Netscout AED v1.0.0

About the connector

Netscout Arbor Edge Defense (AED) secures the internet data center edge from threats against availability — specifically from application-layer, distributed denial of service (DDoS) attacks.

This document provides information about the Netscout AED Connector, which facilitates automated interactions, with a Netscout AED server using FortiSOAR™ playbooks. Add the Netscout AED Connector as a step in FortiSOAR™ playbooks and perform automated operations with Netscout AED.

Version information

Connector Version: 1.0.0

FortiSOAR™ Version Tested on: 7.4.1-3167

Netscout AED Version Tested on: 7.0.1.0 (build NFUL) (arch x86_64)

Authored By: Fortinet

Certified: Yes

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-arbor-aed

Prerequisites to configuring the connector

• You must have the credentials of Netscout AED server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Netscout AED server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Netscout AED connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Get Countries

Input parameters

Output

The output contains the following populated JSON schema:

{
    "countries": [
        {
            "country": "",
            "name": ""
        }
    ]
}

operation: Create Inbound Protection Groups

Input parameters

Output

The output contains the following populated JSON schema:

{
    "active": "",
    "bpsDropped": "",
    "bpsPassed": "",
    "bytesDropped": "",
    "bytesPassed": "",
    "description": "",
    "name": "",
    "packetsDropped": "",
    "packetsPassed": "",
    "pgid": "",
    "ppsDropped": "",
    "ppsPassed": "",
    "prefixes": [],
    "protectionLevel": "",
    "serverName": "",
    "serverType": "",
    "timeCreated": ""
}

operation: Get Inbound Protection Groups

Input parameters

Output

The output contains the following populated JSON schema:

{
    "protection-groups": [
        {
            "active": "",
            "bpsDropped": "",
            "bpsPassed": "",
            "bytesDropped": "",
            "bytesPassed": "",
            "cid": "",
            "description": "",
            "name": "",
            "packetsDropped": "",
            "packetsPassed": "",
            "pgid": "",
            "ppsDropped": "",
            "ppsPassed": "",
            "prefixes": [],
            "profiling": "",
            "profilingDuration": "",
            "profilingStart": "",
            "protectionLevel": "",
            "serverName": "",
            "serverType": "",
            "timeCreated": ""
        }
    ]
}

operation: Update Inbound Protection Groups

Input parameters

Output

The output contains the following populated JSON schema:

{
    "protection-groups": [
        {
            "active": "",
            "bpsDropped": "",
            "bpsPassed": "",
            "bytesDropped": "",
            "bytesPassed": "",
            "description": "",
            "name": "",
            "packetsDropped": "",
            "packetsPassed": "",
            "pgid": "",
            "ppsDropped": "",
            "ppsPassed": "",
            "prefixes": [],
            "protectionLevel": "",
            "serverName": "",
            "serverType": "",
            "timeCreated": ""
        }
    ]
}

operation: Add Inbound Blacklist Countries

Input parameters

Output

The output contains the following populated JSON schema:

{
    "countries": [
        {
            "cid": [],
            "country": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Get Inbound Blacklisted Countries

Input parameters

Output

The output contains the following populated JSON schema:

{
    "blacklisted-countries": [
        {
            "cid": [],
            "country": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Remove Inbound Blacklisted Countries

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Inbound Blacklist Domains

Input parameters

Output

The output contains the following populated JSON schema:

{
    "domains": [
        {
            "cid": [],
            "domain": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Get Inbound Blacklisted Domains

Input parameters

Output

The output contains the following populated JSON schema:

{
    "blacklisted-domains": [
        {
            "cid": [],
            "domain": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Remove Inbound Blacklisted Domains

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Inbound Blacklist Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hosts": [
        {
            "cid": [],
            "hostAddress": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Get Inbound Blacklisted Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "blacklisted-hosts": [
        {
            "cid": [],
            "hostAddress": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Remove Inbound Blacklisted Hosts

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Inbound Whitelisted Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hosts": [
        {
            "cid": [],
            "hostAddress": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Get Inbound Whitelisted Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "whitelisted-hosts": [
        {
            "cid": [],
            "hostAddress": "",
            "pgid": [],
            "updateTime": ""
        }
    ]
}

operation: Remove Inbound Whitelisted Hosts

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Inbound Blacklist URLs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "urls": [
        {
            "cid": [],
            "pgid": [],
            "updateTime": "",
            "url": ""
        }
    ]
}

operation: Get Inbound Blacklisted URLs

Input parameters

Output

The output contains the following populated JSON schema:

{
    "blacklisted-urls": [
        {
            "cid": [],
            "pgid": [],
            "updateTime": "",
            "url": ""
        }
    ]
}

operation: Remove Inbound Blacklisted URLs

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Outbound Blacklist Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hosts": [
        {
            "hostAddress": "",
            "updateTime": ""
        }
    ]
}

operation: Get Outbound Blacklisted Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "blacklisted-hosts": [
        {
            "hostAddress": "",
            "updateTime": ""
        }
    ]
}

operation: Remove Outbound Blacklisted Hosts

Input parameters

Output

The output contains a non-dictionary value.

operation: Add Outbound Whitelist Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "hosts": [
        {
            "hostAddress": "",
            "updateTime": ""
        }
    ]
}

operation: Get Outbound Whitelisted Hosts

Input parameters

Output

The output contains the following populated JSON schema:

{
    "whitelisted-hosts": [
        {
            "hostAddress": "",
            "updateTime": ""
        }
    ]
}

operation: Remove Outbound Whitelisted Hosts

Input parameters

Output

The output contains a non-dictionary value.

Included playbooks

The Sample - Netscout AED - 1.0.0 playbook collection comes bundled with the Netscout AED connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Netscout AED connector.

• Add Inbound Blacklist Countries
• Add Inbound Blacklist Domains
• Add Inbound Blacklist Hosts
• Add Inbound Blacklist URLs
• Add Inbound Whitelisted Hosts
• Add Outbound Blacklist Hosts
• Add Outbound Whitelist Hosts
• Create Inbound Protection Groups
• Get Countries
• Get Inbound Blacklisted Countries
• Get Inbound Blacklisted Domains
• Get Inbound Blacklisted Hosts
• Get Inbound Blacklisted URLs
• Get Inbound Protection Groups
• Get Inbound Whitelisted Hosts
• Get Outbound Blacklisted Hosts
• Get Outbound Whitelisted Hosts
• Remove Inbound Blacklisted Countries
• Remove Inbound Blacklisted Domains
• Remove Inbound Blacklisted Hosts
• Remove Inbound Blacklisted URLs
• Remove Inbound Whitelisted Hosts
• Remove Outbound Blacklisted Hosts
• Remove Outbound Whitelisted Hosts
• Update Inbound Protection Groups

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.