NetscoutAED

Use the Netscout Arbor Edge Defense integration to detect and stop both inbound threats and outbound malicious communication from compromised internal devices.

Network Security · Netscout Arbor Edge Defense - AED

Details

IDNetscoutAED
ProviderNetscout Systems
CategoryNetwork Security
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

The Netscout Arbor Edge Defense (AED) integration enables you to block and allow outbound and inbound traffic.

What does this pack do?

Using the Netscout AED integration you can:

  • Get, add, and remove hosts, countries, domains, and URLs from the inbound block list.
  • Get, add, and remove hosts from the inbound allow list.
  • Get, add, and remove hosts and countries from the outbound blaock list.
  • Get, add, and remove hosts from the outbound all.
  • Get and update the protection group (the IPv4 or IPv6 hosts that you need to protect).

Configure NetscoutAED in Cortex

Parameter Required  
Server URL True  
API Token If using 6.0.2 or lower version, put your API Key in the Password field, leave the User field empty. False
Trust any certificate (not secure) False  
Use system proxy settings False  

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

na-ed-outbound-blacklisted-countries-list


Gets the countries on the outbound block list. By default, 10 block listed countries are returned.

Base Command

na-ed-country-code-list


Gets a country or list of countries (country name and ISO-standardized country code).

Base Command

na-ed-country-code-list

Input

Argument Name Description Required
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results returned per page. Default: 10. Optional

Context Output

Path Type Description
NetscoutAED.Country.country_name String The country’s name.
NetscoutAED.Country.iso_code String The ISO-standardized country code.

Command Example

!na-ed-country-code-list limit=5

Context Example

{
    "NetscoutAED": {
        "Country": [
            {
                "country_name": "6to4 Relay Anycast",
                "iso_code": "XF"
            },
            {
                "country_name": "Afghanistan",
                "iso_code": "AF"
            },
            {
                "country_name": "Aland Islands",
                "iso_code": "AX"
            },
            {
                "country_name": "Albania",
                "iso_code": "AL"
            },
            {
                "country_name": "Algeria",
                "iso_code": "DZ"
            }
        ]
    }
}

Human Readable Output

Netscout AED Countries List

Country Name Iso Code
6to4 Relay Anycast XF
Afghanistan AF
Aland Islands AX
Albania AL
Algeria DZ

na-ed-outbound-blacklisted-countries-list

Input

Argument Name Description Required
country An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the “na-ed-country-code-list” command. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results returned per page. Default: 10. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistCountry.annotation String A message associated with each country in the outbound block list.
NetscoutAED.OutboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.OutboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "OutboundBlacklistCountry": [
            {
                "annotation": "example1",
                "country": "AZ",
                "update_time": "2021-04-13T13:06:43.000Z"
            },
            {
                "annotation": "example2",
                "country": "IS",
                "update_time": "2021-04-19T15:28:13.000Z"
            }
        ]
    }
}

Human Readable Output

Blacklisted Countries

Country Update Time Annotation
AZ 2021-04-13T13:06:43.000Z example1
IS 2021-04-19T15:28:13.000Z example2

na-ed-outbound-blacklisted-countries-add


Adds one or more countries to the outbound block list.

Base Command

na-ed-outbound-blacklisted-countries-add

Input

Argument Name Description Required
country An ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. Required
annotation A message to associate with each country that you add to the outbound block list. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistCountry.annotation String A message associated with each country in the outbound block list.
NetscoutAED.OutboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.OutboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example

!na-ed-outbound-blacklisted-countries-add country=AU

Context Example

{
    "NetscoutAED": {
        "OutboundBlacklistCountry": {
            "annotation": null,
            "country": "AU",
            "update_time": "2021-05-24T08:58:03.000Z"
        }
    }
}

Human Readable Output

Countries were successfully added to the outbound block listed list

Added Countries

Country Update Time
AU 2021-05-24T08:58:03.000Z

na-ed-outbound-blacklisted-countries-remove


Removes one or more countries from the outbound block list.

Base Command

na-ed-outbound-blacklisted-countries-remove

Input

Argument Name Description Required
country An ISO-standardized country code or a comma-separated list of ISO-standardized country codes to remove. Can be retrieved by running the “na-ed-country-code-list” command. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-outbound-blacklisted-countries-remove country=AU

Human Readable Output

Countries were successfully removed from the outbound block listed list

na-ed-inbound-blacklisted-countries-list


Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.

Base Command

na-ed-inbound-blacklisted-countries-list

Input

Argument Name Description Required
cid A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. Optional
pgid A comma-separated list of protection group IDs. Cannot be used with the cid parameter. Optional
country An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the “na-ed-country-code-list” command. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results returned per page. Default: 10. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistCountry.annotation Unknown List of messages associated with each country in the inbound block list.
NetscoutAED.InboundBlacklistCountry.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.InboundBlacklistCountry.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example

!na-ed-inbound-blacklisted-countries-list country=AM

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistCountry": {
            "annotation": [
                "example1"
            ],
            "cid": [],
            "country": "AM",
            "pgid": [
                52
            ],
            "update_time": "2021-04-19T15:36:00.000Z"
        }
    }
}

Human Readable Output

Blacklisted Countries

Country Update Time Annotation Pgid
AM 2021-04-19T15:36:00.000Z example1 52

na-ed-inbound-blacklisted-countries-add


Adds one or more countries to the inbound block list by pgid or cid.

Base Command

na-ed-inbound-blacklisted-countries-add

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
annotation A message to associate with each country that you add to the block list. Optional
country ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. Required

Context Output

Path Type Description
NetscoutAED.InboundBlacklistCountry.annotation Unknown List of messages associated with each country in the outbound block list.
NetscoutAED.InboundBlacklistCountry.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistCountry.country String An ISO-standardized country code.
NetscoutAED.InboundBlacklistCountry.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistCountry.update_time Date The time that the country code was added to the list.

Command Example

!na-ed-inbound-blacklisted-countries-add country=AU

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistCountry": {
            "annotation": [],
            "cid": [
                -1
            ],
            "country": "AU",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:57:58.000Z"
        }
    }
}

Human Readable Output

Countries were successfully added to the inbound block listed list

Added Countries

Country Cid Pgid Update Time
AU -1 -1 2021-05-24T08:57:58.000Z

na-ed-inbound-blacklisted-countries-remove


Removes one or more countries from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-countries-remove

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
country ISO-standardized country code or a comma-separated list of country codes. Can be retrieved by running the “na-ed-country-code-list” command. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-countries-remove country=AU

Human Readable Output

Countries were successfully removed from the inbound block listed list

na-ed-outbound-blacklisted-hosts-list


Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.

Base Command

na-ed-outbound-blacklisted-hosts-list

Input

Argument Name Description Required
host_address Comma-separated list of IPv4 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistHost.annotation String A description of the host.
NetscoutAED.OutboundBlacklistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundBlacklistHost.update_time Date The time the host was last updated/set.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "OutboundBlacklistHost": [
            {
              "annotation": "",
              "host_address": "1.1.1.1",
              "update_time": "2021-05-24T08:58:07.000Z"
            },
            {
              "annotation": "",
              "host_address": "2.2.2.2",
              "update_time": "2021-05-24T08:58:07.000Z"
            }
        ]
    }
}

Human Readable Output

Blacklisted Hosts

Host Address Update Time
1.1.1.1 2021-05-24T08:58:07.000Z
2.2.2.2 2021-05-24T08:58:07.000Z

na-ed-outbound-blacklisted-hosts-add


Adds one or more hosts to the outbound block list.

Base Command

na-ed-outbound-blacklisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistHost.annotation String A description of the host.
NetscoutAED.OutboundBlacklistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundBlacklistHost.update_time Date The time the host was last updated/set

Command Example

!na-ed-outbound-blacklisted-hosts-add host_address=1.2.3.4

Context Example

{
    "NetscoutAED": {
        "OutboundBlacklistHost": {
            "annotation": "",
            "host_address": "1.2.3.4",
            "update_time": "2021-05-24T08:58:07.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the outbound block list list

New Hosts

Host Address Update Time
1.2.3.4 2021-05-24T08:58:07.000Z

na-ed-outbound-blacklisted-hosts-replace


Replaces all the hosts on the outbound block listed list.

Base Command

na-ed-outbound-blacklisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundBlacklistHost.annotation String A description of the host.
NetscoutAED.OutboundBlacklistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundBlacklistHost.update_time Date The time the host was last updated/set.

Command Example

!na-ed-outbound-blacklisted-hosts-replace host_address=5.2.3.4

Context Example

{
    "NetscoutAED": {
        "OutboundBlacklistHost": {
            "annotation": "",
            "host_address": "5.2.3.4",
            "update_time": "2021-05-24T08:58:08.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully replaced in the outbound block list list

New Hosts

Host Address Update Time
5.2.3.4 2021-05-24T08:58:08.000Z

na-ed-outbound-blacklisted-hosts-remove


Removes one or more hosts or CIDRS from the outbound block list.

Base Command

na-ed-outbound-blacklisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR to remove, or a comma-separated list of IPv4 host addresses or CIDRs to remove. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-outbound-blacklisted-hosts-remove host_address=5.2.3.4

Human Readable Output

Hosts were successfully removed from the outbound block list list

na-ed-outbound-whitelisted-hosts-list


Gets the outbound allow listed hosts. By default, 10 hosts on allow list are returned.

Base Command

na-ed-outbound-whitelisted-hosts-list

Input

Argument Name Description Required
host_address Comma-separated list of IPv4 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit Maximal number of results to retrieve. Also sets the size of the returned page. Optional

Context Output

Path Type Description
NetscoutAED.OutboundWhitelistHost.annotation String A description of the host.
NetscoutAED.OutboundWhitelistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundWhitelistHost.update_time Date The time the host was last updated/set.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "OutboundWhitelistHost": {
            "annotation": "",
            "host_address": "4.4.4.4",
            "update_time": "2021-05-24T08:53:20.000Z"
        }
    }
}

Human Readable Output

Whitelisted Hosts

Host Address Update Time
4.4.4.4 2021-05-24T08:53:20.000Z

na-ed-outbound-whitelisted-hosts-add


Adds one or more hosts to the outbound allow listed list.

Base Command

na-ed-outbound-whitelisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to add. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundWhitelistHost.annotation String A description of the host.
NetscoutAED.OutboundWhitelistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundWhitelistHost.update_time Date The time the host was last updated/set.

Command Example

!na-ed-outbound-whitelisted-hosts-add host_address=3.3.3.3

Context Example

{
    "NetscoutAED": {
        "OutboundWhitelistHost": {
            "annotation": "",
            "host_address": "3.3.3.3",
            "update_time": "2021-05-24T08:58:19.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the outbound allow list list

New Hosts

Host Address Update Time
3.3.3.3 2021-05-24T08:58:19.000Z

na-ed-outbound-whitelisted-hosts-replace


Replaces all the hosts on the outbound allow listed list.

Base Command

na-ed-outbound-whitelisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to update. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.OutboundWhitelistHost.annotation String A description of the host.
NetscoutAED.OutboundWhitelistHost.host_address String IPv4 host address or CIDRs.
NetscoutAED.OutboundWhitelistHost.update_time Date The time the host was last updated/set.

Command Example

!na-ed-outbound-whitelisted-hosts-replace host_address=3.3.3.3,4.4.4.4

Context Example

{
    "NetscoutAED": {
        "OutboundWhitelistHost": [
            {
                "annotation": "",
                "host_address": "3.3.3.3",
                "update_time": "2021-05-24T08:58:21.000Z"
            },
            {
                "annotation": "",
                "host_address": "4.4.4.4",
                "update_time": "2021-05-24T08:58:21.000Z"
            }
        ]
    }
}

Human Readable Output

Hosts were successfully replaced in the outbound allow list list

New Hosts

Host Address Update Time
3.3.3.3 2021-05-24T08:58:21.000Z
4.4.4.4 2021-05-24T08:58:21.000Z

na-ed-protection-groups-update


Updates the settings for one or more protection groups.

Base Command

na-ed-protection-groups-update

Input

Argument Name Description Required
pgid List of protection group IDs. Required
active Set the protection group mode to active (true) or inactive (false). Default: true. Possible values are: true, false. Optional
protection_level The protection level (None = use the global protection level, low, medium, high). Default: low. Possible values are: None, low, medium, high. Optional
profiling Turn traffic profiling on (true) or off (false) for one or more of the protection groups. Possible values are: true, false. Optional
profiling_duration Required when profiling is set to true. Specify the number of days, from 1 to 14, over which profiling will run. Possible values are: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14. Optional

Context Output

Path Type Description
NetscoutAED.ProtectionGroup.active Boolean True if the protection group mode is active, false if inactive.
NetscoutAED.ProtectionGroup.bps_dropped Number Number of dropped bps.
NetscoutAED.ProtectionGroup.bps_passed Number Number of passed bps.
NetscoutAED.ProtectionGroup.bytes_dropped Number Number of dropped bytes.
NetscoutAED.ProtectionGroup.bytes_passed Unknown Number of passed bytes.
NetscoutAED.ProtectionGroup.description String Description of the protection group.
NetscoutAED.ProtectionGroup.name String Protection group name.
NetscoutAED.ProtectionGroup.packets_dropped Number Number of dropped packets.
NetscoutAED.ProtectionGroup.packets_passed Number Number of passed packets.
NetscoutAED.ProtectionGroup.pgid Number Protection group identifier.
NetscoutAED.ProtectionGroup.pps_passed Number Number of passed pps.
NetscoutAED.ProtectionGroup.pps_dropped Number Number of dropped pps.
NetscoutAED.ProtectionGroup.prefixes Unknown List of ‘,’ delimited prefixes belonging to the protection group.
NetscoutAED.ProtectionGroup.profiling Boolean A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
NetscoutAED.ProtectionGroup.profiling_duration Number The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
NetscoutAED.ProtectionGroup.profiling_start Date A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicates that profiling was never started.
NetscoutAED.ProtectionGroup.protection_level Unknown The protection level (None = use the global protection level, low, medium, high).
NetscoutAED.ProtectionGroup.server_name String The protection group’s server name.
NetscoutAED.ProtectionGroup.server_type Number The protection group’s server type.
NetscoutAED.ProtectionGroup.time_created Date The time when the protection group was created.

Command Example

!na-ed-protection-groups-update pgid=52 active=false

Context Example

{
    "NetscoutAED": {
        "ProtectionGroup": {
            "active": false,
            "bps_dropped": 0,
            "bps_passed": 0,
            "bytes_dropped": 0,
            "bytes_passed": 0,
            "description": "",
            "name": "test2",
            "packets_dropped": 0,
            "packets_passed": 0,
            "pgid": 52,
            "pps_dropped": 0,
            "pps_passed": 0,
            "prefixes": [
                "1.1.1.1/32"
            ],
            "profiling": false,
            "profiling_duration": 0,
            "profiling_start": 0,
            "protection_level": "global protection level",
            "server_name": "test2",
            "server_type": 35,
            "time_created": "2021-04-13T14:41:23.000Z"
        }
    }
}

Human Readable Output

Successfully updated the protection group object with protection group id: 52

Protection Groups

Name Pgid Protection Level Active Server Name Profiling Profiling Duration Time Created
test2 52 global protection level false test2 false 0 2021-04-13T14:41:23.000Z

na-ed-protection-groups-list


Gets a list of the protection groups.

Base Command

na-ed-protection-groups-list

Input

Argument Name Description Required
pgid Protection group identifier. Optional
name Protection group name. Optional
active Whether the protection group is active or not. Possible values are: true, false. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional

Context Output

Path Type Description
NetscoutAED.ProtectionGroup.active Boolean True if the protection group mode is active, false if inactive.
NetscoutAED.ProtectionGroup.bps_dropped Number Number of dropped bps.
NetscoutAED.ProtectionGroup.bps_passed Number Number of passed bps.
NetscoutAED.ProtectionGroup.bytes_dropped Number Number of dropped bytes.
NetscoutAED.ProtectionGroup.bytes_passed Unknown Number of passed bytes.
NetscoutAED.ProtectionGroup.description String Description of the protection group.
NetscoutAED.ProtectionGroup.name String Protection group name.
NetscoutAED.ProtectionGroup.packets_dropped Number Number of dropped packets.
NetscoutAED.ProtectionGroup.packets_passed Number Number of passed packets.
NetscoutAED.ProtectionGroup.pgid Number Protection group identifier.
NetscoutAED.ProtectionGroup.pps_passed Number Number of passed pps.
NetscoutAED.ProtectionGroup.pps_dropped Number Number of dropped pps.
NetscoutAED.ProtectionGroup.prefixes Unknown Comma-separated list of prefixes belonging to the protection group.
NetscoutAED.ProtectionGroup.profiling Boolean A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
NetscoutAED.ProtectionGroup.profiling_duration Number The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
NetscoutAED.ProtectionGroup.profiling_start Date A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicats that profiling was never started.
NetscoutAED.ProtectionGroup.protection_level Unknown The protection level (None = use the global protection level, low, medium, high).
NetscoutAED.ProtectionGroup.server_name String The protection group’s server name.
NetscoutAED.ProtectionGroup.server_type Number The protection group’s server type.
NetscoutAED.ProtectionGroup.time_created Date The time when the protection group was created.
NetscoutAED.ProtectionGroup.cid Number Central configuration ID.

Command Example

!na-ed-protection-groups-list active=true

Context Example

{
    "NetscoutAED": {
        "ProtectionGroup": {
            "active": false,
            "bps_dropped": 0,
            "bps_passed": 0,
            "bytes_dropped": 0,
            "bytes_passed": 0,
            "description": "",
            "name": "test2",
            "packets_dropped": 0,
            "packets_passed": 0,
            "pgid": 52,
            "pps_dropped": 0,
            "pps_passed": 0,
            "prefixes": [
                "1.1.1.1/32"
            ],
            "profiling": true,
            "profiling_duration": 0,
            "profiling_start": 0,
            "protection_level": "global protection level",
            "server_name": "test2",
            "server_type": 35,
            "time_created": "2021-04-13T14:41:23.000Z"
        }
    }
}

Human Readable Output

Protection Groups

Name Pgid Protection Level Active Server Name Profiling Profiling Duration Time Created
test2 52 global protection level true test2 false 0 2021-04-13T14:41:23.000Z

na-ed-inbound-blacklisted-hosts-list


Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.

Base Command

na-ed-inbound-blacklisted-hosts-list

Input

Argument Name Description Required
host_address List of ‘,’ delimited IPv4 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (For example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistHost.annotation Unknown List of messages associated with each host in the inbound block list.
NetscoutAED.InboundBlacklistHost.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundBlacklistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistHost.update_time Date The time that the host address was added to the list.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "InboundBlacklistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "1.1.1.1",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:13.000Z"
        }
    }
}

Human Readable Output

Blacklisted Hosts

Host Address Pgid Cid Update Time Annotation
1.1.1.1 -1 -1 2021-05-24T08:58:13.000Z  

na-ed-inbound-blacklisted-hosts-add


Adds one or more hosts to the inbound block listed list.

Base Command

na-ed-inbound-blacklisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistHost.annotation Unknown List of messages associated with each host in the inbound block list.
NetscoutAED.InboundBlacklistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundBlacklistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundBlacklistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistHostupdate_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-blacklisted-hosts-add host_address=1.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "1.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:13.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the inbound block list list

New Hosts

Host Address Pgid Cid Update Time Annotation
1.2.3.4 -1 -1 2021-05-24T08:58:13.000Z  

na-ed-inbound-blacklisted-hosts-replace


Replaces all the hosts on the inbound block list.

Base Command

na-ed-inbound-blacklisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistHost.annotation Unknown List of messages associated with each host in the inbound block list.
NetscoutAED.InboundBlacklistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundBlacklistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundBlacklistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistHost.update_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-blacklisted-hosts-replace host_address=5.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "5.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:15.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully replaced in the inbound block list list

New Hosts

Host Address Pgid Cid Update Time Annotation
5.2.3.4 -1 -1 2021-05-24T08:58:15.000Z  

na-ed-inbound-blacklisted-hosts-remove


Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-hosts-remove host_address=5.2.3.4

Human Readable Output

Hosts were successfully removed from the inbound block list list

na-ed-inbound-whitelisted-hosts-list


Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.

Base Command

na-ed-inbound-whitelisted-hosts-list

Input

Argument Name Description Required
host_address Comma-separated list of IPv4 or IPv6 host addresses or CIDRs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundWhitelistHost.annotation Unknown List of messages associated with each host in the inbound allow listed list.
NetscoutAED.InboundWhitelistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundWhitelistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundWhitelistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundWhitelistHost.update_time Date The time that the host address was added to the list.

Command Example


```json
{
    "NetscoutAED": {
        "InboundWhitelistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "2.2.2.2",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:25.000Z"
        }
    }
}

Human Readable Output

Whitelisted Hosts

Host Address Pgid Cid Update Time Annotation
2.2.2.2 -1 -1 2021-05-24T08:58:25.000Z  

na-ed-inbound-whitelisted-hosts-add


Adds one or more hosts to the inbound allow listed list.

Base Command

na-ed-inbound-whitelisted-hosts-add

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to add. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundWhitelistHost.annotation Unknown List of messages associated with each host in the inbound allow listed list.
NetscoutAED.InboundWhitelistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundWhitelistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundWhitelistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundWhitelistHost.update_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-whitelisted-hosts-add host_address=1.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundWhitelistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "1.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:25.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully added to the inbound allow list list

New Hosts

Host Address Pgid Cid Update Time Annotation
1.2.3.4 -1 -1 2021-05-24T08:58:25.000Z  

na-ed-inbound-whitelisted-hosts-replace


Replaces all the hosts on the inbound allow list.

Base Command

na-ed-inbound-whitelisted-hosts-replace

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to update. Required
annotation A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host. Optional

Context Output

Path Type Description
NetscoutAED.InboundWhitelistHost.annotation Unknown List of messages associated with each host in the inbound allow listed list.
NetscoutAED.InboundWhitelistHost.cid Unknown List of central configuration IDs
NetscoutAED.InboundWhitelistHost.host_address String IPv4 host addresses or CIDRs.
NetscoutAED.InboundWhitelistHost.pgid Unknown List of protection group ID.
NetscoutAED.InboundWhitelistHost.update_time Date The time that the host address was added to the list.

Command Example

!na-ed-inbound-whitelisted-hosts-replace host_address=5.2.3.4

Context Example

{
    "NetscoutAED": {
        "InboundWhitelistHost": {
            "annotation": [
                ""
            ],
            "cid": [
                -1
            ],
            "host_address": "5.2.3.4",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:26.000Z"
        }
    }
}

Human Readable Output

Hosts were successfully replaced in the inbound allow list list

New Hosts

Host Address Pgid Cid Update Time Annotation
5.2.3.4 -1 -1 2021-05-24T08:58:26.000Z  

na-ed-inbound-whitelisted-hosts-remove


Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-whitelisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs to remove. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-whitelisted-hosts-remove host_address=5.2.3.4

Human Readable Output

Hosts were successfully removed from the inbound whitelist list

na-ed-inbound-blacklisted-domains-list


Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.

Base Command

na-ed-inbound-blacklisted-domains-list

Input

Argument Name Description Required
cid Comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. Optional
pgid Comma-separated list of protection group IDs. Cannot be used with the cid parameter. Optional
domain Comma-separated list of domains. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit The maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistDomain.annotation Unknown List of messages associated with each domain in the inbound block list.
NetscoutAED.InboundBlacklistDomain.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistDomain.domain String Domain name.
NetscoutAED.InboundBlacklistDomain.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistDomain.update_time Date The time that the domain was added to the list.

Command Example


#### Context Example

```json
{
    "NetscoutAED": {
        "InboundBlacklistDomain": [
            {
                "annotation": [
                    "try1"
                ],
                "cid": [
                    -1
                ],
                "domain": "sport.co.il",
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-15T16:00:24.000Z"
            },
            {
                "annotation": [],
                "cid": [
                    -1
                ],
                "domain": "sport.com",
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T17:25:26.000Z"
            },
            {
                "annotation": [],
                "cid": [
                    -1
                ],
                "domain": "ynet.com",
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T16:49:50.000Z"
            }
        ]
    }
}

Human Readable Output

Blacklisted Domains

Domain Pgid Cid Update Time Annotation
sport.co.il -1 -1 2021-03-15T16:00:24.000Z try1
sport.com -1 -1 2021-03-18T17:25:26.000Z  
ynet.com -1 -1 2021-03-18T16:49:50.000Z  

na-ed-inbound-blacklisted-domains-add


Adds one or more domains to the block list by pgid or cid.

Base Command

na-ed-inbound-blacklisted-domains-add

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
domain Domain name or a comma-separated list of domain names. Required
annotation A message to associate with each domain that you add to the block list. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistDomain.annotation Unknown List of messages associated with each domain in the inbound blaok list.
NetscoutAED.InboundBlacklistDomain.cid Unknown List of central configuration IDs.
NetscoutAED.InboundBlacklistDomain.domain String Domain name.
NetscoutAED.InboundBlacklistDomain.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistDomain.update_time Unknown The time that the domain was added to the list.

Command Example

!na-ed-inbound-blacklisted-domains-add domain=goo.com

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistDomain": {
            "annotation": [],
            "cid": [
                -1
            ],
            "domain": "goo.com",
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:34.000Z"
        }
    }
}

Human Readable Output

Domains were successfully added to the inbound block listed list

Added Domains

Domain Pgid Cid Update Time
goo.com -1 -1 2021-05-24T08:58:34.000Z

na-ed-inbound-blacklisted-domains-remove


Removes one or more domains from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-domains-remove

Input

Argument Name Description Required
domain Domain name or a comma-separated list of domain names. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-domains-remove domain=goo.com

Human Readable Output

Domains were successfully removed from the inbound block listed list

na-ed-inbound-blacklisted-urls-list


Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.

Base Command

na-ed-inbound-blacklisted-urls-list

Input

Argument Name Description Required
cid Comma-separated list of central configuration IDs. Cannot be used with the pgid parameter. Optional
pgid Comma-separated list of protection group IDs. Cannot be used with the cid parameter. Optional
url Comma-separated list of URLs. Optional
query Search strings, separated by “+” to filter the results. (example: “AZ+BS”). Optional
page The page of the results to return. Optional
limit Maximum number of results to retrieve. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistUrl.annotation Unknown List of messages associated with each URL in the inbound block list.
NetscoutAED.InboundBlacklistUrl.cid Unknown List of central configuration ID.s
NetscoutAED.InboundBlacklistUrl.url String URL address.
NetscoutAED.InboundBlacklistUrl.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistUrl.update_time Date The time that the domain was added to the list.

Command Example

!na-ed-inbound-blacklisted-urls-list limit=3

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistUrl": [
            {
                "annotation": [],
                "cid": [
                    -1
                ],
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T16:52:26.000Z",
                "url": "google.com"
            },
            {
                "annotation": [
                    "Google Maps"
                ],
                "cid": [
                    -1
                ],
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T18:08:39.000Z",
                "url": "maps.google.com"
            },
            {
                "annotation": [
                    "Google Maps"
                ],
                "cid": [
                    -1
                ],
                "pgid": [
                    -1
                ],
                "update_time": "2021-03-18T18:08:27.000Z",
                "url": "maps.google.com/sport.com"
            }
        ]
    }
}

Human Readable Output

Blacklisted URLs

Url Pgid Cid Update Time Annotation
google.com -1 -1 2021-03-18T16:52:26.000Z  
maps.google.com -1 -1 2021-03-18T18:08:39.000Z Google Maps
maps.google.com/sport.com -1 -1 2021-03-18T18:08:27.000Z Google Maps

na-ed-inbound-blacklisted-urls-add


Adds one or more URLs to the block list by pgid or cid.

Base Command

na-ed-inbound-blacklisted-urls-add

Input

Argument Name Description Required
cid A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter. Optional
pgid A specific protection group ID or -1 for global. Cannot be used with the cid parameter. Optional
url URL or a comma-separated list of URLs to add. Required
annotation A message to associate with each URL that you add to the block list. Optional

Context Output

Path Type Description
NetscoutAED.InboundBlacklistUrl.annotation Unknown List of messages associated with each url in the inbound block list.
NetscoutAED.InboundBlacklistUrl.cid Unknown List of central configuration IDs
NetscoutAED.InboundBlacklistUrl.url String URL address.
NetscoutAED.InboundBlacklistUrl.pgid Unknown List of protection group ID.
NetscoutAED.InboundBlacklistUrl.update_time Date The time that the domain was added to the list.

Command Example

!na-ed-inbound-blacklisted-urls-add url=www.goo.com

Context Example

{
    "NetscoutAED": {
        "InboundBlacklistUrl": {
            "annotation": [],
            "cid": [
                -1
            ],
            "pgid": [
                -1
            ],
            "update_time": "2021-05-24T08:58:39.000Z",
            "url": "www.goo.com"
        }
    }
}

Human Readable Output

Urls were successfully added to the inbound block listed list

Added Urls

Url Pgid Cid Update Time
www.goo.com -1 -1 2021-05-24T08:58:39.000Z

na-ed-inbound-blacklisted-urls-remove


Removes one or more URLs from the block list for a specific protection group or for all protection groups.

Base Command

na-ed-inbound-blacklisted-urls-remove

Input

Argument Name Description Required
url URL or a comma-separated list of URLs. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-inbound-blacklisted-urls-remove url=www.goo.com

Human Readable Output

Urls were successfully removed from the inbound block listed list

na-ed-outbound-whitelisted-hosts-remove


Removes one or more hosts or CIDRs from the outbound allow list.

Base Command

na-ed-outbound-whitelisted-hosts-remove

Input

Argument Name Description Required
host_address A single IPv4 host address or CIDR, or a comma-separated list of IPv4 host addresses or CIDRs to remove. Required

Context Output

There is no context output for this command.

Command Example

!na-ed-outbound-whitelisted-hosts-remove host_address=3.3.3.3

Human Readable Output

Hosts were successfully removed from the outbound allow list list

Configuration parameters

  • base_url — Server URL (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • User

Commands (31)

  • na-ed-country-code-list

    Gets a country or list of countries (country name and ISO-standardized country code).

  • na-ed-inbound-blacklisted-countries-add

    Adds one or more countries to the inbound block list by pgid or cid.

  • na-ed-inbound-blacklisted-countries-list

    Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.

  • na-ed-inbound-blacklisted-countries-remove

    Removes one or more countries from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-blacklisted-domains-add

    Adds one or more domains to the block list by pgid or cid.

  • na-ed-inbound-blacklisted-domains-list

    Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.

  • na-ed-inbound-blacklisted-domains-remove

    Removes one or more domains from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-blacklisted-hosts-add

    Adds one or more hosts to the inbound block listed list.

  • na-ed-inbound-blacklisted-hosts-list

    Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.

  • na-ed-inbound-blacklisted-hosts-remove

    Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-blacklisted-hosts-replace

    Replaces all the hosts on the inbound block list.

  • na-ed-inbound-blacklisted-urls-add

    Adds one or more URLs to the block list by pgid or cid.

  • na-ed-inbound-blacklisted-urls-list

    Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.

  • na-ed-inbound-blacklisted-urls-remove

    Removes one or more URLs from the block list for a specific protection group or for all protection groups.

  • na-ed-inbound-whitelisted-hosts-add

    Adds one or more hosts to the inbound allow listed list.

  • na-ed-inbound-whitelisted-hosts-list

    Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.

  • na-ed-inbound-whitelisted-hosts-remove

    Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.

  • na-ed-inbound-whitelisted-hosts-replace

    Replaces all the hosts on the inbound allow list.

  • na-ed-outbound-blacklisted-countries-add

    Adds one or more countries to the outbound block list.

  • na-ed-outbound-blacklisted-countries-list

    Gets the countries on the outbound block list. By default, 10 block listed countries are returned.

  • na-ed-outbound-blacklisted-countries-remove

    Removes one or more countries from the outbound block list.

  • na-ed-outbound-blacklisted-hosts-add

    Adds one or more hosts to the outbound block list.

  • na-ed-outbound-blacklisted-hosts-list

    Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.

  • na-ed-outbound-blacklisted-hosts-remove

    Removes one or more hosts or CIDRS from the outbound block list.

  • na-ed-outbound-blacklisted-hosts-replace

    Replaces all the hosts on the outbound block listed list.

  • na-ed-outbound-whitelisted-hosts-add

    Adds one or more hosts to the outbound whitelisted list.

  • na-ed-outbound-whitelisted-hosts-list

    Gets the outbound hosts on allow list. By default, 10 hosts on allow list are returned.

  • na-ed-outbound-whitelisted-hosts-remove

    Removes one or more hosts or CIDRs from the outbound allow list.

  • na-ed-outbound-whitelisted-hosts-replace

    Replaces all the hosts on the outbound allow listed list.

  • na-ed-protection-groups-list

    Gets a list of the protection groups.

  • na-ed-protection-groups-update

    Updates the settings for one or more protection groups.

import json

import pytest
import requests_mock
from CommonServerPython import DemistoException
from NetscoutAED import Client

MOCK_URL = "http://base_url_mock"
client = Client(base_url=MOCK_URL, verify=False, api_token="api_token", proxy=False)

inbound_blacklisted = {"direction": "inbound", "list_color": "blacklist"}
inbound_whitelisted = {"direction": "inbound", "list_color": "whitelist"}
outbound_blacklisted = {"direction": "outbound", "list_color": "blacklist"}
outbound_whitelisted = {"direction": "outbound", "list_color": "whitelist"}


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_objects_time_to_readable_time():
    """

    Given:
        - A list of objects with same time key and a valid key name

    When:
        - When the api returns list of objects with timestamps (seconds)

    Then:
        - The time value of each object is replaced with a date string (ISO 8601 format)

    """
    from NetscoutAED import objects_time_to_readable_time

    list_of_objects = [
        {"countryName": "country", "createdTime": 1615888547},
        {"countryName": "country", "createdTime": 1615838546},
    ]
    time_key = "createdTime"
    objects_time_to_readable_time(list_of_objects, time_key)
    expected_output = [
        {"country_name": "country", "created_time": "2021-03-16T09:55:47.000Z"},
        {"country_name": "country", "created_time": "2021-03-15T20:02:26.000Z"},
    ]
    assert len(list_of_objects) == len(expected_output)
    assert all(x == y for x, y in zip(list_of_objects, expected_output))


def test_objects_time_to_readable_time_key_mismatch():
    """

    Given:
        - A key that does not match the keys in the list of objects

    When:
        - When the api returns list of objects with timestamps (seconds)

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import objects_time_to_readable_time

    with pytest.raises(DemistoException, match="argument is not valid"):
        objects_time_to_readable_time([{"createdTime": 1615888547}, {"createdTime": 1615444547}], "TimeKey")


def test_serialize_protection_groups():
    """

    Given:
        - A valid object

    When:
        - When the api expects a different format

    Then:
        - Returns the expected format

    """
    from NetscoutAED import serialize_protection_groups

    protection_groups_list = [
        {"active": True, "protectionLevel": "low"},
        {"active": False, "protectionLevel": "medium"},
        {"active": False, "protectionLevel": "high"},
    ]
    expected_output = [
        {"active": 1, "protectionLevel": 1},
        {"active": 0, "protectionLevel": 2},
        {"active": 0, "protectionLevel": 3},
    ]
    for i, protection_group in enumerate(protection_groups_list):
        serialize_protection_groups(protection_group)
        assert protection_groups_list[i] == expected_output[i]


def test_deserialize_protection_groups():
    """

    Given:
        - A valid list of objects

    When:
        - When the human readable expects a different format

    Then:
        - Returns the expected format

    """
    from NetscoutAED import deserialize_protection_groups

    protection_groups_list = [
        {"active": 1, "protectionLevel": 1},
        {"active": 0, "protectionLevel": 2},
        {"active": 0, "protectionLevel": 3},
    ]
    expected_output = [
        {"active": True, "protectionLevel": "low"},
        {"active": False, "protectionLevel": "medium"},
        {"active": False, "protectionLevel": "high"},
    ]
    deserialize_protection_groups(protection_groups_list)
    assert len(protection_groups_list) == len(expected_output)
    assert all(x == y for x, y in zip(protection_groups_list, expected_output))


def test_country_code_list_command(mocker):
    """

    Given:
        - A valid args input

    When:
        - Running country code list command.

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import country_code_list_command

    countries_code_raw_response = util_load_json("test_data/countries_codes/countries_code_raw.json")
    mocker.patch.object(client, "country_code_list_command", return_value=countries_code_raw_response)
    result = country_code_list_command(client, {})
    assert "Anguilla" in result.readable_output
    assert "| Algeria | DZ |" in result.readable_output
    assert {"country_name": "Afghanistan", "iso_code": "AF"} in result.outputs


country_list_params = [
    (
        outbound_blacklisted,
        "outbound_blacklisted_country_list_command",
        "outbound_blacklisted_countries_raw.json",
        {"annotation": "Test", "country": "BD", "update_time": "2021-03-16T16:57:16.000Z"},
    ),
    (
        inbound_blacklisted,
        "inbound_blacklisted_country_list_command",
        "inbound_blacklisted_countries_raw.json",
        {"annotation": ["Test2"], "cid": [-1], "country": "BF", "pgid": [-1], "update_time": "2021-03-15T10:17:32.000Z"},
    ),
]


@pytest.mark.parametrize("direction_color, func_mock, raw_respond, expected_output", country_list_params)
def test_handle_country_list_commands(mocker, direction_color, func_mock, raw_respond, expected_output):
    """

    Given:
        - A valid args input

    When:
        - Running blacklisted country list command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_country_list_commands

    outbound_blacklisted_countries_raw_response = util_load_json(f"test_data/countries/{raw_respond}")
    mocker.patch.object(client, func_mock, return_value=outbound_blacklisted_countries_raw_response)
    result = handle_country_list_commands(client, {}, direction_color)
    assert "Test" in result.readable_output
    assert "| AI | 2021-03-16T16:57:09.000Z |" in result.readable_output
    assert expected_output in result.outputs


country_addition_params = [
    (
        "BS",
        outbound_blacklisted,
        "outbound_blacklisted_country_add_command",
        "added_outbound_blacklisted_countries_raw.json",
        [{"annotation": "Test", "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"}],
    ),
    (
        "BS,AU",
        outbound_blacklisted,
        "outbound_blacklisted_country_add_command",
        "added_outbound_blacklisted_countries_raw.json",
        [
            {"annotation": "Test", "country": "AU", "update_time": "2021-03-16T17:54:38.000Z"},
            {"annotation": None, "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"},
        ],
    ),
    (
        "BS",
        inbound_blacklisted,
        "inbound_blacklisted_country_add_command",
        "added_inbound_blacklisted_countries_raw.json",
        [{"annotation": "Test", "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"}],
    ),
    (
        "BS,AU",
        inbound_blacklisted,
        "inbound_blacklisted_country_add_command",
        "added_inbound_blacklisted_countries_raw.json",
        [
            {"annotation": "Test", "country": "AU", "update_time": "2021-03-16T17:54:38.000Z"},
            {"annotation": None, "country": "BS", "update_time": "2021-03-14T12:18:05.000Z"},
        ],
    ),
]


@pytest.mark.parametrize("country, direction_color, func_mock, raw_respond, expected_output", country_addition_params)
def test_handle_country_addition_commands(mocker, country, func_mock, raw_respond, direction_color, expected_output):
    """

    Given:
        - (case1) A valid args and a single country to add input
        - (case2) A valid args and multiple countries to add input (comma seperated)

    When:
        - Running outbound/inbound blacklisted country add command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_country_addition_commands

    blacklisted_countries_raw = util_load_json("test_data/countries/" + raw_respond)
    if country == "BS":
        blacklisted_countries_raw = blacklisted_countries_raw["single_country_output"]
    elif country == "BS,AU":
        blacklisted_countries_raw = blacklisted_countries_raw["multiple_country_output"]

    mocker.patch.object(client, func_mock, return_value=blacklisted_countries_raw)
    result = handle_country_addition_commands(client, {"country": country}, direction_color)
    assert "Test" in result.readable_output
    assert "| BS | 2021-03-14T12:18:05.000Z |" in result.readable_output
    assert all(x == y for x, y in zip(expected_output, result.outputs))


def test_handle_country_addition_commands_no_country_given():
    """

    Given:
        - An invalid country input

    When:
        - Running outbound/inbound blacklisted country add command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_country_addition_commands

    with pytest.raises(DemistoException, match="A country code must be provided in order to add"):
        handle_country_addition_commands(client, {}, outbound_blacklisted)


@pytest.mark.parametrize(
    "country, func_mock, url_suffix, direction_color",
    [
        ("BS", "outbound_blacklisted_country_delete_command", "/otf/blacklisted-countries/", outbound_blacklisted),
        ("BS,AU", "outbound_blacklisted_country_delete_command", "/otf/blacklisted-countries/", outbound_blacklisted),
        ("BS", "inbound_blacklisted_country_delete_command", "/protection-groups/blacklisted-countries/", inbound_blacklisted),
        ("BS,AU", "inbound_blacklisted_country_delete_command", "/protection-groups/blacklisted-countries/", inbound_blacklisted),
    ],
)
def test_handle_country_deletion_commands(country, func_mock, url_suffix, direction_color):
    """

    Given:
        - (case1) A valid args and a single country to remove input
        - (case2) A valid args and multiple countries to remove input (comma seperated)

    When:
        - Running outbound/inbound blacklisted country remove command

    Then:
        - Ensure expected response is returned

    """
    from NetscoutAED import handle_country_deletion_commands

    with requests_mock.Mocker() as m:
        m.delete(f"{MOCK_URL}{url_suffix}", status_code=204)
        result = handle_country_deletion_commands(client, {"country": country}, direction_color)
    assert "Countries were successfully removed" in result


def test_handle_country_deletion_commands_no_country_given():
    """

    Given:
        - An invalid country input

    When:
        - Running outbound/inbound blacklisted country delete command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_country_deletion_commands

    with pytest.raises(DemistoException, match="A country code must be provided in order to add"):
        handle_country_deletion_commands(client, {}, outbound_blacklisted)


hosts_list_params = [
    (
        outbound_blacklisted,
        "outbound_blacklisted_host_list_command",
        "outbound_blacklisted_hosts_list_raw.json",
        [{"annotation": "blacklisted outbound", "host_address": "6.6.6.6", "update_time": "2021-03-15T13:16:11.000Z"}],
    ),
    (
        inbound_blacklisted,
        "inbound_blacklisted_host_list_command",
        "inbound_blacklisted_hosts_list_raw.json",
        [
            {
                "annotation": ["blacklisted inbound"],
                "cid": [-1],
                "host_address": "1.1.1.1",
                "pgid": [-1],
                "update_time": "2021-03-15T13:16:11.000Z",
            }
        ],
    ),
    (
        outbound_whitelisted,
        "outbound_whitelisted_host_list_command",
        "outbound_whitelisted_hosts_list_raw.json",
        [{"annotation": "whitelisted outbound", "host_address": "12.1.1.1", "update_time": "2021-03-15T13:16:11.000Z"}],
    ),
    (
        inbound_whitelisted,
        "inbound_whitelisted_host_list_command",
        "inbound_whitelisted_hosts_list_raw.json",
        [
            {
                "annotation": ["whitelisted inbound"],
                "cid": [-1],
                "host_address": "6.6.6.6",
                "pgid": [-1],
                "update_time": "2021-03-15T13:16:11.000Z",
            }
        ],
    ),
]


@pytest.mark.parametrize("direction_color, func_mock, raw_respond, expected_output", hosts_list_params)
def test_handle_host_list_commands(mocker, direction_color, func_mock, raw_respond, expected_output):
    """

    Given:
        - A valid args input

    When:
        - Running hosts list command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_host_list_commands

    outbound_blacklisted_hosts_raw_response = util_load_json(f"test_data/hosts/{raw_respond}")
    mocker.patch.object(client, func_mock, return_value=outbound_blacklisted_hosts_raw_response)
    result = handle_host_list_commands(client, {}, direction_color)
    assert direction_color["direction"]
    assert direction_color["list_color"] in result.readable_output
    assert "2021-03-15T13:16:11.000Z" in result.readable_output
    assert expected_output[0] == result.outputs[0]


host_addition_params = [
    (
        "1.1.1.1",
        outbound_blacklisted,
        "outbound_blacklisted_host_add_update_command",
        "added_or_updated_outbound_blacklisted_hosts_raw.json",
        [{"annotation": "Test blacklisted outbound", "host_address": "1.1.1.1", "update_time": "2021-03-18T10:38:56.000Z"}],
    ),
    (
        "2.2.2.2,3.3.3.3",
        outbound_blacklisted,
        "outbound_blacklisted_host_add_update_command",
        "added_or_updated_outbound_blacklisted_hosts_raw.json",
        [
            {"annotation": "Test blacklisted outbound", "host_address": "2.2.2.2", "update_time": "2021-03-18T10:41:27.000Z"},
            {"annotation": "Test blacklisted outbound", "host_address": "3.3.3.3", "update_time": "2021-03-18T10:41:27.000Z"},
        ],
    ),
    (
        "1.1.1.1",
        inbound_blacklisted,
        "inbound_blacklisted_host_add_update_command",
        "added_or_updated_inbound_blacklisted_hosts_raw.json",
        [
            {
                "annotation": ["Test blacklisted inbound"],
                "cid": [-1],
                "host_address": "1.1.1.1",
                "pgid": [-1],
                "update_time": "2021-03-18T10:48:37.000Z",
            }
        ],
    ),
    (
        "2.2.2.2,3.3.3.3",
        inbound_blacklisted,
        "inbound_blacklisted_host_add_update_command",
        "added_or_updated_inbound_blacklisted_hosts_raw.json",
        [
            {
                "annotation": ["Test blacklisted inbound"],
                "cid": [-1],
                "host_address": "2.2.2.2",
                "pgid": [-1],
                "update_time": "2021-03-18T10:53:00.000Z",
            },
            {
                "annotation": ["Test blacklisted inbound"],
                "cid": [-1],
                "host_address": "3.3.3.3",
                "pgid": [-1],
                "update_time": "2021-03-18T10:53:00.000Z",
            },
        ],
    ),
    (
        "1.1.1.1",
        outbound_whitelisted,
        "outbound_whitelisted_host_add_update_command",
        "added_or_updated_outbound_whitelisted_hosts_raw.json",
        [{"annotation": "Test whitelisted outbound", "host_address": "1.1.1.1", "update_time": "2021-03-18T10:44:09.000Z"}],
    ),
    (
        "2.2.2.2,3.3.3.3",
        outbound_whitelisted,
        "outbound_whitelisted_host_add_update_command",
        "added_or_updated_outbound_whitelisted_hosts_raw.json",
        [
            {"annotation": "Test whitelisted outbound", "host_address": "2.2.2.2", "update_time": "2021-03-18T10:45:18.000Z"},
            {"annotation": "Test whitelisted outbound", "host_address": "3.3.3.3", "update_time": "2021-03-18T10:45:18.000Z"},
        ],
    ),
    (
        "1.1.1.1",
        inbound_whitelisted,
        "inbound_whitelisted_host_add_update_command",
        "added_or_updated_inbound_whitelisted_hosts_raw.json",
        [
            {
                "annotation": ["Test whitelisted inbound"],
                "cid": [-1],
                "host_address": "1.1.1.1",
                "pgid": [-1],
                "update_time": "2021-03-18T10:48:37.000Z",
            }
        ],
    ),
    (
        "2.2.2.2,3.3.3.3",
        inbound_whitelisted,
        "inbound_whitelisted_host_add_update_command",
        "added_or_updated_inbound_whitelisted_hosts_raw.json",
        [
            {
                "annotation": ["Test whitelisted inbound"],
                "cid": [-1],
                "host_address": "2.2.2.2",
                "pgid": [-1],
                "update_time": "2021-03-18T10:50:36.000Z",
            },
            {
                "annotation": ["Test whitelisted inbound"],
                "cid": [-1],
                "host_address": "3.3.3.3",
                "pgid": [-1],
                "update_time": "2021-03-18T10:50:36.000Z",
            },
        ],
    ),
]


@pytest.mark.parametrize("host, direction_color, func_mock, raw_respond, expected_output", host_addition_params)
def test_handle_host_addition_commands(mocker, host, func_mock, raw_respond, direction_color, expected_output):
    """

    Given:
        - (case1) A valid args and a single host to add/update input
        - (case2) A valid args and multiple host to add/update input (comma seperated)

    When:
        - Running host addition/update command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_host_addition_and_replacement_commands

    hosts_raw = util_load_json("test_data/hosts/" + raw_respond)
    if host == "1.1.1.1":
        hosts_raw = hosts_raw["single_host_output"]
    elif host == "2.2.2.2,3.3.3.3":
        hosts_raw = hosts_raw["multiple_hosts_output"]

    mocker.patch.object(client, func_mock, return_value=hosts_raw)
    result = handle_host_addition_and_replacement_commands(client, {"host_address": host}, direction_color)
    assert "Hosts were successfully" in result.readable_output
    assert all(x == y for x, y in zip(expected_output, result.outputs))


def test_handle_host_addition_commands_no_host_given():
    """

    Given:
        - An invalid host input

    When:
        - Running host addition command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_host_addition_and_replacement_commands

    with pytest.raises(DemistoException, match="A host address must be provided in order to add/update"):
        handle_host_addition_and_replacement_commands(client, {}, outbound_blacklisted)


host_deletion_params = [
    ("1.1.1.1", outbound_blacklisted, "outbound_blacklisted_host_remove_command", "/otf/blacklisted-hosts/"),
    ("2.2.2.2,3.3.3.3", outbound_blacklisted, "outbound_blacklisted_host_remove_command", "/otf/blacklisted-hosts/"),
    ("1.1.1.1", inbound_blacklisted, "inbound_blacklisted_host_remove_command", "/protection-groups/blacklisted-hosts/"),
    ("2.2.2.2,3.3.3.3", inbound_blacklisted, "inbound_blacklisted_host_remove_command", "/protection-groups/blacklisted-hosts/"),
    ("1.1.1.1", outbound_whitelisted, "outbound_whitelisted_host_remove_command", "/otf/whitelisted-hosts/"),
    ("2.2.2.2,3.3.3.3", outbound_whitelisted, "outbound_whitelisted_host_remove_command", "/otf/whitelisted-hosts/"),
    ("1.1.1.1", inbound_whitelisted, "inbound_whitelisted_host_remove_command", "/protection-groups/whitelisted-hosts/"),
    ("2.2.2.2,3.3.3.3", inbound_whitelisted, "inbound_whitelisted_host_remove_command", "/protection-groups/whitelisted-hosts/"),
]


@pytest.mark.parametrize("host, direction_color, func_mock, url_suffix", host_deletion_params)
def test_handle_host_deletion_commands(host, func_mock, direction_color, url_suffix):
    """

    Given:
        - (case1) A valid args and a single host to remove input
        - (case2) A valid args and multiple hosts to remove input (comma seperated)

    When:
        - Running host deletion command

    Then:
        - Ensure expected response is returned

    """
    from NetscoutAED import handle_host_deletion_commands

    with requests_mock.Mocker() as m:
        m.delete(f"{MOCK_URL}{url_suffix}", status_code=204)
        result = handle_host_deletion_commands(client, {"host_address": host}, direction_color)
    assert "Hosts were successfully removed" in result


def test_handle_host_deletion_commands_no_host_given():
    """

    Given:
        - An invalid host input

    When:
        - Running host deletion command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_host_deletion_commands

    with pytest.raises(DemistoException, match="A host address must be provided in order to remove"):
        handle_host_deletion_commands(client, {}, outbound_blacklisted)


def test_handle_protection_groups_list_commands(mocker):
    """

    Given:
        - A valid args input

    When:
        - Running protection groups list command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_protection_groups_list_commands

    protection_groups_raw_response = util_load_json("test_data/protection_groups/protection_groups_list_raw.json")
    mocker.patch.object(client, "protection_group_list_command", return_value=protection_groups_raw_response)
    expected_output = {
        "active": False,
        "bps_dropped": 0,
        "bps_passed": 0,
        "bytes_dropped": 0,
        "bytes_passed": 0,
        "cid": None,
        "description": "The default protection group on 0.0.0.0/0",
        "name": "Default Protection Group",
        "packets_dropped": 0,
        "packets_passed": 0,
        "pgid": 7,
        "pps_dropped": 0,
        "pps_passed": 0,
        "prefixes": ["0.0.0.0/0"],
        "profiling": False,
        "profiling_duration": 0,
        "profiling_start": 0,
        "protection_level": "low",
        "server_name": "Generic Server",
        "server_type": 0,
        "time_created": "2021-01-17T13:54:13.000Z",
    }
    result = handle_protection_groups_list_commands(client, {})
    assert "Default Protection Group" in result.readable_output
    assert "Generic Server" in result.readable_output
    assert "42" in result.readable_output
    assert expected_output == result.outputs[0]


def test_handle_protection_groups_update_commands(mocker):
    """

    Given:
        - A valid args input

    When:
        - Running protection groups update command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_protection_groups_update_commands

    protection_groups_update_raw_response = util_load_json("test_data/protection_groups/protection_groups_update_raw.json")
    mocker.patch.object(client, "protection_group_patch_command", return_value=protection_groups_update_raw_response)
    expected_output = {
        "active": False,
        "bps_dropped": 0,
        "bps_passed": 0,
        "bytes_dropped": 0,
        "bytes_passed": 0,
        "description": "The default protection group on 0.0.0.0/0",
        "name": "Default Protection Group",
        "packets_dropped": 0,
        "packets_passed": 0,
        "pgid": 7,
        "pps_dropped": 0,
        "pps_passed": 0,
        "prefixes": ["0.0.0.0/0"],
        "profiling": False,
        "profiling_duration": 0,
        "profiling_start": 0,
        "protection_level": "low",
        "server_name": "Generic Server",
        "server_type": 0,
        "time_created": "2021-01-17T13:54:13.000Z",
    }
    result = handle_protection_groups_update_commands(client, {"pgid": 7})
    assert "Successfully updated the protection group object with protection group id: 7" in result.readable_output
    assert "Default Protection Group" in result.readable_output
    assert expected_output == result.outputs[0]


def test_handle_protection_groups_update_commands_no_pgid_given(mocker):
    """

    Given:
        - An invalid pgid input

    When:
        - Running protection group update command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_protection_groups_update_commands

    with pytest.raises(DemistoException, match="A pgid must be provided in order to update"):
        handle_protection_groups_update_commands(client, {})


def test_handle_domain_list_commands(mocker):
    """

    Given:
        - A valid args input

    When:
        - Running inbound blacklisted domain list command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_domain_list_commands

    inbound_blacklisted_domains_raw_response = util_load_json("test_data/domains/inbound_blacklisted_domains_raw.json")
    mocker.patch.object(client, "inbound_blacklisted_domain_list_command", return_value=inbound_blacklisted_domains_raw_response)
    result = handle_domain_list_commands(client, {})
    assert "google.com" in result.readable_output
    assert "2021-03-18T16:49:50.000Z" in result.readable_output
    assert result.outputs[0] == {
        "annotation": [],
        "cid": [-1],
        "domain": "google.com",
        "pgid": [-1],
        "update_time": "2021-03-18T16:49:26.000Z",
    }


domain_addition_params = [
    (
        "google.com",
        [{"annotation": [], "cid": [-1], "domain": "google.com", "pgid": [-1], "update_time": "2021-03-18T16:49:26.000Z"}],
    ),
    (
        "google.com,sport.com",
        [
            {"annotation": [], "cid": [-1], "domain": "google.com", "pgid": [-1], "update_time": "2021-03-18T16:49:26.000Z"},
            {"annotation": [], "cid": [-1], "domain": "sport.com", "pgid": [-1], "update_time": "2021-03-18T17:25:26.000Z"},
        ],
    ),
]


@pytest.mark.parametrize("domain, expected_output", domain_addition_params)
def test_handle_domain_addition_commands(mocker, domain, expected_output):
    """

    Given:
        - (case1) A valid args and a single domain to add input
        - (case2) A valid args and multiple domains to add input (comma seperated)

    When:
        - Running domain addition command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_domain_addition_commands

    domains_raw = util_load_json("test_data/domains/added_inbound_blacklisted_domains_raw.json")
    if domain == "google.com":
        domains_raw = domains_raw["single_domain_output"]
    elif domain == "google.com,sport.com":
        domains_raw = domains_raw["multiple_domains_output"]

    mocker.patch.object(client, "inbound_blacklisted_domain_add_command", return_value=domains_raw)
    result = handle_domain_addition_commands(client, {"domain": domain})
    assert "Domains were successfully added to the inbound blacklisted list" in result.readable_output
    assert "google.com" in result.readable_output
    assert all(x == y for x, y in zip(expected_output, result.outputs))


def test_handle_domain_addition_commands_no_domain_given():
    """

    Given:
        - An invalid domain input

    When:
        - Running domain addition command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_domain_addition_commands

    with pytest.raises(DemistoException, match="A domain must be provided in order to add"):
        handle_domain_addition_commands(client, {})


@pytest.mark.parametrize("domain", [("google.com"), ("google.com,sport.com")])
def test_handle_domain_deletion_commands(mocker, domain):
    """

    Given:
        - (case1) A valid args and a single domain to remove input
        - (case2) A valid args and multiple domains to remove input (comma seperated)

    When:
        - Running domain deletion command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_domain_deletion_commands

    with requests_mock.Mocker() as m:
        m.delete(f"{MOCK_URL}/protection-groups/blacklisted-domains/", status_code=204)
        result = handle_domain_deletion_commands(client, {"domain": domain})
    assert "Domains were successfully removed" in result


def test_handle_domain_deletion_commands_no_domain_given():
    """

    Given:
        - An invalid domain input

    When:
        - Running domain deletion command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_domain_deletion_commands

    with pytest.raises(DemistoException, match="A domain must be provided in order to remove"):
        handle_domain_deletion_commands(client, {})


def test_handle_url_list_commands(mocker):
    """

    Given:
        - A valid args input

    When:
        - Running inbound blacklisted url list command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_url_list_commands

    inbound_blacklisted_urls_raw_response = util_load_json("test_data/urls/inbound_blacklisted_urls_raw.json")
    mocker.patch.object(client, "inbound_blacklisted_url_list_command", return_value=inbound_blacklisted_urls_raw_response)
    result = handle_url_list_commands(client, {})
    assert "google.com" in result.readable_output
    assert "2021-03-18T16:52:26.000Z" in result.readable_output
    assert result.outputs[0] == {
        "annotation": [],
        "cid": [-1],
        "pgid": [-1],
        "url": "google.com",
        "update_time": "2021-03-18T16:52:26.000Z",
    }


url_addition_params = [
    (
        "maps.google.com",
        [
            {
                "annotation": ["Google Maps"],
                "cid": [-1],
                "pgid": [-1],
                "url": "maps.google.com",
                "update_time": "2021-03-18T18:08:39.000Z",
            }
        ],
    ),
    (
        "maps.google.com,sport.com",
        [
            {
                "annotation": ["Google Maps"],
                "cid": [-1],
                "pgid": [-1],
                "url": "maps.google.com",
                "update_time": "2021-03-18T18:08:39.000Z",
            },
            {
                "annotation": ["Google Maps"],
                "cid": [-1],
                "pgid": [-1],
                "url": "sport.com",
                "update_time": "2021-03-18T18:08:39.000Z",
            },
        ],
    ),
]


@pytest.mark.parametrize("url, expected_output", url_addition_params)
def test_handle_url_addition_commands(mocker, url, expected_output):
    """

    Given:
        - (case1) A valid args and a single url to add input
        - (case2) A valid args and multiple urls to add input (comma seperated)

    When:
        - Running domain addition command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_url_addition_commands

    urls_raw = util_load_json("test_data/urls/added_inbound_blacklisted_urls_raw.json")
    if url == "maps.google.com":
        urls_raw = urls_raw["single_url_output"]
    elif url == "maps.google.com,sport.com":
        urls_raw = urls_raw["multiple_urls_output"]

    mocker.patch.object(client, "inbound_blacklisted_url_add_command", return_value=urls_raw)
    result = handle_url_addition_commands(client, {"url": url})
    assert "Urls were successfully added to the inbound blacklisted list" in result.readable_output
    assert "maps.google.com" in result.readable_output
    assert all(x == y for x, y in zip(expected_output, result.outputs))


def test_handle_url_addition_commands_no_url_given():
    """

    Given:
        - An invalid url input

    When:
        - Running url addition command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_url_addition_commands

    with pytest.raises(DemistoException, match="A URL must be provided in order to add"):
        handle_url_addition_commands(client, {})


@pytest.mark.parametrize("url", [("google.com"), ("google.com,sport.com")])
def test_handle_url_deletion_commands(url):
    """

    Given:
        - (case1) A valid args and a single url to remove input
        - (case2) A valid args and multiple urls to remove input (comma seperated)

    When:
        - Running url deletion command

    Then:
        - Ensure expected human readable response is returned and output is correct

    """
    from NetscoutAED import handle_url_deletion_commands

    with requests_mock.Mocker() as m:
        m.delete(f"{MOCK_URL}/protection-groups/blacklisted-urls/", status_code=204)
        result = handle_url_deletion_commands(client, {"url": url})
    assert "URLs were successfully removed" in result


def test_handle_url_deletion_commands_no_url_given():
    """

    Given:
        - An invalid url input

    When:
        - Running url deletion command

    Then:
        - An exception is raised by the function

    """
    from NetscoutAED import handle_url_deletion_commands

    with pytest.raises(DemistoException, match="A URL must be provided in order to remove"):
        handle_url_deletion_commands(client, {})