annotation Unknown List of messages associated with each url in the inbound block list.
NetscoutAED.InboundBlacklistUrl.cid Unknown List of central configuration IDs
NetscoutAED.InboundBlacklistUrl.url String URL address.
NetscoutAED.InboundBlacklistUrl.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistUrl.update_time Date The time that the domain was added to the list.

Command Example

!na-ed-inbound-blacklisted-urls-add url=www.goo.com

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistUrl": {
            "annotation": [],
            "cid": [
                -1
            ],
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:39.000Z",
            "url": "www.goo.com"
        }
    }
}

Human Readable Output

Urls were successfully added to the inbound block listed list

Added Urls

Url Pgid Cid Update Time
www.goo.com -1 -1 2021-05-24T08:58:39.000Z

na-ed-inbound-blacklisted-urls-remove

Removes one or more URLs from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-urls-remove

Input

Argument Name Description Required
url URL or a comma-separated list of URLs. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-urls-remove url=www.goo.com

Human Readable Output

Urls were successfully removed from the inbound block listed list

na-ed-outbound-whitelisted-hosts-remove

Removes one or more hosts or CIDRs from the outbound allow list.

Base Command

na-ed-outbound-whitelisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR, or a comma-separated list of IPv4 host addresses or CIDRs to remove. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-outbound-whitelisted-hosts-remove host_address=3.3.3.3

Human Readable Output

Hosts were successfully removed from the outbound allow list list

Configuration parameters

  • base_url — Server URL (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • User —

Commands (31)

  • na-ed-country-code-list

    Gets a country or list of countries (country name and ISO-standardized country code).

  • na-ed-inbound-blacklisted-countries-add

    Adds one or more countries to the inbound block list by pgid or cid.

  • na-ed-inbound-blacklisted-countries-list

    Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.

  • na-ed-inbound-blacklisted-countries-remove

    Removes one or more countries from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-blacklisted-domains-add

    Adds one or more domains to the block list by pgid or cid.

  • na-ed-inbound-blacklisted-domains-list

    Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.

  • na-ed-inbound-blacklisted-domains-remove

    Removes one or more domains from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-blacklisted-hosts-add

    Adds one or more hosts to the inbound block listed list.

  • na-ed-inbound-blacklisted-hosts-list

    Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.

  • na-ed-inbound-blacklisted-hosts-remove

    Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-blacklisted-hosts-replace

    Replaces all the hosts on the inbound block list.

  • na-ed-inbound-blacklisted-urls-add

    Adds one or more URLs to the block list by pgid or cid.

  • na-ed-inbound-blacklisted-urls-list

    Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.

  • na-ed-inbound-blacklisted-urls-remove

    Removes one or more URLs from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-whitelisted-hosts-add

    Adds one or more hosts to the inbound allow listed list.

  • na-ed-inbound-whitelisted-hosts-list

    Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.

  • na-ed-inbound-whitelisted-hosts-remove

    Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.

  • na-ed-inbound-whitelisted-hosts-replace

    Replaces all the hosts on the inbound allow list.

  • na-ed-outbound-blacklisted-countries-add

    Adds one or more countries to the outbound block list.

  • na-ed-outbound-blacklisted-countries-list

    Gets the countries on the outbound block list. By default, 10 block listed countries are returned.

  • na-ed-outbound-blacklisted-countries-remove

    Removes one or more countries from the outbound block list.

  • na-ed-outbound-blacklisted-hosts-add

    Adds one or more hosts to the outbound block list.

  • na-ed-outbound-blacklisted-hosts-list

    Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.

  • na-ed-outbound-blacklisted-hosts-remove

    Removes one or more hosts or CIDRS from the outbound block list.

  • na-ed-outbound-blacklisted-hosts-replace

    Replaces all the hosts on the outbound block listed list.

  • na-ed-outbound-whitelisted-hosts-add

    Adds one or more hosts to the outbound whitelisted list.

  • na-ed-outbound-whitelisted-hosts-list

    Gets the outbound hosts on allow list. By default, 10 hosts on allow list are returned.

  • na-ed-outbound-whitelisted-hosts-remove

    Removes one or more hosts or CIDRs from the outbound allow list.

  • na-ed-outbound-whitelisted-hosts-replace

    Replaces all the hosts on the outbound allow listed list.

  • na-ed-protection-groups-list

    Gets a list of the protection groups.

  • na-ed-protection-groups-update

    Updates the settings for one or more protection groups.

Source

NetscoutAED.py NetscoutAED_test.py NetscoutAED.yml NetscoutAED_description.md command_examples.txt
Download History Raw 
category: Network Security
provider: Netscout Systems
commonfields:
  id: NetscoutAED
  version: -1
configuration:
- display: Server URL
  name: base_url
  required: true
  type: 0
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- name: User
  displaypassword: API Key
  hiddenusername: true
  type: 9
  required: false
description: Use the Netscout Arbor Edge Defense integration to detect and stop both inbound threats and outbound malicious communication from compromised internal devices.
display: Netscout Arbor Edge Defense
name: NetscoutAED
script:
  commands:
  - arguments:
    - description: An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the "na-ed-country-code-list" command.
      name: country
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the countries on the outbound block list. By default, 10 block listed countries are returned.
    name: na-ed-outbound-blacklisted-countries-list
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistCountry.annotation
      description: A message associated with each country in the outbound block list.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets a country or list of countries (country name and ISO-standardized country code).
    name: na-ed-country-code-list
    outputs:
    - contextPath: NetscoutAED.Country.country_name
      description: The country's name.
      type: String
    - contextPath: NetscoutAED.Country.iso_code
      description: The ISO-standardized country code.
      type: String
  - arguments:
    - description: An ISO standardized country code or a comma-separated list of country codes. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    - description: A message to associate with each country that you add to the outbound block list.
      name: annotation
    description: Adds one or more countries to the outbound block list.
    name: na-ed-outbound-blacklisted-countries-add
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistCountry.annotation
      description: A message associated with each country in the outbound block list.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: An ISO-standardized country code or a comma-separated list of ISO-standardized country codes to remove. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    description: Removes one or more countries from the outbound block list.
    name: na-ed-outbound-blacklisted-countries-remove
  - arguments:
    - description: A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter.
      isArray: true
      name: cid
    - description: A comma-separated list of protection group IDs. Cannot be used with the cid parameter.
      isArray: true
      name: pgid
    - description: An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the "na-ed-country-code-list"command.
      name: country
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.
    name: na-ed-inbound-blacklisted-countries-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistCountry.annotation
      description: List of messages associated with each country in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistCountry.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: A message to associate with each country that you add to the inbound block list.
      name: annotation
    - description: ISO standardized country code or a comma-separated list of country codes. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    description: Adds one or more countries to the inbound block list by pgid or cid.
    name: na-ed-inbound-blacklisted-countries-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistCountry.annotation
      description: List of messages associated with each country in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistCountry.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: ISO standardized country code or a comma-separated list of country codes. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    description: Removes one or more countries from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-countries-remove
  - arguments:
    - description: A comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.
    name: na-ed-outbound-blacklisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the outbound block list.
    name: na-ed-outbound-blacklisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the outbound block listed list.
    name: na-ed-outbound-blacklisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR to remove, or a comma-separated list of IPv4 host addresses or CIDRs to remove.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRS from the outbound block list.
    name: na-ed-outbound-blacklisted-hosts-remove
  - arguments:
    - description: A comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the outbound hosts on allow list. By default, 10 hosts on allow list are returned.
    name: na-ed-outbound-whitelisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.OutboundWhitelistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to add.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the outbound whitelisted list.
    name: na-ed-outbound-whitelisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.OutboundWhitelistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to update.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the outbound allow listed list.
    name: na-ed-outbound-whitelisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.OutboundWhitelistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: List of protection group IDs.
      name: pgid
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: 'Set the protection group mode to active (true) or inactive (false).'
      name: active
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: low
      description: 'The protection level (None = use the global protection level, low, medium, high).'
      name: protection_level
      predefined:
      - low
      - medium
      - high
    - auto: PREDEFINED
      description: Turn traffic profiling on (true) or off (false) for one or more of the protection groups.
      name: profiling
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify the number of days, from 1 to 14, over which profiling will run. Required when profiling is set to true.
      name: profiling_duration
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      - '8'
      - '9'
      - '10'
      - '11'
      - '12'
      - '13'
      - '14'
    description: Updates the settings for one or more protection groups.
    name: na-ed-protection-groups-update
    outputs:
    - contextPath: NetscoutAED.ProtectionGroup.active
      description: True if the protection group mode is active, false if inactive.
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.bps_dropped
      description: Number of dropped bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bps_passed
      description: Number of passed bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_dropped
      description: Number of dropped bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_passed
      description: Number of passed bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.description
      description: Description of the protection group.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.name
      description: Protection group name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.packets_dropped
      description: Number of dropped packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.packets_passed
      description: Number of passed packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pgid
      description: Protection group identifier.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_passed
      description: Number of passed pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_dropped
      description: Number of dropped pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.prefixes
      description: A comma-separated list of prefixes belonging to the protection group.
      type: Unknown
    - contextPath: NetscoutAED.ProtectionGroup.profiling
      description: A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.profiling_duration
      description: The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.profiling_start
      description: A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicates that profiling was never started.
      type: Date
    - contextPath: NetscoutAED.ProtectionGroup.protection_level
      description: The protection level (None = use the global protection level, low, medium, high).
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_name
      description: The protection group’s server name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_type
      description: The protection group’s server type.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.time_created
      description: The time when the protection group was created.
      type: Date
  - arguments:
    - description: Protection group identifier.
      name: pgid
    - description: Protection group name.
      name: name
    - auto: PREDEFINED
      description: Whether the protection group is active or not.
      name: active
      predefined:
      - 'true'
      - 'false'
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    description: Gets a list of the protection groups.
    name: na-ed-protection-groups-list
    outputs:
    - contextPath: NetscoutAED.ProtectionGroup.active
      description: True if the protection group mode is active, false if inactive.
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.bps_dropped
      description: Number of dropped bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bps_passed
      description: Number of passed bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_dropped
      description: Number of dropped bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_passed
      description: Number of passed bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.description
      description: Description of the protection group.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.name
      description: Protection group name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.packets_dropped
      description: Number of dropped packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.packets_passed
      description: Number of passed packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pgid
      description: Protection group identifier.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_passed
      description: Number of passed pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_dropped
      description: Number of dropped pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.prefixes
      description: A comma-separated list of prefixes belonging to the protection group.
      type: Unknown
    - contextPath: NetscoutAED.ProtectionGroup.profiling
      description: A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.profiling_duration
      description: The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.profiling_start
      description: A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicates that profiling was never started.
      type: Date
    - contextPath: NetscoutAED.ProtectionGroup.protection_level
      description: The protection level (None = use the global protection level, low, medium, high).
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_name
      description: The protection group’s server name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_type
      description: The protection group’s server type.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.time_created
      description: The time when the protection group was created.
      type: Date
    - contextPath: NetscoutAED.ProtectionGroup.cid
      description: Central configuration ID.
      type: Number
  - arguments:
    - description: A comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.
    name: na-ed-inbound-blacklisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistHost.annotation
      description: List of messages associated with each host in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the inbound block listed list.
    name: na-ed-inbound-blacklisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistHost.annotation
      description: List of messages associated with each host in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHostupdate_time
      description: The time that the host address was added to the list.
      type: Date
    compliantpolicies:
    - IP Blockage
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the inbound block list.
    name: na-ed-inbound-blacklisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistHost.annotation
      description: List of messages associated with each host in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-hosts-remove
  - arguments:
    - description: A comma-separated list of IPv4 or IPv6 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.
    name: na-ed-inbound-whitelisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.InboundWhitelistHost.annotation
      description: List of messages associated with each host in the inbound allow listed list.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundWhitelistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to add.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the inbound allow listed list.
    name: na-ed-inbound-whitelisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.InboundWhitelistHost.annotation
      description: List of messages associated with each host in the inbound allow listed list.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundWhitelistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to update.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the inbound allow list.
    name: na-ed-inbound-whitelisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.InboundWhitelistHost.annotation
      description: List of messages associated with each host in the inbound allow listed list.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundWhitelistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs to remove.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.
    name: na-ed-inbound-whitelisted-hosts-remove
  - arguments:
    - description: A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter.
      isArray: true
      name: cid
    - description: A comma-separated list of protection group IDs. Cannot be used with the cid parameter.
      isArray: true
      name: pgid
    - description: A comma-separated list of domains.
      isArray: true
      name: domain
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.
    name: na-ed-inbound-blacklisted-domains-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistDomain.annotation
      description: List of messages associated with each domain in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.domain
      description: Domain name.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistDomain.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: Domain name or a comma-separated list of domain names.
      isArray: true
      name: domain
      required: true
    - description: A message to associate with each domain that you add to the block list.
      name: annotation
    description: Adds one or more domains to the block list by pgid or cid.
    name: na-ed-inbound-blacklisted-domains-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistDomain.annotation
      description: List of messages associated with each domain in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.domain
      description: Domain name.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistDomain.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: Domain name or a comma-separated list of domain names.
      isArray: true
      name: domain
      required: true
    description: Removes one or more domains from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-domains-remove
  - arguments:
    - description: A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter.
      isArray: true
      name: cid
    - description: A comma-separated list of protection group IDs. Cannot be used with the cid parameter.
      isArray: true
      name: pgid
    - description: A comma-separated list of URLs.
      isArray: true
      name: url
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.
    name: na-ed-inbound-blacklisted-urls-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistUrl.annotation
      description: List of messages associated with each url in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.url
      description: URL address.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistUrl.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: URL or a comma-separated list of URLs to add.
      isArray: true
      name: url
      required: true
    - description: A message to associate with each URL that you add to the block list.
      name: annotation
    description: Adds one or more URLs to the block list by pgid or cid.
    name: na-ed-inbound-blacklisted-urls-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistUrl.annotation
      description: List of messages associated with each url in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.url
      description: URL address.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistUrl.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: URL or a comma-separated list of URLs.
      isArray: true
      name: url
      required: true
    description: Removes one or more URLs from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-urls-remove
  - arguments:
    - description: A single IPv4 host address or CIDR, or a comma-separated list of IPv4 host addresses or CIDRs to remove.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRs from the outbound allow list.
    name: na-ed-outbound-whitelisted-hosts-remove
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- NetscoutAED-Test
defaultclassifier: 'null'
fromversion: 5.5.0