ARIA Packet Intelligence

The ARIA Cybesecurity Solutions Software-Defined Security (SDS) platform integrates with Cortex XSOAR to add robustness when responding to incidents. The combination of ARIA hardware, in the form of a Secure Intelligent Adapter (SIA), and software, specifically Packet Intelligence and SDS orchestrator (SDSo), provides the elements required to react instantly when an incident is detected. When integrated with the ARIA solution, you can create playbooks that instruct one or more SIAs to add, modify, or delete rules automatically. These rule changes, which take effect immediately, can block conversations, redirect packets to a recorder or VLAN, or perform a variety of other actions.

Category

Network Security

Pack

ARIAPacketIntelligence

Configuration parameters

• sdso — SDSo Base URL (e.g. http://<IP address or FQDN of SDSo Node>:7443) (required)
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)

Commands (30)

• aria-alert-conversation — Adds a rule that generates an alert when a conversation that matches the specified 5-tuple values is detected.
• aria-alert-dest-port — Creates a rule that generates an alert when traffic destined for one or more ports is detected.
• aria-alert-dest-subnet — Creates a rule that generates an alert when traffic destined for a specific IP address or range of IP addresses is detected.
• aria-alert-src-port — Creates a rule that generates an alert when traffic originating from one or more ports is detected.
• aria-alert-src-subnet — Adds a rule that generates an alert when traffic originating from a specific IP address or range of IP addresses is detected.
• aria-block-conversation — Creates a rule that drops all packets that match the specified 5-tuple values.
• aria-block-dest-port — Creates a rule that blocks packets destined for one or more specified ports.
• aria-block-dest-subnet — Adds a rule that blocks packets destined for a specific IP address or range of IP addresses.
• aria-block-src-port — Adds a rule that blocks packets originating from one or more specific ports.
• aria-block-src-subnet — Adds a rule that blocks packets originating from a specific IP address or range of IP addresses.
• aria-mute-alert-conversation — Removes a named rule from the 5-tuple logic block, disabling the alerts.
• aria-mute-alert-dest-port — Removes a named rule from the destination port logic block, disabling the alerts.
• aria-mute-alert-dest-subnet — Removes a named rule from the destination subnet logic block, disabling the alerts.
• aria-mute-alert-src-port — Removes a named rule from the source port logic block, disabling the alerts.
• aria-mute-alert-src-subnet — Removes a named rule from the source subnet logic block, disabling the alerts.
• aria-record-conversation — Creates a rule that redirects a conversation that matches 5-tuple values to the Packet Recorder. Packets are tagged with the VID specified in the instance.
• aria-record-dest-port — Adds a rule that redirects traffic that is destined for one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.
• aria-record-dest-subnet — Creates a rule that redirects traffic destined for a specific IP address or range of IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.
• aria-record-src-port — Adds a rule that redirects traffic originating from one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.
• aria-record-src-subnet — Creates a rule that redirects traffic originating from one or more specific IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.
• aria-stop-recording-conversation — Removes the named rule from the 5-tuple block. This stops redirecting traffic to the Packet Recorder.
• aria-stop-recording-dest-port — Removes a named rule from the destination port logic block. This stops redirecting traffic to the Packet Recorder.
• aria-stop-recording-dest-subnet — Removes a named rule from the destination subnet logic block. This stops redirecting traffic to the Packet Recorder.
• aria-stop-recording-src-port — Removes a named rule from the source port logic block. This stops redirecting traffic to the Packet Recorder.
• aria-stop-recording-src-subnet — Removes a named rule from the source subnet logic block. This stops redirecting traffic to the Packet Recorder.
• aria-unblock-conversation — Deletes a named rule from the 5-tuple logic block. This allows the previously blocked conversation to resume.
• aria-unblock-dest-port — Removes a named rule from the destination port logic block. This allows the previously blocked traffic to resume.
• aria-unblock-dest-subnet — Removes a named rule from the destination subnet logic block. This allows the previously blocked traffic to resume.
• aria-unblock-src-port — Removes a named rule from the source port logic block. This allows the previously blocked traffic to resume.
• aria-unblock-src-subnet — Removes a named rule from the source subnet logic block. This allows the previously blocked traffic to resume.