NetscoutAED
Use the Netscout Arbor Edge Defense integration to detect and stop both inbound threats and outbound malicious communication from compromised internal devices.
Network Security · Netscout Arbor Edge Defense - AED
Details
| ID | NetscoutAED |
|---|---|
| Provider | Netscout Systems |
| Category | Network Security |
| From Version | 5.5.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
The Netscout Arbor Edge Defense (AED) integration enables you to block and allow outbound and inbound traffic.
What does this pack do?
Using the Netscout AED integration you can:
- Get, add, and remove hosts, countries, domains, and URLs from the inbound block list.
- Get, add, and remove hosts from the inbound allow list.
- Get, add, and remove hosts and countries from the outbound blaock list.
- Get, add, and remove hosts from the outbound all.
- Get and update the protection group (the IPv4 or IPv6 hosts that you need to protect).
Configure NetscoutAED in Cortex
| Parameter | Required | |
|---|---|---|
| Server URL | True | |
| API Token | If using 6.0.2 or lower version, put your API Key in the Password field, leave the User field empty. | False |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
na-ed-outbound-blacklisted-countries-list
Gets the countries on the outbound block list. By default, 10 block listed countries are returned.
Base Command
na-ed-country-code-list
Gets a country or list of countries (country name and ISO-standardized country code).
Base Command
na-ed-country-code-list
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | The maximum number of results returned per page. Default: 10. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.Country.country_name | String | The country’s name. |
| NetscoutAED.Country.iso_code | String | The ISO-standardized country code. |
Command Example
!na-ed-country-code-list limit=5
Context Example
{
"NetscoutAED": {
"Country": [
{
"country_name": "6to4 Relay Anycast",
"iso_code": "XF"
},
{
"country_name": "Afghanistan",
"iso_code": "AF"
},
{
"country_name": "Aland Islands",
"iso_code": "AX"
},
{
"country_name": "Albania",
"iso_code": "AL"
},
{
"country_name": "Algeria",
"iso_code": "DZ"
}
]
}
}
Human Readable Output
Netscout AED Countries List
Country Name Iso Code 6to4 Relay Anycast XF Afghanistan AF Aland Islands AX Albania AL Algeria DZ
na-ed-outbound-blacklisted-countries-list
Input
| Argument Name | Description | Required |
|---|---|---|
| country | An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the “na-ed-country-code-list” command. | Optional |
| query | Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | The maximum number of results returned per page. Default: 10. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundBlacklistCountry.annotation | String | A message associated with each country in the outbound block list. |
| NetscoutAED.OutboundBlacklistCountry.country | String | An ISO-standardized country code. |
| NetscoutAED.OutboundBlacklistCountry.update_time | Date | The time that the country code was added to the list. |
Command Example
#### Context Example
```json
{
"NetscoutAED": {
"OutboundBlacklistCountry": [
{
"annotation": "example1",
"country": "AZ",
"update_time": "2021-04-13T13:06:43.000Z"
},
{
"annotation": "example2",
"country": "IS",
"update_time": "2021-04-19T15:28:13.000Z"
}
]
}
}
Human Readable Output
Blacklisted Countries
Country Update Time Annotation AZ 2021-04-13T13:06:43.000Z example1 IS 2021-04-19T15:28:13.000Z example2
na-ed-outbound-blacklisted-countries-add
Adds one or more countries to the outbound block list.
Base Command
na-ed-outbound-blacklisted-countries-add
Input
| Argument Name | Description | Required |
|---|---|---|
| country | An ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. | Required |
| annotation | A message to associate with each country that you add to the outbound block list. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundBlacklistCountry.annotation | String | A message associated with each country in the outbound block list. |
| NetscoutAED.OutboundBlacklistCountry.country | String | An ISO-standardized country code. |
| NetscoutAED.OutboundBlacklistCountry.update_time | Date | The time that the country code was added to the list. |
Command Example
!na-ed-outbound-blacklisted-countries-add country=AU
Context Example
{
"NetscoutAED": {
"OutboundBlacklistCountry": {
"annotation": null,
"country": "AU",
"update_time": "2021-05-24T08:58:03.000Z"
}
}
}
Human Readable Output
Countries were successfully added to the outbound block listed list
Added Countries
Country Update Time AU 2021-05-24T08:58:03.000Z
na-ed-outbound-blacklisted-countries-remove
Removes one or more countries from the outbound block list.
Base Command
na-ed-outbound-blacklisted-countries-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| country | An ISO-standardized country code or a comma-separated list of ISO-standardized country codes to remove. Can be retrieved by running the “na-ed-country-code-list” command. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-outbound-blacklisted-countries-remove country=AU
Human Readable Output
Countries were successfully removed from the outbound block listed list
na-ed-inbound-blacklisted-countries-list
Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.
Base Command
na-ed-inbound-blacklisted-countries-list
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. | Optional |
| pgid | A comma-separated list of protection group IDs. Cannot be used with the cid parameter. | Optional |
| country | An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the “na-ed-country-code-list” command. | Optional |
| query | Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | The maximum number of results returned per page. Default: 10. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistCountry.annotation | Unknown | List of messages associated with each country in the inbound block list. |
| NetscoutAED.InboundBlacklistCountry.cid | Unknown | List of central configuration IDs. |
| NetscoutAED.InboundBlacklistCountry.country | String | An ISO-standardized country code. |
| NetscoutAED.InboundBlacklistCountry.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistCountry.update_time | Date | The time that the country code was added to the list. |
Command Example
!na-ed-inbound-blacklisted-countries-list country=AM
Context Example
{
"NetscoutAED": {
"InboundBlacklistCountry": {
"annotation": [
"example1"
],
"cid": [],
"country": "AM",
"pgid": [
52
],
"update_time": "2021-04-19T15:36:00.000Z"
}
}
}
Human Readable Output
Blacklisted Countries
Country Update Time Annotation Pgid AM 2021-04-19T15:36:00.000Z example1 52
na-ed-inbound-blacklisted-countries-add
Adds one or more countries to the inbound block list by pgid or cid.
Base Command
na-ed-inbound-blacklisted-countries-add
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. | Optional |
| pgid | A specific protection group ID or -1 for global. Cannot be used with the cid parameter. | Optional |
| annotation | A message to associate with each country that you add to the block list. | Optional |
| country | ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistCountry.annotation | Unknown | List of messages associated with each country in the outbound block list. |
| NetscoutAED.InboundBlacklistCountry.cid | Unknown | List of central configuration IDs. |
| NetscoutAED.InboundBlacklistCountry.country | String | An ISO-standardized country code. |
| NetscoutAED.InboundBlacklistCountry.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistCountry.update_time | Date | The time that the country code was added to the list. |
Command Example
!na-ed-inbound-blacklisted-countries-add country=AU
Context Example
{
"NetscoutAED": {
"InboundBlacklistCountry": {
"annotation": [],
"cid": [
-1
],
"country": "AU",
"pgid": [
-1
],
"update_time": "2021-05-24T08:57:58.000Z"
}
}
}
Human Readable Output
Countries were successfully added to the inbound block listed list
Added Countries
Country Cid Pgid Update Time AU -1 -1 2021-05-24T08:57:58.000Z
na-ed-inbound-blacklisted-countries-remove
Removes one or more countries from the block list for a specific protection group or for all protection groups.
Base Command
na-ed-inbound-blacklisted-countries-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. | Optional |
| pgid | A specific protection group ID or -1 for global. Cannot be used with the cid parameter. | Optional |
| country | ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-inbound-blacklisted-countries-remove country=AU
Human Readable Output
Countries were successfully removed from the inbound block listed list
na-ed-outbound-blacklisted-hosts-list
Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.
Base Command
na-ed-outbound-blacklisted-hosts-list
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | Comma-separated list of IPv4 host addresses or CIDRs. | Optional |
| query | Search strings, separated by “+” to filter the results. (example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | The maximum number of results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundBlacklistHost.annotation | String | A description of the host. |
| NetscoutAED.OutboundBlacklistHost.host_address | String | IPv4 host address or CIDRs. |
| NetscoutAED.OutboundBlacklistHost.update_time | Date | The time the host was last updated/set. |
Command Example
#### Context Example
```json
{
"NetscoutAED": {
"OutboundBlacklistHost": [
{
"annotation": "",
"host_address": "1.1.1.1",
"update_time": "2021-05-24T08:58:07.000Z"
},
{
"annotation": "",
"host_address": "2.2.2.2",
"update_time": "2021-05-24T08:58:07.000Z"
}
]
}
}
Human Readable Output
Blacklisted Hosts
Host Address Update Time 1.1.1.1 2021-05-24T08:58:07.000Z 2.2.2.2 2021-05-24T08:58:07.000Z
na-ed-outbound-blacklisted-hosts-add
Adds one or more hosts to the outbound block list.
Base Command
na-ed-outbound-blacklisted-hosts-add
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundBlacklistHost.annotation | String | A description of the host. |
| NetscoutAED.OutboundBlacklistHost.host_address | String | IPv4 host address or CIDRs. |
| NetscoutAED.OutboundBlacklistHost.update_time | Date | The time the host was last updated/set |
Command Example
!na-ed-outbound-blacklisted-hosts-add host_address=1.2.3.4
Context Example
{
"NetscoutAED": {
"OutboundBlacklistHost": {
"annotation": "",
"host_address": "1.2.3.4",
"update_time": "2021-05-24T08:58:07.000Z"
}
}
}
Human Readable Output
Hosts were successfully added to the outbound block list list
New Hosts
Host Address Update Time 1.2.3.4 2021-05-24T08:58:07.000Z
na-ed-outbound-blacklisted-hosts-replace
Replaces all the hosts on the outbound block listed list.
Base Command
na-ed-outbound-blacklisted-hosts-replace
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundBlacklistHost.annotation | String | A description of the host. |
| NetscoutAED.OutboundBlacklistHost.host_address | String | IPv4 host address or CIDRs. |
| NetscoutAED.OutboundBlacklistHost.update_time | Date | The time the host was last updated/set. |
Command Example
!na-ed-outbound-blacklisted-hosts-replace host_address=5.2.3.4
Context Example
{
"NetscoutAED": {
"OutboundBlacklistHost": {
"annotation": "",
"host_address": "5.2.3.4",
"update_time": "2021-05-24T08:58:08.000Z"
}
}
}
Human Readable Output
Hosts were successfully replaced in the outbound block list list
New Hosts
Host Address Update Time 5.2.3.4 2021-05-24T08:58:08.000Z
na-ed-outbound-blacklisted-hosts-remove
Removes one or more hosts or CIDRS from the outbound block list.
Base Command
na-ed-outbound-blacklisted-hosts-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 host address or CIDR to remove, or a comma-separated list of IPv4 host addresses or CIDRs to remove. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-outbound-blacklisted-hosts-remove host_address=5.2.3.4
Human Readable Output
Hosts were successfully removed from the outbound block list list
na-ed-outbound-whitelisted-hosts-list
Gets the outbound allow listed hosts. By default, 10 hosts on allow list are returned.
Base Command
na-ed-outbound-whitelisted-hosts-list
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | Comma-separated list of IPv4 host addresses or CIDRs. | Optional |
| query | Search strings, separated by “+” to filter the results. (example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | Maximal number of results to retrieve. Also sets the size of the returned page. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundWhitelistHost.annotation | String | A description of the host. |
| NetscoutAED.OutboundWhitelistHost.host_address | String | IPv4 host address or CIDRs. |
| NetscoutAED.OutboundWhitelistHost.update_time | Date | The time the host was last updated/set. |
Command Example
#### Context Example
```json
{
"NetscoutAED": {
"OutboundWhitelistHost": {
"annotation": "",
"host_address": "4.4.4.4",
"update_time": "2021-05-24T08:53:20.000Z"
}
}
}
Human Readable Output
Whitelisted Hosts
Host Address Update Time 4.4.4.4 2021-05-24T08:53:20.000Z
na-ed-outbound-whitelisted-hosts-add
Adds one or more hosts to the outbound allow listed list.
Base Command
na-ed-outbound-whitelisted-hosts-add
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to add. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundWhitelistHost.annotation | String | A description of the host. |
| NetscoutAED.OutboundWhitelistHost.host_address | String | IPv4 host address or CIDRs. |
| NetscoutAED.OutboundWhitelistHost.update_time | Date | The time the host was last updated/set. |
Command Example
!na-ed-outbound-whitelisted-hosts-add host_address=3.3.3.3
Context Example
{
"NetscoutAED": {
"OutboundWhitelistHost": {
"annotation": "",
"host_address": "3.3.3.3",
"update_time": "2021-05-24T08:58:19.000Z"
}
}
}
Human Readable Output
Hosts were successfully added to the outbound allow list list
New Hosts
Host Address Update Time 3.3.3.3 2021-05-24T08:58:19.000Z
na-ed-outbound-whitelisted-hosts-replace
Replaces all the hosts on the outbound allow listed list.
Base Command
na-ed-outbound-whitelisted-hosts-replace
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to update. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.OutboundWhitelistHost.annotation | String | A description of the host. |
| NetscoutAED.OutboundWhitelistHost.host_address | String | IPv4 host address or CIDRs. |
| NetscoutAED.OutboundWhitelistHost.update_time | Date | The time the host was last updated/set. |
Command Example
!na-ed-outbound-whitelisted-hosts-replace host_address=3.3.3.3,4.4.4.4
Context Example
{
"NetscoutAED": {
"OutboundWhitelistHost": [
{
"annotation": "",
"host_address": "3.3.3.3",
"update_time": "2021-05-24T08:58:21.000Z"
},
{
"annotation": "",
"host_address": "4.4.4.4",
"update_time": "2021-05-24T08:58:21.000Z"
}
]
}
}
Human Readable Output
Hosts were successfully replaced in the outbound allow list list
New Hosts
Host Address Update Time 3.3.3.3 2021-05-24T08:58:21.000Z 4.4.4.4 2021-05-24T08:58:21.000Z
na-ed-protection-groups-update
Updates the settings for one or more protection groups.
Base Command
na-ed-protection-groups-update
Input
| Argument Name | Description | Required |
|---|---|---|
| pgid | List of protection group IDs. | Required |
| active | Set the protection group mode to active (true) or inactive (false). Default: true. Possible values are: true, false. | Optional |
| protection_level | The protection level (None = use the global protection level, low, medium, high). Default: low. Possible values are: None, low, medium, high. | Optional |
| profiling | Turn traffic profiling on (true) or off (false) for one or more of the protection groups. Possible values are: true, false. | Optional |
| profiling_duration | Required when profiling is set to true. Specify the number of days, from 1 to 14, over which profiling will run. Possible values are: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.ProtectionGroup.active | Boolean | True if the protection group mode is active, false if inactive. |
| NetscoutAED.ProtectionGroup.bps_dropped | Number | Number of dropped bps. |
| NetscoutAED.ProtectionGroup.bps_passed | Number | Number of passed bps. |
| NetscoutAED.ProtectionGroup.bytes_dropped | Number | Number of dropped bytes. |
| NetscoutAED.ProtectionGroup.bytes_passed | Unknown | Number of passed bytes. |
| NetscoutAED.ProtectionGroup.description | String | Description of the protection group. |
| NetscoutAED.ProtectionGroup.name | String | Protection group name. |
| NetscoutAED.ProtectionGroup.packets_dropped | Number | Number of dropped packets. |
| NetscoutAED.ProtectionGroup.packets_passed | Number | Number of passed packets. |
| NetscoutAED.ProtectionGroup.pgid | Number | Protection group identifier. |
| NetscoutAED.ProtectionGroup.pps_passed | Number | Number of passed pps. |
| NetscoutAED.ProtectionGroup.pps_dropped | Number | Number of dropped pps. |
| NetscoutAED.ProtectionGroup.prefixes | Unknown | List of ‘,’ delimited prefixes belonging to the protection group. |
| NetscoutAED.ProtectionGroup.profiling | Boolean | A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false). |
| NetscoutAED.ProtectionGroup.profiling_duration | Number | The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active. |
| NetscoutAED.ProtectionGroup.profiling_start | Date | A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicates that profiling was never started. |
| NetscoutAED.ProtectionGroup.protection_level | Unknown | The protection level (None = use the global protection level, low, medium, high). |
| NetscoutAED.ProtectionGroup.server_name | String | The protection group’s server name. |
| NetscoutAED.ProtectionGroup.server_type | Number | The protection group’s server type. |
| NetscoutAED.ProtectionGroup.time_created | Date | The time when the protection group was created. |
Command Example
!na-ed-protection-groups-update pgid=52 active=false
Context Example
{
"NetscoutAED": {
"ProtectionGroup": {
"active": false,
"bps_dropped": 0,
"bps_passed": 0,
"bytes_dropped": 0,
"bytes_passed": 0,
"description": "",
"name": "test2",
"packets_dropped": 0,
"packets_passed": 0,
"pgid": 52,
"pps_dropped": 0,
"pps_passed": 0,
"prefixes": [
"1.1.1.1/32"
],
"profiling": false,
"profiling_duration": 0,
"profiling_start": 0,
"protection_level": "global protection level",
"server_name": "test2",
"server_type": 35,
"time_created": "2021-04-13T14:41:23.000Z"
}
}
}
Human Readable Output
Successfully updated the protection group object with protection group id: 52
Protection Groups
Name Pgid Protection Level Active Server Name Profiling Profiling Duration Time Created test2 52 global protection level false test2 false 0 2021-04-13T14:41:23.000Z
na-ed-protection-groups-list
Gets a list of the protection groups.
Base Command
na-ed-protection-groups-list
Input
| Argument Name | Description | Required |
|---|---|---|
| pgid | Protection group identifier. | Optional |
| name | Protection group name. | Optional |
| active | Whether the protection group is active or not. Possible values are: true, false. | Optional |
| query | Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.ProtectionGroup.active | Boolean | True if the protection group mode is active, false if inactive. |
| NetscoutAED.ProtectionGroup.bps_dropped | Number | Number of dropped bps. |
| NetscoutAED.ProtectionGroup.bps_passed | Number | Number of passed bps. |
| NetscoutAED.ProtectionGroup.bytes_dropped | Number | Number of dropped bytes. |
| NetscoutAED.ProtectionGroup.bytes_passed | Unknown | Number of passed bytes. |
| NetscoutAED.ProtectionGroup.description | String | Description of the protection group. |
| NetscoutAED.ProtectionGroup.name | String | Protection group name. |
| NetscoutAED.ProtectionGroup.packets_dropped | Number | Number of dropped packets. |
| NetscoutAED.ProtectionGroup.packets_passed | Number | Number of passed packets. |
| NetscoutAED.ProtectionGroup.pgid | Number | Protection group identifier. |
| NetscoutAED.ProtectionGroup.pps_passed | Number | Number of passed pps. |
| NetscoutAED.ProtectionGroup.pps_dropped | Number | Number of dropped pps. |
| NetscoutAED.ProtectionGroup.prefixes | Unknown | Comma-separated list of prefixes belonging to the protection group. |
| NetscoutAED.ProtectionGroup.profiling | Boolean | A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false). |
| NetscoutAED.ProtectionGroup.profiling_duration | Number | The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active. |
| NetscoutAED.ProtectionGroup.profiling_start | Date | A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicats that profiling was never started. |
| NetscoutAED.ProtectionGroup.protection_level | Unknown | The protection level (None = use the global protection level, low, medium, high). |
| NetscoutAED.ProtectionGroup.server_name | String | The protection group’s server name. |
| NetscoutAED.ProtectionGroup.server_type | Number | The protection group’s server type. |
| NetscoutAED.ProtectionGroup.time_created | Date | The time when the protection group was created. |
| NetscoutAED.ProtectionGroup.cid | Number | Central configuration ID. |
Command Example
!na-ed-protection-groups-list active=true
Context Example
{
"NetscoutAED": {
"ProtectionGroup": {
"active": false,
"bps_dropped": 0,
"bps_passed": 0,
"bytes_dropped": 0,
"bytes_passed": 0,
"description": "",
"name": "test2",
"packets_dropped": 0,
"packets_passed": 0,
"pgid": 52,
"pps_dropped": 0,
"pps_passed": 0,
"prefixes": [
"1.1.1.1/32"
],
"profiling": true,
"profiling_duration": 0,
"profiling_start": 0,
"protection_level": "global protection level",
"server_name": "test2",
"server_type": 35,
"time_created": "2021-04-13T14:41:23.000Z"
}
}
}
Human Readable Output
Protection Groups
Name Pgid Protection Level Active Server Name Profiling Profiling Duration Time Created test2 52 global protection level true test2 false 0 2021-04-13T14:41:23.000Z
na-ed-inbound-blacklisted-hosts-list
Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.
Base Command
na-ed-inbound-blacklisted-hosts-list
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | List of ‘,’ delimited IPv4 host addresses or CIDRs. | Optional |
| query | Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | The maximum number of results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistHost.annotation | Unknown | List of messages associated with each host in the inbound block list. |
| NetscoutAED.InboundBlacklistHost.cid | Unknown | List of central configuration IDs. |
| NetscoutAED.InboundBlacklistHost.host_address | String | IPv4 host addresses or CIDRs. |
| NetscoutAED.InboundBlacklistHost.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistHost.update_time | Date | The time that the host address was added to the list. |
Command Example
#### Context Example
```json
{
"NetscoutAED": {
"InboundBlacklistHost": {
"annotation": [
""
],
"cid": [
-1
],
"host_address": "1.1.1.1",
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:13.000Z"
}
}
}
Human Readable Output
Blacklisted Hosts
Host Address Pgid Cid Update Time Annotation 1.1.1.1 -1 -1 2021-05-24T08:58:13.000Z
na-ed-inbound-blacklisted-hosts-add
Adds one or more hosts to the inbound block listed list.
Base Command
na-ed-inbound-blacklisted-hosts-add
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistHost.annotation | Unknown | List of messages associated with each host in the inbound block list. |
| NetscoutAED.InboundBlacklistHost.cid | Unknown | List of central configuration IDs |
| NetscoutAED.InboundBlacklistHost.host_address | String | IPv4 host addresses or CIDRs. |
| NetscoutAED.InboundBlacklistHost.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistHostupdate_time | Date | The time that the host address was added to the list. |
Command Example
!na-ed-inbound-blacklisted-hosts-add host_address=1.2.3.4
Context Example
{
"NetscoutAED": {
"InboundBlacklistHost": {
"annotation": [
""
],
"cid": [
-1
],
"host_address": "1.2.3.4",
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:13.000Z"
}
}
}
Human Readable Output
Hosts were successfully added to the inbound block list list
New Hosts
Host Address Pgid Cid Update Time Annotation 1.2.3.4 -1 -1 2021-05-24T08:58:13.000Z
na-ed-inbound-blacklisted-hosts-replace
Replaces all the hosts on the inbound block list.
Base Command
na-ed-inbound-blacklisted-hosts-replace
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistHost.annotation | Unknown | List of messages associated with each host in the inbound block list. |
| NetscoutAED.InboundBlacklistHost.cid | Unknown | List of central configuration IDs |
| NetscoutAED.InboundBlacklistHost.host_address | String | IPv4 host addresses or CIDRs. |
| NetscoutAED.InboundBlacklistHost.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistHost.update_time | Date | The time that the host address was added to the list. |
Command Example
!na-ed-inbound-blacklisted-hosts-replace host_address=5.2.3.4
Context Example
{
"NetscoutAED": {
"InboundBlacklistHost": {
"annotation": [
""
],
"cid": [
-1
],
"host_address": "5.2.3.4",
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:15.000Z"
}
}
}
Human Readable Output
Hosts were successfully replaced in the inbound block list list
New Hosts
Host Address Pgid Cid Update Time Annotation 5.2.3.4 -1 -1 2021-05-24T08:58:15.000Z
na-ed-inbound-blacklisted-hosts-remove
Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.
Base Command
na-ed-inbound-blacklisted-hosts-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-inbound-blacklisted-hosts-remove host_address=5.2.3.4
Human Readable Output
Hosts were successfully removed from the inbound block list list
na-ed-inbound-whitelisted-hosts-list
Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.
Base Command
na-ed-inbound-whitelisted-hosts-list
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | Comma-separated list of IPv4 or IPv6 host addresses or CIDRs. | Optional |
| query | Search strings, separated by “+” to filter the results. (example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | The maximum number of results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundWhitelistHost.annotation | Unknown | List of messages associated with each host in the inbound allow listed list. |
| NetscoutAED.InboundWhitelistHost.cid | Unknown | List of central configuration IDs |
| NetscoutAED.InboundWhitelistHost.host_address | String | IPv4 host addresses or CIDRs. |
| NetscoutAED.InboundWhitelistHost.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundWhitelistHost.update_time | Date | The time that the host address was added to the list. |
Command Example
```json
{
"NetscoutAED": {
"InboundWhitelistHost": {
"annotation": [
""
],
"cid": [
-1
],
"host_address": "2.2.2.2",
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:25.000Z"
}
}
}
Human Readable Output
Whitelisted Hosts
Host Address Pgid Cid Update Time Annotation 2.2.2.2 -1 -1 2021-05-24T08:58:25.000Z
na-ed-inbound-whitelisted-hosts-add
Adds one or more hosts to the inbound allow listed list.
Base Command
na-ed-inbound-whitelisted-hosts-add
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to add. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundWhitelistHost.annotation | Unknown | List of messages associated with each host in the inbound allow listed list. |
| NetscoutAED.InboundWhitelistHost.cid | Unknown | List of central configuration IDs |
| NetscoutAED.InboundWhitelistHost.host_address | String | IPv4 host addresses or CIDRs. |
| NetscoutAED.InboundWhitelistHost.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundWhitelistHost.update_time | Date | The time that the host address was added to the list. |
Command Example
!na-ed-inbound-whitelisted-hosts-add host_address=1.2.3.4
Context Example
{
"NetscoutAED": {
"InboundWhitelistHost": {
"annotation": [
""
],
"cid": [
-1
],
"host_address": "1.2.3.4",
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:25.000Z"
}
}
}
Human Readable Output
Hosts were successfully added to the inbound allow list list
New Hosts
Host Address Pgid Cid Update Time Annotation 1.2.3.4 -1 -1 2021-05-24T08:58:25.000Z
na-ed-inbound-whitelisted-hosts-replace
Replaces all the hosts on the inbound allow list.
Base Command
na-ed-inbound-whitelisted-hosts-replace
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to update. | Required |
| annotation | A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundWhitelistHost.annotation | Unknown | List of messages associated with each host in the inbound allow listed list. |
| NetscoutAED.InboundWhitelistHost.cid | Unknown | List of central configuration IDs |
| NetscoutAED.InboundWhitelistHost.host_address | String | IPv4 host addresses or CIDRs. |
| NetscoutAED.InboundWhitelistHost.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundWhitelistHost.update_time | Date | The time that the host address was added to the list. |
Command Example
!na-ed-inbound-whitelisted-hosts-replace host_address=5.2.3.4
Context Example
{
"NetscoutAED": {
"InboundWhitelistHost": {
"annotation": [
""
],
"cid": [
-1
],
"host_address": "5.2.3.4",
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:26.000Z"
}
}
}
Human Readable Output
Hosts were successfully replaced in the inbound allow list list
New Hosts
Host Address Pgid Cid Update Time Annotation 5.2.3.4 -1 -1 2021-05-24T08:58:26.000Z
na-ed-inbound-whitelisted-hosts-remove
Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.
Base Command
na-ed-inbound-whitelisted-hosts-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs to remove. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-inbound-whitelisted-hosts-remove host_address=5.2.3.4
Human Readable Output
Hosts were successfully removed from the inbound whitelist list
na-ed-inbound-blacklisted-domains-list
Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.
Base Command
na-ed-inbound-blacklisted-domains-list
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | Comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. | Optional |
| pgid | Comma-separated list of protection group IDs. Cannot be used with the cid parameter. | Optional |
| domain | Comma-separated list of domains. | Optional |
| query | Search strings, separated by “+” to filter the results. (example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | The maximum number of results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistDomain.annotation | Unknown | List of messages associated with each domain in the inbound block list. |
| NetscoutAED.InboundBlacklistDomain.cid | Unknown | List of central configuration IDs. |
| NetscoutAED.InboundBlacklistDomain.domain | String | Domain name. |
| NetscoutAED.InboundBlacklistDomain.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistDomain.update_time | Date | The time that the domain was added to the list. |
Command Example
#### Context Example
```json
{
"NetscoutAED": {
"InboundBlacklistDomain": [
{
"annotation": [
"try1"
],
"cid": [
-1
],
"domain": "sport.co.il",
"pgid": [
-1
],
"update_time": "2021-03-15T16:00:24.000Z"
},
{
"annotation": [],
"cid": [
-1
],
"domain": "sport.com",
"pgid": [
-1
],
"update_time": "2021-03-18T17:25:26.000Z"
},
{
"annotation": [],
"cid": [
-1
],
"domain": "ynet.com",
"pgid": [
-1
],
"update_time": "2021-03-18T16:49:50.000Z"
}
]
}
}
Human Readable Output
Blacklisted Domains
Domain Pgid Cid Update Time Annotation sport.co.il -1 -1 2021-03-15T16:00:24.000Z try1 sport.com -1 -1 2021-03-18T17:25:26.000Z ynet.com -1 -1 2021-03-18T16:49:50.000Z
na-ed-inbound-blacklisted-domains-add
Adds one or more domains to the block list by pgid or cid.
Base Command
na-ed-inbound-blacklisted-domains-add
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. | Optional |
| pgid | A specific protection group ID or -1 for global. Cannot be used with the cid parameter. | Optional |
| domain | Domain name or a comma-separated list of domain names. | Required |
| annotation | A message to associate with each domain that you add to the block list. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistDomain.annotation | Unknown | List of messages associated with each domain in the inbound blaok list. |
| NetscoutAED.InboundBlacklistDomain.cid | Unknown | List of central configuration IDs. |
| NetscoutAED.InboundBlacklistDomain.domain | String | Domain name. |
| NetscoutAED.InboundBlacklistDomain.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistDomain.update_time | Unknown | The time that the domain was added to the list. |
Command Example
!na-ed-inbound-blacklisted-domains-add domain=goo.com
Context Example
{
"NetscoutAED": {
"InboundBlacklistDomain": {
"annotation": [],
"cid": [
-1
],
"domain": "goo.com",
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:34.000Z"
}
}
}
Human Readable Output
Domains were successfully added to the inbound block listed list
Added Domains
Domain Pgid Cid Update Time goo.com -1 -1 2021-05-24T08:58:34.000Z
na-ed-inbound-blacklisted-domains-remove
Removes one or more domains from the block list for a specific protection group or for all protection groups.
Base Command
na-ed-inbound-blacklisted-domains-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | Domain name or a comma-separated list of domain names. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-inbound-blacklisted-domains-remove domain=goo.com
Human Readable Output
Domains were successfully removed from the inbound block listed list
na-ed-inbound-blacklisted-urls-list
Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.
Base Command
na-ed-inbound-blacklisted-urls-list
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | Comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. | Optional |
| pgid | Comma-separated list of protection group IDs. Cannot be used with the cid parameter. | Optional |
| url | Comma-separated list of URLs. | Optional |
| query | Search strings, separated by “+” to filter the results. (example: “AZ+BS”). | Optional |
| page | The page of the results to return. | Optional |
| limit | Maximum number of results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistUrl.annotation | Unknown | List of messages associated with each URL in the inbound block list. |
| NetscoutAED.InboundBlacklistUrl.cid | Unknown | List of central configuration ID.s |
| NetscoutAED.InboundBlacklistUrl.url | String | URL address. |
| NetscoutAED.InboundBlacklistUrl.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistUrl.update_time | Date | The time that the domain was added to the list. |
Command Example
!na-ed-inbound-blacklisted-urls-list limit=3
Context Example
{
"NetscoutAED": {
"InboundBlacklistUrl": [
{
"annotation": [],
"cid": [
-1
],
"pgid": [
-1
],
"update_time": "2021-03-18T16:52:26.000Z",
"url": "google.com"
},
{
"annotation": [
"Google Maps"
],
"cid": [
-1
],
"pgid": [
-1
],
"update_time": "2021-03-18T18:08:39.000Z",
"url": "maps.google.com"
},
{
"annotation": [
"Google Maps"
],
"cid": [
-1
],
"pgid": [
-1
],
"update_time": "2021-03-18T18:08:27.000Z",
"url": "maps.google.com/sport.com"
}
]
}
}
Human Readable Output
Blacklisted URLs
Url Pgid Cid Update Time Annotation google.com -1 -1 2021-03-18T16:52:26.000Z maps.google.com -1 -1 2021-03-18T18:08:39.000Z Google Maps maps.google.com/sport.com -1 -1 2021-03-18T18:08:27.000Z Google Maps
na-ed-inbound-blacklisted-urls-add
Adds one or more URLs to the block list by pgid or cid.
Base Command
na-ed-inbound-blacklisted-urls-add
Input
| Argument Name | Description | Required |
|---|---|---|
| cid | A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. | Optional |
| pgid | A specific protection group ID or -1 for global. Cannot be used with the cid parameter. | Optional |
| url | URL or a comma-separated list of URLs to add. | Required |
| annotation | A message to associate with each URL that you add to the block list. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| NetscoutAED.InboundBlacklistUrl.annotation | Unknown | List of messages associated with each url in the inbound block list. |
| NetscoutAED.InboundBlacklistUrl.cid | Unknown | List of central configuration IDs |
| NetscoutAED.InboundBlacklistUrl.url | String | URL address. |
| NetscoutAED.InboundBlacklistUrl.pgid | Unknown | List of protection group ID. |
| NetscoutAED.InboundBlacklistUrl.update_time | Date | The time that the domain was added to the list. |
Command Example
!na-ed-inbound-blacklisted-urls-add url=www.goo.com
Context Example
{
"NetscoutAED": {
"InboundBlacklistUrl": {
"annotation": [],
"cid": [
-1
],
"pgid": [
-1
],
"update_time": "2021-05-24T08:58:39.000Z",
"url": "www.goo.com"
}
}
}
Human Readable Output
Urls were successfully added to the inbound block listed list
Added Urls
Url Pgid Cid Update Time www.goo.com -1 -1 2021-05-24T08:58:39.000Z
na-ed-inbound-blacklisted-urls-remove
Removes one or more URLs from the block list for a specific protection group or for all protection groups.
Base Command
na-ed-inbound-blacklisted-urls-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| url | URL or a comma-separated list of URLs. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-inbound-blacklisted-urls-remove url=www.goo.com
Human Readable Output
Urls were successfully removed from the inbound block listed list
na-ed-outbound-whitelisted-hosts-remove
Removes one or more hosts or CIDRs from the outbound allow list.
Base Command
na-ed-outbound-whitelisted-hosts-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| host_address | A single IPv4 host address or CIDR, or a comma-separated list of IPv4 host addresses or CIDRs to remove. | Required |
Context Output
There is no context output for this command.
Command Example
!na-ed-outbound-whitelisted-hosts-remove host_address=3.3.3.3
Human Readable Output
Hosts were successfully removed from the outbound allow list list
Configuration parameters
base_url— Server URL (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settingsUser—
Commands (31)
-
na-ed-country-code-listGets a country or list of countries (country name and ISO-standardized country code).
-
na-ed-inbound-blacklisted-countries-addAdds one or more countries to the inbound block list by pgid or cid.
-
na-ed-inbound-blacklisted-countries-listGets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.
-
na-ed-inbound-blacklisted-countries-removeRemoves one or more countries from the block list for a specific protection group or for all protection groups.
-
na-ed-inbound-blacklisted-domains-addAdds one or more domains to the block list by pgid or cid.
-
na-ed-inbound-blacklisted-domains-listGets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.
-
na-ed-inbound-blacklisted-domains-removeRemoves one or more domains from the block list for a specific protection group or for all protection groups.
-
na-ed-inbound-blacklisted-hosts-addAdds one or more hosts to the inbound block listed list.
-
na-ed-inbound-blacklisted-hosts-listGets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.
-
na-ed-inbound-blacklisted-hosts-removeRemoves one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.
-
na-ed-inbound-blacklisted-hosts-replaceReplaces all the hosts on the inbound block list.
-
na-ed-inbound-blacklisted-urls-addAdds one or more URLs to the block list by pgid or cid.
-
na-ed-inbound-blacklisted-urls-listGets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.
-
na-ed-inbound-blacklisted-urls-removeRemoves one or more URLs from the block list for a specific protection group or for all protection groups.
-
na-ed-inbound-whitelisted-hosts-addAdds one or more hosts to the inbound allow listed list.
-
na-ed-inbound-whitelisted-hosts-listGet the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.
-
na-ed-inbound-whitelisted-hosts-removeRemoves one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.
-
na-ed-inbound-whitelisted-hosts-replaceReplaces all the hosts on the inbound allow list.
-
na-ed-outbound-blacklisted-countries-addAdds one or more countries to the outbound block list.
-
na-ed-outbound-blacklisted-countries-listGets the countries on the outbound block list. By default, 10 block listed countries are returned.
-
na-ed-outbound-blacklisted-countries-removeRemoves one or more countries from the outbound block list.
-
na-ed-outbound-blacklisted-hosts-addAdds one or more hosts to the outbound block list.
-
na-ed-outbound-blacklisted-hosts-listGets the outbound block listed hosts. By default, 10 block listed hosts are returned.
-
na-ed-outbound-blacklisted-hosts-removeRemoves one or more hosts or CIDRS from the outbound block list.
-
na-ed-outbound-blacklisted-hosts-replaceReplaces all the hosts on the outbound block listed list.
-
na-ed-outbound-whitelisted-hosts-addAdds one or more hosts to the outbound whitelisted list.
-
na-ed-outbound-whitelisted-hosts-listGets the outbound hosts on allow list. By default, 10 hosts on allow list are returned.
-
na-ed-outbound-whitelisted-hosts-removeRemoves one or more hosts or CIDRs from the outbound allow list.
-
na-ed-outbound-whitelisted-hosts-replaceReplaces all the hosts on the outbound allow listed list.
-
na-ed-protection-groups-listGets a list of the protection groups.
-
na-ed-protection-groups-updateUpdates the settings for one or more protection groups.
import json import pytest import requests_mock from CommonServerPython import DemistoException from NetscoutAED import Client MOCK_URL = "http://base_url_mock" client = Client(base_url=MOCK_URL, verify=False, api_token="api_token", proxy=False) inbound_blacklisted = {"direction": "inbound", "list_color": "blacklist"} inbound_whitelisted = {"direction": "inbound", "list_color": "whitelist"} outbound_blacklisted = {"direction": "outbound", "list_color": "blacklist"} outbound_whitelisted = {"direction": "outbound", "list_color": "whitelist"} def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) def test_objects_time_to_readable_time(): """ Given: - A list of objects with same time key and a valid key name When: - When the api returns list of objects with timestamps (seconds) Then: - The time value of each object is replaced with a date string (ISO 8601 format) """ from NetscoutAED import objects_time_to_readable_time list_of_objects = [ {"countryName": "country", "createdTime": 1615888547}, {"countryName": "country", "createdTime": 1615838546}, ] time_key = "createdTime" objects_time_to_readable_time(list_of_objects, time_key) expected_output = [ {"country_name": "country", "created_time": "2021-03-16T09:55:47.000Z"}, {"country_name": "country", "created_time": "2021-03-15T20:02:26.000Z"}, ] assert len(list_of_objects) == len(expected_output) assert all(x == y for x, y in zip(list_of_objects, expected_output)) def test_objects_time_to_readable_time_key_mismatch(): """ Given: - A key that does not match the keys in the list of objects When: - When the api returns list of objects with timestamps (seconds) Then: - An exception is raised by the function """ from NetscoutAED import objects_time_to_readable_time with pytest.raises(DemistoException, match="argument is not valid"): objects_time_to_readable_time([{"createdTime": 1615888547}, {"createdTime": 1615444547}], "TimeKey") def test_serialize_protection_groups(): """ Given: - A valid object When: - When the api expects a different format Then: - Returns the expected format """ from NetscoutAED import serialize_protection_groups protection_groups_list = [ {"active": True, "protectionLevel": "low"}, {"active": False, "protectionLevel": "medium"}, {"active": False, "protectionLevel": "high"}, ] expected_output = [ {"active": 1, "protectionLevel": 1}, {"active": 0, "protectionLevel": 2}, {"active": 0, "protectionLevel": 3}, ] for i, protection_group in enumerate(protection_groups_list): serialize_protection_groups(protection_group) assert protection_groups_list[i] == expected_output[i] def test_deserialize_protection_groups(): """ Given: - A valid list of objects When: - When the human readable expects a different format Then: - Returns the expected format """ from NetscoutAED import deserialize_protection_groups protection_groups_list = [ {"active": 1, "protectionLevel": 1}, {"active": 0, "protectionLevel": 2}, {"active": 0, "protectionLevel": 3}, ] expected_output = [ {"active": True, "protectionLevel": "low"}, {"active": False, "protectionLevel": "medium"}, {"active": False, "protectionLevel": "high"}, ] deserialize_protection_groups(protection_groups_list) assert len(protection_groups_list) == len(expected_output) assert all(x == y for x, y in zip(protection_groups_list, expected_output)) def test_country_code_list_command(mocker): """ Given: - A valid args input When: - Running country code list command. Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import country_code_list_command countries_code_raw_response = util_load_json("test_data/countries_codes/countries_code_raw.json") mocker.patch.object(client, "country_code_list_command", return_value=countries_code_raw_response) result = country_code_list_command(client, {}) assert "Anguilla" in result.readable_output assert "| Algeria | DZ |" in result.readable_output assert {"country_name": "Afghanistan", "iso_code": "AF"} in result.outputs country_list_params = [ ( outbound_blacklisted, "outbound_blacklisted_country_list_command", "outbound_blacklisted_countries_raw.json", {"annotation": "Test", "country": "BD", "update_time": "2021-03-16T16:57:16.000Z"}, ), ( inbound_blacklisted, "inbound_blacklisted_country_list_command", "inbound_blacklisted_countries_raw.json", {"annotation": ["Test2"], "cid": [-1], "country": "BF", "pgid": [-1], "update_time": "2021-03-15T10:17:32.000Z"}, ), ] @pytest.mark.parametrize("direction_color, func_mock, raw_respond, expected_output", country_list_params) def test_handle_country_list_commands(mocker, direction_color, func_mock, raw_respond, expected_output): """ Given: - A valid args input When: - Running blacklisted country list command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_country_list_commands outbound_blacklisted_countries_raw_response = util_load_json(f"test_data/countries/{raw_respond}") mocker.patch.object(client, func_mock, return_value=outbound_blacklisted_countries_raw_response) result = handle_country_list_commands(client, {}, direction_color) assert "Test" in result.readable_output assert "| AI | 2021-03-16T16:57:09.000Z |" in result.readable_output assert expected_output in result.outputs country_addition_params = [ ( "BS", outbound_blacklisted, "outbound_blacklisted_country_add_command", "added_outbound_blacklisted_countries_raw.json", [{"annotation": "Test", "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"}], ), ( "BS,AU", outbound_blacklisted, "outbound_blacklisted_country_add_command", "added_outbound_blacklisted_countries_raw.json", [ {"annotation": "Test", "country": "AU", "update_time": "2021-03-16T17:54:38.000Z"}, {"annotation": None, "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"}, ], ), ( "BS", inbound_blacklisted, "inbound_blacklisted_country_add_command", "added_inbound_blacklisted_countries_raw.json", [{"annotation": "Test", "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"}], ), ( "BS,AU", inbound_blacklisted, "inbound_blacklisted_country_add_command", "added_inbound_blacklisted_countries_raw.json", [ {"annotation": "Test", "country": "AU", "update_time": "2021-03-16T17:54:38.000Z"}, {"annotation": None, "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"}, ], ), ] @pytest.mark.parametrize("country, direction_color, func_mock, raw_respond, expected_output", country_addition_params) def test_handle_country_addition_commands(mocker, country, func_mock, raw_respond, direction_color, expected_output): """ Given: - (case1) A valid args and a single country to add input - (case2) A valid args and multiple countries to add input (comma seperated) When: - Running outbound/inbound blacklisted country add command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_country_addition_commands blacklisted_countries_raw = util_load_json("test_data/countries/" + raw_respond) if country == "BS": blacklisted_countries_raw = blacklisted_countries_raw["single_country_output"] elif country == "BS,AU": blacklisted_countries_raw = blacklisted_countries_raw["multiple_country_output"] mocker.patch.object(client, func_mock, return_value=blacklisted_countries_raw) result = handle_country_addition_commands(client, {"country": country}, direction_color) assert "Test" in result.readable_output assert "| BS | 2021-03-14T12:18:05.000Z |" in result.readable_output assert all(x == y for x, y in zip(expected_output, result.outputs)) def test_handle_country_addition_commands_no_country_given(): """ Given: - An invalid country input When: - Running outbound/inbound blacklisted country add command Then: - An exception is raised by the function """ from NetscoutAED import handle_country_addition_commands with pytest.raises(DemistoException, match="A country code must be provided in order to add"): handle_country_addition_commands(client, {}, outbound_blacklisted) @pytest.mark.parametrize( "country, func_mock, url_suffix, direction_color", [ ("BS", "outbound_blacklisted_country_delete_command", "/otf/blacklisted-countries/", outbound_blacklisted), ("BS,AU", "outbound_blacklisted_country_delete_command", "/otf/blacklisted-countries/", outbound_blacklisted), ("BS", "inbound_blacklisted_country_delete_command", "/protection-groups/blacklisted-countries/", inbound_blacklisted), ("BS,AU", "inbound_blacklisted_country_delete_command", "/protection-groups/blacklisted-countries/", inbound_blacklisted), ], ) def test_handle_country_deletion_commands(country, func_mock, url_suffix, direction_color): """ Given: - (case1) A valid args and a single country to remove input - (case2) A valid args and multiple countries to remove input (comma seperated) When: - Running outbound/inbound blacklisted country remove command Then: - Ensure expected response is returned """ from NetscoutAED import handle_country_deletion_commands with requests_mock.Mocker() as m: m.delete(f"{MOCK_URL}{url_suffix}", status_code=204) result = handle_country_deletion_commands(client, {"country": country}, direction_color) assert "Countries were successfully removed" in result def test_handle_country_deletion_commands_no_country_given(): """ Given: - An invalid country input When: - Running outbound/inbound blacklisted country delete command Then: - An exception is raised by the function """ from NetscoutAED import handle_country_deletion_commands with pytest.raises(DemistoException, match="A country code must be provided in order to add"): handle_country_deletion_commands(client, {}, outbound_blacklisted) hosts_list_params = [ ( outbound_blacklisted, "outbound_blacklisted_host_list_command", "outbound_blacklisted_hosts_list_raw.json", [{"annotation": "blacklisted outbound", "host_address": "6.6.6.6", "update_time": "2021-03-15T13:16:11.000Z"}], ), ( inbound_blacklisted, "inbound_blacklisted_host_list_command", "inbound_blacklisted_hosts_list_raw.json", [ { "annotation": ["blacklisted inbound"], "cid": [-1], "host_address": "1.1.1.1", "pgid": [-1], "update_time": "2021-03-15T13:16:11.000Z", } ], ), ( outbound_whitelisted, "outbound_whitelisted_host_list_command", "outbound_whitelisted_hosts_list_raw.json", [{"annotation": "whitelisted outbound", "host_address": "12.1.1.1", "update_time": "2021-03-15T13:16:11.000Z"}], ), ( inbound_whitelisted, "inbound_whitelisted_host_list_command", "inbound_whitelisted_hosts_list_raw.json", [ { "annotation": ["whitelisted inbound"], "cid": [-1], "host_address": "6.6.6.6", "pgid": [-1], "update_time": "2021-03-15T13:16:11.000Z", } ], ), ] @pytest.mark.parametrize("direction_color, func_mock, raw_respond, expected_output", hosts_list_params) def test_handle_host_list_commands(mocker, direction_color, func_mock, raw_respond, expected_output): """ Given: - A valid args input When: - Running hosts list command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_host_list_commands outbound_blacklisted_hosts_raw_response = util_load_json(f"test_data/hosts/{raw_respond}") mocker.patch.object(client, func_mock, return_value=outbound_blacklisted_hosts_raw_response) result = handle_host_list_commands(client, {}, direction_color) assert direction_color["direction"] assert direction_color["list_color"] in result.readable_output assert "2021-03-15T13:16:11.000Z" in result.readable_output assert expected_output[0] == result.outputs[0] host_addition_params = [ ( "1.1.1.1", outbound_blacklisted, "outbound_blacklisted_host_add_update_command", "added_or_updated_outbound_blacklisted_hosts_raw.json", [{"annotation": "Test blacklisted outbound", "host_address": "1.1.1.1", "update_time": "2021-03-18T10:38:56.000Z"}], ), ( "2.2.2.2,3.3.3.3", outbound_blacklisted, "outbound_blacklisted_host_add_update_command", "added_or_updated_outbound_blacklisted_hosts_raw.json", [ {"annotation": "Test blacklisted outbound", "host_address": "2.2.2.2", "update_time": "2021-03-18T10:41:27.000Z"}, {"annotation": "Test blacklisted outbound", "host_address": "3.3.3.3", "update_time": "2021-03-18T10:41:27.000Z"}, ], ), ( "1.1.1.1", inbound_blacklisted, "inbound_blacklisted_host_add_update_command", "added_or_updated_inbound_blacklisted_hosts_raw.json", [ { "annotation": ["Test blacklisted inbound"], "cid": [-1], "host_address": "1.1.1.1", "pgid": [-1], "update_time": "2021-03-18T10:48:37.000Z", } ], ), ( "2.2.2.2,3.3.3.3", inbound_blacklisted, "inbound_blacklisted_host_add_update_command", "added_or_updated_inbound_blacklisted_hosts_raw.json", [ { "annotation": ["Test blacklisted inbound"], "cid": [-1], "host_address": "2.2.2.2", "pgid": [-1], "update_time": "2021-03-18T10:53:00.000Z", }, { "annotation": ["Test blacklisted inbound"], "cid": [-1], "host_address": "3.3.3.3", "pgid": [-1], "update_time": "2021-03-18T10:53:00.000Z", }, ], ), ( "1.1.1.1", outbound_whitelisted, "outbound_whitelisted_host_add_update_command", "added_or_updated_outbound_whitelisted_hosts_raw.json", [{"annotation": "Test whitelisted outbound", "host_address": "1.1.1.1", "update_time": "2021-03-18T10:44:09.000Z"}], ), ( "2.2.2.2,3.3.3.3", outbound_whitelisted, "outbound_whitelisted_host_add_update_command", "added_or_updated_outbound_whitelisted_hosts_raw.json", [ {"annotation": "Test whitelisted outbound", "host_address": "2.2.2.2", "update_time": "2021-03-18T10:45:18.000Z"}, {"annotation": "Test whitelisted outbound", "host_address": "3.3.3.3", "update_time": "2021-03-18T10:45:18.000Z"}, ], ), ( "1.1.1.1", inbound_whitelisted, "inbound_whitelisted_host_add_update_command", "added_or_updated_inbound_whitelisted_hosts_raw.json", [ { "annotation": ["Test whitelisted inbound"], "cid": [-1], "host_address": "1.1.1.1", "pgid": [-1], "update_time": "2021-03-18T10:48:37.000Z", } ], ), ( "2.2.2.2,3.3.3.3", inbound_whitelisted, "inbound_whitelisted_host_add_update_command", "added_or_updated_inbound_whitelisted_hosts_raw.json", [ { "annotation": ["Test whitelisted inbound"], "cid": [-1], "host_address": "2.2.2.2", "pgid": [-1], "update_time": "2021-03-18T10:50:36.000Z", }, { "annotation": ["Test whitelisted inbound"], "cid": [-1], "host_address": "3.3.3.3", "pgid": [-1], "update_time": "2021-03-18T10:50:36.000Z", }, ], ), ] @pytest.mark.parametrize("host, direction_color, func_mock, raw_respond, expected_output", host_addition_params) def test_handle_host_addition_commands(mocker, host, func_mock, raw_respond, direction_color, expected_output): """ Given: - (case1) A valid args and a single host to add/update input - (case2) A valid args and multiple host to add/update input (comma seperated) When: - Running host addition/update command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_host_addition_and_replacement_commands hosts_raw = util_load_json("test_data/hosts/" + raw_respond) if host == "1.1.1.1": hosts_raw = hosts_raw["single_host_output"] elif host == "2.2.2.2,3.3.3.3": hosts_raw = hosts_raw["multiple_hosts_output"] mocker.patch.object(client, func_mock, return_value=hosts_raw) result = handle_host_addition_and_replacement_commands(client, {"host_address": host}, direction_color) assert "Hosts were successfully" in result.readable_output assert all(x == y for x, y in zip(expected_output, result.outputs)) def test_handle_host_addition_commands_no_host_given(): """ Given: - An invalid host input When: - Running host addition command Then: - An exception is raised by the function """ from NetscoutAED import handle_host_addition_and_replacement_commands with pytest.raises(DemistoException, match="A host address must be provided in order to add/update"): handle_host_addition_and_replacement_commands(client, {}, outbound_blacklisted) host_deletion_params = [ ("1.1.1.1", outbound_blacklisted, "outbound_blacklisted_host_remove_command", "/otf/blacklisted-hosts/"), ("2.2.2.2,3.3.3.3", outbound_blacklisted, "outbound_blacklisted_host_remove_command", "/otf/blacklisted-hosts/"), ("1.1.1.1", inbound_blacklisted, "inbound_blacklisted_host_remove_command", "/protection-groups/blacklisted-hosts/"), ("2.2.2.2,3.3.3.3", inbound_blacklisted, "inbound_blacklisted_host_remove_command", "/protection-groups/blacklisted-hosts/"), ("1.1.1.1", outbound_whitelisted, "outbound_whitelisted_host_remove_command", "/otf/whitelisted-hosts/"), ("2.2.2.2,3.3.3.3", outbound_whitelisted, "outbound_whitelisted_host_remove_command", "/otf/whitelisted-hosts/"), ("1.1.1.1", inbound_whitelisted, "inbound_whitelisted_host_remove_command", "/protection-groups/whitelisted-hosts/"), ("2.2.2.2,3.3.3.3", inbound_whitelisted, "inbound_whitelisted_host_remove_command", "/protection-groups/whitelisted-hosts/"), ] @pytest.mark.parametrize("host, direction_color, func_mock, url_suffix", host_deletion_params) def test_handle_host_deletion_commands(host, func_mock, direction_color, url_suffix): """ Given: - (case1) A valid args and a single host to remove input - (case2) A valid args and multiple hosts to remove input (comma seperated) When: - Running host deletion command Then: - Ensure expected response is returned """ from NetscoutAED import handle_host_deletion_commands with requests_mock.Mocker() as m: m.delete(f"{MOCK_URL}{url_suffix}", status_code=204) result = handle_host_deletion_commands(client, {"host_address": host}, direction_color) assert "Hosts were successfully removed" in result def test_handle_host_deletion_commands_no_host_given(): """ Given: - An invalid host input When: - Running host deletion command Then: - An exception is raised by the function """ from NetscoutAED import handle_host_deletion_commands with pytest.raises(DemistoException, match="A host address must be provided in order to remove"): handle_host_deletion_commands(client, {}, outbound_blacklisted) def test_handle_protection_groups_list_commands(mocker): """ Given: - A valid args input When: - Running protection groups list command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_protection_groups_list_commands protection_groups_raw_response = util_load_json("test_data/protection_groups/protection_groups_list_raw.json") mocker.patch.object(client, "protection_group_list_command", return_value=protection_groups_raw_response) expected_output = { "active": False, "bps_dropped": 0, "bps_passed": 0, "bytes_dropped": 0, "bytes_passed": 0, "cid": None, "description": "The default protection group on 0.0.0.0/0", "name": "Default Protection Group", "packets_dropped": 0, "packets_passed": 0, "pgid": 7, "pps_dropped": 0, "pps_passed": 0, "prefixes": ["0.0.0.0/0"], "profiling": False, "profiling_duration": 0, "profiling_start": 0, "protection_level": "low", "server_name": "Generic Server", "server_type": 0, "time_created": "2021-01-17T13:54:13.000Z", } result = handle_protection_groups_list_commands(client, {}) assert "Default Protection Group" in result.readable_output assert "Generic Server" in result.readable_output assert "42" in result.readable_output assert expected_output == result.outputs[0] def test_handle_protection_groups_update_commands(mocker): """ Given: - A valid args input When: - Running protection groups update command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_protection_groups_update_commands protection_groups_update_raw_response = util_load_json("test_data/protection_groups/protection_groups_update_raw.json") mocker.patch.object(client, "protection_group_patch_command", return_value=protection_groups_update_raw_response) expected_output = { "active": False, "bps_dropped": 0, "bps_passed": 0, "bytes_dropped": 0, "bytes_passed": 0, "description": "The default protection group on 0.0.0.0/0", "name": "Default Protection Group", "packets_dropped": 0, "packets_passed": 0, "pgid": 7, "pps_dropped": 0, "pps_passed": 0, "prefixes": ["0.0.0.0/0"], "profiling": False, "profiling_duration": 0, "profiling_start": 0, "protection_level": "low", "server_name": "Generic Server", "server_type": 0, "time_created": "2021-01-17T13:54:13.000Z", } result = handle_protection_groups_update_commands(client, {"pgid": 7}) assert "Successfully updated the protection group object with protection group id: 7" in result.readable_output assert "Default Protection Group" in result.readable_output assert expected_output == result.outputs[0] def test_handle_protection_groups_update_commands_no_pgid_given(mocker): """ Given: - An invalid pgid input When: - Running protection group update command Then: - An exception is raised by the function """ from NetscoutAED import handle_protection_groups_update_commands with pytest.raises(DemistoException, match="A pgid must be provided in order to update"): handle_protection_groups_update_commands(client, {}) def test_handle_domain_list_commands(mocker): """ Given: - A valid args input When: - Running inbound blacklisted domain list command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_domain_list_commands inbound_blacklisted_domains_raw_response = util_load_json("test_data/domains/inbound_blacklisted_domains_raw.json") mocker.patch.object(client, "inbound_blacklisted_domain_list_command", return_value=inbound_blacklisted_domains_raw_response) result = handle_domain_list_commands(client, {}) assert "google.com" in result.readable_output assert "2021-03-18T16:49:50.000Z" in result.readable_output assert result.outputs[0] == { "annotation": [], "cid": [-1], "domain": "google.com", "pgid": [-1], "update_time": "2021-03-18T16:49:26.000Z", } domain_addition_params = [ ( "google.com", [{"annotation": [], "cid": [-1], "domain": "google.com", "pgid": [-1], "update_time": "2021-03-18T16:49:26.000Z"}], ), ( "google.com,sport.com", [ {"annotation": [], "cid": [-1], "domain": "google.com", "pgid": [-1], "update_time": "2021-03-18T16:49:26.000Z"}, {"annotation": [], "cid": [-1], "domain": "sport.com", "pgid": [-1], "update_time": "2021-03-18T17:25:26.000Z"}, ], ), ] @pytest.mark.parametrize("domain, expected_output", domain_addition_params) def test_handle_domain_addition_commands(mocker, domain, expected_output): """ Given: - (case1) A valid args and a single domain to add input - (case2) A valid args and multiple domains to add input (comma seperated) When: - Running domain addition command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_domain_addition_commands domains_raw = util_load_json("test_data/domains/added_inbound_blacklisted_domains_raw.json") if domain == "google.com": domains_raw = domains_raw["single_domain_output"] elif domain == "google.com,sport.com": domains_raw = domains_raw["multiple_domains_output"] mocker.patch.object(client, "inbound_blacklisted_domain_add_command", return_value=domains_raw) result = handle_domain_addition_commands(client, {"domain": domain}) assert "Domains were successfully added to the inbound blacklisted list" in result.readable_output assert "google.com" in result.readable_output assert all(x == y for x, y in zip(expected_output, result.outputs)) def test_handle_domain_addition_commands_no_domain_given(): """ Given: - An invalid domain input When: - Running domain addition command Then: - An exception is raised by the function """ from NetscoutAED import handle_domain_addition_commands with pytest.raises(DemistoException, match="A domain must be provided in order to add"): handle_domain_addition_commands(client, {}) @pytest.mark.parametrize("domain", [("google.com"), ("google.com,sport.com")]) def test_handle_domain_deletion_commands(mocker, domain): """ Given: - (case1) A valid args and a single domain to remove input - (case2) A valid args and multiple domains to remove input (comma seperated) When: - Running domain deletion command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_domain_deletion_commands with requests_mock.Mocker() as m: m.delete(f"{MOCK_URL}/protection-groups/blacklisted-domains/", status_code=204) result = handle_domain_deletion_commands(client, {"domain": domain}) assert "Domains were successfully removed" in result def test_handle_domain_deletion_commands_no_domain_given(): """ Given: - An invalid domain input When: - Running domain deletion command Then: - An exception is raised by the function """ from NetscoutAED import handle_domain_deletion_commands with pytest.raises(DemistoException, match="A domain must be provided in order to remove"): handle_domain_deletion_commands(client, {}) def test_handle_url_list_commands(mocker): """ Given: - A valid args input When: - Running inbound blacklisted url list command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_url_list_commands inbound_blacklisted_urls_raw_response = util_load_json("test_data/urls/inbound_blacklisted_urls_raw.json") mocker.patch.object(client, "inbound_blacklisted_url_list_command", return_value=inbound_blacklisted_urls_raw_response) result = handle_url_list_commands(client, {}) assert "google.com" in result.readable_output assert "2021-03-18T16:52:26.000Z" in result.readable_output assert result.outputs[0] == { "annotation": [], "cid": [-1], "pgid": [-1], "url": "google.com", "update_time": "2021-03-18T16:52:26.000Z", } url_addition_params = [ ( "maps.google.com", [ { "annotation": ["Google Maps"], "cid": [-1], "pgid": [-1], "url": "maps.google.com", "update_time": "2021-03-18T18:08:39.000Z", } ], ), ( "maps.google.com,sport.com", [ { "annotation": ["Google Maps"], "cid": [-1], "pgid": [-1], "url": "maps.google.com", "update_time": "2021-03-18T18:08:39.000Z", }, { "annotation": ["Google Maps"], "cid": [-1], "pgid": [-1], "url": "sport.com", "update_time": "2021-03-18T18:08:39.000Z", }, ], ), ] @pytest.mark.parametrize("url, expected_output", url_addition_params) def test_handle_url_addition_commands(mocker, url, expected_output): """ Given: - (case1) A valid args and a single url to add input - (case2) A valid args and multiple urls to add input (comma seperated) When: - Running domain addition command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_url_addition_commands urls_raw = util_load_json("test_data/urls/added_inbound_blacklisted_urls_raw.json") if url == "maps.google.com": urls_raw = urls_raw["single_url_output"] elif url == "maps.google.com,sport.com": urls_raw = urls_raw["multiple_urls_output"] mocker.patch.object(client, "inbound_blacklisted_url_add_command", return_value=urls_raw) result = handle_url_addition_commands(client, {"url": url}) assert "Urls were successfully added to the inbound blacklisted list" in result.readable_output assert "maps.google.com" in result.readable_output assert all(x == y for x, y in zip(expected_output, result.outputs)) def test_handle_url_addition_commands_no_url_given(): """ Given: - An invalid url input When: - Running url addition command Then: - An exception is raised by the function """ from NetscoutAED import handle_url_addition_commands with pytest.raises(DemistoException, match="A URL must be provided in order to add"): handle_url_addition_commands(client, {}) @pytest.mark.parametrize("url", [("google.com"), ("google.com,sport.com")]) def test_handle_url_deletion_commands(url): """ Given: - (case1) A valid args and a single url to remove input - (case2) A valid args and multiple urls to remove input (comma seperated) When: - Running url deletion command Then: - Ensure expected human readable response is returned and output is correct """ from NetscoutAED import handle_url_deletion_commands with requests_mock.Mocker() as m: m.delete(f"{MOCK_URL}/protection-groups/blacklisted-urls/", status_code=204) result = handle_url_deletion_commands(client, {"url": url}) assert "URLs were successfully removed" in result def test_handle_url_deletion_commands_no_url_given(): """ Given: - An invalid url input When: - Running url deletion command Then: - An exception is raised by the function """ from NetscoutAED import handle_url_deletion_commands with pytest.raises(DemistoException, match="A URL must be provided in order to remove"): handle_url_deletion_commands(client, {})