NetscoutAED

Use the Netscout Arbor Edge Defense integration to detect and stop both inbound threats and outbound malicious communication from compromised internal devices.

Category

Network Security

Pack

NetscoutAED

Configuration parameters

• base_url — Server URL (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• User —

Commands (31)

• na-ed-country-code-list — Gets a country or list of countries (country name and ISO-standardized country code).
• na-ed-inbound-blacklisted-countries-add — Adds one or more countries to the inbound block list by pgid or cid.
• na-ed-inbound-blacklisted-countries-list — Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.
• na-ed-inbound-blacklisted-countries-remove — Removes one or more countries from the block list for a specific protection group or for all protection groups.
• na-ed-inbound-blacklisted-domains-add — Adds one or more domains to the block list by pgid or cid.
• na-ed-inbound-blacklisted-domains-list — Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.
• na-ed-inbound-blacklisted-domains-remove — Removes one or more domains from the block list for a specific protection group or for all protection groups.
• na-ed-inbound-blacklisted-hosts-add — Adds one or more hosts to the inbound block listed list.
• na-ed-inbound-blacklisted-hosts-list — Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.
• na-ed-inbound-blacklisted-hosts-remove — Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.
• na-ed-inbound-blacklisted-hosts-replace — Replaces all the hosts on the inbound block list.
• na-ed-inbound-blacklisted-urls-add — Adds one or more URLs to the block list by pgid or cid.
• na-ed-inbound-blacklisted-urls-list — Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.
• na-ed-inbound-blacklisted-urls-remove — Removes one or more URLs from the block list for a specific protection group or for all protection groups.
• na-ed-inbound-whitelisted-hosts-add — Adds one or more hosts to the inbound allow listed list.
• na-ed-inbound-whitelisted-hosts-list — Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.
• na-ed-inbound-whitelisted-hosts-remove — Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.
• na-ed-inbound-whitelisted-hosts-replace — Replaces all the hosts on the inbound allow list.
• na-ed-outbound-blacklisted-countries-add — Adds one or more countries to the outbound block list.
• na-ed-outbound-blacklisted-countries-list — Gets the countries on the outbound block list. By default, 10 block listed countries are returned.
• na-ed-outbound-blacklisted-countries-remove — Removes one or more countries from the outbound block list.
• na-ed-outbound-blacklisted-hosts-add — Adds one or more hosts to the outbound block list.
• na-ed-outbound-blacklisted-hosts-list — Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.
• na-ed-outbound-blacklisted-hosts-remove — Removes one or more hosts or CIDRS from the outbound block list.
• na-ed-outbound-blacklisted-hosts-replace — Replaces all the hosts on the outbound block listed list.
• na-ed-outbound-whitelisted-hosts-add — Adds one or more hosts to the outbound whitelisted list.
• na-ed-outbound-whitelisted-hosts-list — Gets the outbound hosts on allow list. By default, 10 hosts on allow list are returned.
• na-ed-outbound-whitelisted-hosts-remove — Removes one or more hosts or CIDRs from the outbound allow list.
• na-ed-outbound-whitelisted-hosts-replace — Replaces all the hosts on the outbound allow listed list.
• na-ed-protection-groups-list — Gets a list of the protection groups.
• na-ed-protection-groups-update — Updates the settings for one or more protection groups.