category: Network Security
provider: Netscout Systems
commonfields:
  id: NetscoutAED
  version: -1
configuration:
- display: Server URL
  name: base_url
  required: true
  type: 0
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- name: User
  displaypassword: API Key
  hiddenusername: true
  type: 9
  required: false
description: Use the Netscout Arbor Edge Defense integration to detect and stop both inbound threats and outbound malicious communication from compromised internal devices.
display: Netscout Arbor Edge Defense
name: NetscoutAED
script:
  commands:
  - arguments:
    - description: An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the "na-ed-country-code-list" command.
      name: country
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the countries on the outbound block list. By default, 10 block listed countries are returned.
    name: na-ed-outbound-blacklisted-countries-list
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistCountry.annotation
      description: A message associated with each country in the outbound block list.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets a country or list of countries (country name and ISO-standardized country code).
    name: na-ed-country-code-list
    outputs:
    - contextPath: NetscoutAED.Country.country_name
      description: The country's name.
      type: String
    - contextPath: NetscoutAED.Country.iso_code
      description: The ISO-standardized country code.
      type: String
  - arguments:
    - description: An ISO standardized country code or a comma-separated list of country codes. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    - description: A message to associate with each country that you add to the outbound block list.
      name: annotation
    description: Adds one or more countries to the outbound block list.
    name: na-ed-outbound-blacklisted-countries-add
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistCountry.annotation
      description: A message associated with each country in the outbound block list.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: An ISO-standardized country code or a comma-separated list of ISO-standardized country codes to remove. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    description: Removes one or more countries from the outbound block list.
    name: na-ed-outbound-blacklisted-countries-remove
  - arguments:
    - description: A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter.
      isArray: true
      name: cid
    - description: A comma-separated list of protection group IDs. Cannot be used with the cid parameter.
      isArray: true
      name: pgid
    - description: An ISO-standardized country code to get a specific country in the results. Can be retrieved by running the "na-ed-country-code-list"command.
      name: country
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the inbound block listed countries. By default, 10 block listed countries are returned. To return block listed countries for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects countries that are globally block listed.
    name: na-ed-inbound-blacklisted-countries-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistCountry.annotation
      description: List of messages associated with each country in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistCountry.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: A message to associate with each country that you add to the inbound block list.
      name: annotation
    - description: ISO standardized country code or a comma-separated list of country codes. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    description: Adds one or more countries to the inbound block list by pgid or cid.
    name: na-ed-inbound-blacklisted-countries-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistCountry.annotation
      description: List of messages associated with each country in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.country
      description: An ISO standardized country code.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistCountry.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistCountry.update_time
      description: The time that the country code was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: ISO standardized country code or a comma-separated list of country codes. Can be retrieved by running the "na-ed-country-code-list" command.
      isArray: true
      name: country
      required: true
    description: Removes one or more countries from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-countries-remove
  - arguments:
    - description: A comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the outbound block listed hosts. By default, 10 block listed hosts are returned.
    name: na-ed-outbound-blacklisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the outbound block list.
    name: na-ed-outbound-blacklisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the outbound block listed list.
    name: na-ed-outbound-blacklisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.OutboundBlacklistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundBlacklistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR to remove, or a comma-separated list of IPv4 host addresses or CIDRs to remove.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRS from the outbound block list.
    name: na-ed-outbound-blacklisted-hosts-remove
  - arguments:
    - description: A comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the outbound hosts on allow list. By default, 10 hosts on allow list are returned.
    name: na-ed-outbound-whitelisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.OutboundWhitelistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to add.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the outbound whitelisted list.
    name: na-ed-outbound-whitelisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.OutboundWhitelistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: A single IPv4 host address or CIDR or a comma-separated list of IPv4 host addresses or CIDRs to update.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the outbound allow listed list.
    name: na-ed-outbound-whitelisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.OutboundWhitelistHost.annotation
      description: A description of the host.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.host_address
      description: IPv4 host address or CIDRs.
      type: String
    - contextPath: NetscoutAED.OutboundWhitelistHost.update_time
      description: The time the host was last updated/set.
      type: Date
  - arguments:
    - description: List of protection group IDs.
      name: pgid
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: 'Set the protection group mode to active (true) or inactive (false).'
      name: active
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: low
      description: 'The protection level (None = use the global protection level, low, medium, high).'
      name: protection_level
      predefined:
      - low
      - medium
      - high
    - auto: PREDEFINED
      description: Turn traffic profiling on (true) or off (false) for one or more of the protection groups.
      name: profiling
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Specify the number of days, from 1 to 14, over which profiling will run. Required when profiling is set to true.
      name: profiling_duration
      predefined:
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      - '8'
      - '9'
      - '10'
      - '11'
      - '12'
      - '13'
      - '14'
    description: Updates the settings for one or more protection groups.
    name: na-ed-protection-groups-update
    outputs:
    - contextPath: NetscoutAED.ProtectionGroup.active
      description: True if the protection group mode is active, false if inactive.
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.bps_dropped
      description: Number of dropped bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bps_passed
      description: Number of passed bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_dropped
      description: Number of dropped bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_passed
      description: Number of passed bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.description
      description: Description of the protection group.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.name
      description: Protection group name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.packets_dropped
      description: Number of dropped packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.packets_passed
      description: Number of passed packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pgid
      description: Protection group identifier.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_passed
      description: Number of passed pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_dropped
      description: Number of dropped pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.prefixes
      description: A comma-separated list of prefixes belonging to the protection group.
      type: Unknown
    - contextPath: NetscoutAED.ProtectionGroup.profiling
      description: A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.profiling_duration
      description: The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.profiling_start
      description: A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicates that profiling was never started.
      type: Date
    - contextPath: NetscoutAED.ProtectionGroup.protection_level
      description: The protection level (None = use the global protection level, low, medium, high).
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_name
      description: The protection group’s server name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_type
      description: The protection group’s server type.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.time_created
      description: The time when the protection group was created.
      type: Date
  - arguments:
    - description: Protection group identifier.
      name: pgid
    - description: Protection group name.
      name: name
    - auto: PREDEFINED
      description: Whether the protection group is active or not.
      name: active
      predefined:
      - 'true'
      - 'false'
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    description: Gets a list of the protection groups.
    name: na-ed-protection-groups-list
    outputs:
    - contextPath: NetscoutAED.ProtectionGroup.active
      description: True if the protection group mode is active, false if inactive.
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.bps_dropped
      description: Number of dropped bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bps_passed
      description: Number of passed bps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_dropped
      description: Number of dropped bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.bytes_passed
      description: Number of passed bytes.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.description
      description: Description of the protection group.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.name
      description: Protection group name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.packets_dropped
      description: Number of dropped packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.packets_passed
      description: Number of passed packets.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pgid
      description: Protection group identifier.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_passed
      description: Number of passed pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.pps_dropped
      description: Number of dropped pps.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.prefixes
      description: A comma-separated list of prefixes belonging to the protection group.
      type: Unknown
    - contextPath: NetscoutAED.ProtectionGroup.profiling
      description: A traffic profile capture for a protection group’s rate-based protection settings is running (true) or not (false).
      type: Boolean
    - contextPath: NetscoutAED.ProtectionGroup.profiling_duration
      description: The duration, in days, of an active traffic profile capture. A 0 indicates that profiling is not active.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.profiling_start
      description: A UNIX epoch timestamp that indicates when a traffic profile capture began. A 0 indicates that profiling was never started.
      type: Date
    - contextPath: NetscoutAED.ProtectionGroup.protection_level
      description: The protection level (None = use the global protection level, low, medium, high).
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_name
      description: The protection group’s server name.
      type: String
    - contextPath: NetscoutAED.ProtectionGroup.server_type
      description: The protection group’s server type.
      type: Number
    - contextPath: NetscoutAED.ProtectionGroup.time_created
      description: The time when the protection group was created.
      type: Date
    - contextPath: NetscoutAED.ProtectionGroup.cid
      description: Central configuration ID.
      type: Number
  - arguments:
    - description: A comma-separated list of IPv4 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the inbound block listed hosts. By default, 10 block listed hosts are returned. To return block listed hosts for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally block listed.
    name: na-ed-inbound-blacklisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistHost.annotation
      description: List of messages associated with each host in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the inbound block listed list.
    name: na-ed-inbound-blacklisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistHost.annotation
      description: List of messages associated with each host in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHostupdate_time
      description: The time that the host address was added to the list.
      type: Date
    compliantpolicies:
    - IP Blockage
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the inbound block list.
    name: na-ed-inbound-blacklisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistHost.annotation
      description: List of messages associated with each host in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRs from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-hosts-remove
  - arguments:
    - description: A comma-separated list of IPv4 or IPv6 host addresses or CIDRs.
      isArray: true
      name: host_address
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Get the hosts on allow list. By default, 10 hosts on allow list are returned. To return hosts on allow list for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects hosts that are globally on allow list.
    name: na-ed-inbound-whitelisted-hosts-list
    outputs:
    - contextPath: NetscoutAED.InboundWhitelistHost.annotation
      description: List of messages associated with each host in the inbound allow listed list.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundWhitelistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to add.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Adds one or more hosts to the inbound allow listed list.
    name: na-ed-inbound-whitelisted-hosts-add
    outputs:
    - contextPath: NetscoutAED.InboundWhitelistHost.annotation
      description: List of messages associated with each host in the inbound allow listed list.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundWhitelistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR or a comma-separated list of host addresses or CIDRs to update.
      isArray: true
      name: host_address
      required: true
    - description: A single description that applies to all of the specified hosts or a comma-separated list of descriptions, each of which applies to a specific host.
      isArray: true
      name: annotation
    description: Replaces all the hosts on the inbound allow list.
    name: na-ed-inbound-whitelisted-hosts-replace
    outputs:
    - contextPath: NetscoutAED.InboundWhitelistHost.annotation
      description: List of messages associated with each host in the inbound allow listed list.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.host_address
      description: IPv4 host addresses or CIDRs.
      type: String
    - contextPath: NetscoutAED.InboundWhitelistHost.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundWhitelistHost.update_time
      description: The time that the host address was added to the list.
      type: Date
  - arguments:
    - description: A single IPv4 or IPv6 host address or CIDR, or a comma-separated list of host addresses or CIDRs to remove.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRs from the allow list for a specific protection group or for all protection groups.
    name: na-ed-inbound-whitelisted-hosts-remove
  - arguments:
    - description: A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter.
      isArray: true
      name: cid
    - description: A comma-separated list of protection group IDs. Cannot be used with the cid parameter.
      isArray: true
      name: pgid
    - description: A comma-separated list of domains.
      isArray: true
      name: domain
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the block listed domains. By default, 10 block listed domains are returned. To return block listed domains for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects domains that are globally block listed.
    name: na-ed-inbound-blacklisted-domains-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistDomain.annotation
      description: List of messages associated with each domain in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.domain
      description: Domain name.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistDomain.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: Domain name or a comma-separated list of domain names.
      isArray: true
      name: domain
      required: true
    - description: A message to associate with each domain that you add to the block list.
      name: annotation
    description: Adds one or more domains to the block list by pgid or cid.
    name: na-ed-inbound-blacklisted-domains-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistDomain.annotation
      description: List of messages associated with each domain in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.domain
      description: Domain name.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistDomain.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistDomain.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: Domain name or a comma-separated list of domain names.
      isArray: true
      name: domain
      required: true
    description: Removes one or more domains from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-domains-remove
  - arguments:
    - description: A comma-separated list of central configuration IDs. Cannot be used with the pgid parameter.
      isArray: true
      name: cid
    - description: A comma-separated list of protection group IDs. Cannot be used with the cid parameter.
      isArray: true
      name: pgid
    - description: A comma-separated list of URLs.
      isArray: true
      name: url
    - description: 'Search strings, separated by “+” to filter the results. (example: "AZ+BS").'
      name: query
    - description: The page of the results to return.
      name: page
    - description: Maximal number of results to retrieve. Also sets the size of the returned page.
      name: limit
    description: Gets the block listed URLs. By default, 10 block listed URLs are returned. To return block listed URLs for specific protection groups, specify a list of protection group IDs or central configuration IDs. An ID of -1 selects URLs that are globally block listed.
    name: na-ed-inbound-blacklisted-urls-list
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistUrl.annotation
      description: List of messages associated with each url in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.url
      description: URL address.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistUrl.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: A specific central configuration ID or -1 for global. Cannot be used with the pgid parameter.
      name: cid
    - description: A specific protection group ID or -1 for global. Cannot be used with the cid parameter.
      name: pgid
    - description: URL or a comma-separated list of URLs to add.
      isArray: true
      name: url
      required: true
    - description: A message to associate with each URL that you add to the block list.
      name: annotation
    description: Adds one or more URLs to the block list by pgid or cid.
    name: na-ed-inbound-blacklisted-urls-add
    outputs:
    - contextPath: NetscoutAED.InboundBlacklistUrl.annotation
      description: List of messages associated with each url in the inbound block list.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.cid
      description: List of central configuration IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.url
      description: URL address.
      type: String
    - contextPath: NetscoutAED.InboundBlacklistUrl.pgid
      description: List of protection group IDs.
      type: Unknown
    - contextPath: NetscoutAED.InboundBlacklistUrl.update_time
      description: The time that the domain was added to the list.
      type: Date
  - arguments:
    - description: URL or a comma-separated list of URLs.
      isArray: true
      name: url
      required: true
    description: Removes one or more URLs from the block list for a specific protection group or for all protection groups.
    name: na-ed-inbound-blacklisted-urls-remove
  - arguments:
    - description: A single IPv4 host address or CIDR, or a comma-separated list of IPv4 host addresses or CIDRs to remove.
      isArray: true
      name: host_address
      required: true
    description: Removes one or more hosts or CIDRs from the outbound allow list.
    name: na-ed-outbound-whitelisted-hosts-remove
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- NetscoutAED-Test
defaultclassifier: 'null'
fromversion: 5.5.0