Netscout Arbor DDoS Protection

The NetScout Arbor connector facilitates automated interactions with the Netscout Arbor DDoS Protection platform, enabling users to manage alerts and generate reports directly through Swimlane.

NetScout Arbor DDOS protection is a comprehensive defense solution against distributed denial-of-service (ddos) attacks, providing real-time detection and automated mitigation. This connector enables swimlane turbine users to integrate with netscout arbor's robust security features, allowing for the retrieval of detailed alert information, generation of in-depth reports, and monitoring of potential threats through a list of alerts. By leveraging this connector, users can enhance their security posture with actionable insights and streamlined incident response directly within the swimlane turbine platform, ensuring rapid and effective ddos threat management.

Prerequisites

To effectively utilize the Netscout Arbor DDoS Protection connector with Swimlane Turbine, ensure you have the following:

API Key Authentication:

URL: The endpoint URL for the Netscout Arbor API.

API Key: A valid API key provided by Netscout Arbor for authentication.

Capabilities

This connector provides the following capabilities:

Get Alert

Get Report

List Alerts

Asset Setup

To use the asset, you must create an API key. To create an API Key, follow the following steps.

To create the token, enter service aaa local apitoken generate within the CLI. The system responds with: username “tokenDescription”username = "the name of a valid AED user"tokenDescription = "A brief description of the token" This description is appended to the token.

To save the configuration, enter config write within the CLI.

(Optional) Enter the following command to view the generated token. This command identifies each user and the tokens associated with that user: service aaa local apitoken show.

Notes

To access your API notes, you must follow to this link This connector was developed against product version: 6.1

Configurations

Netscout Arbor API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
X-Arbux-APIToken	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Alert

Retrieves detailed information for a specific alert identified by an alert_id in Netscout Arbor DDoS Protection.

Endpoint

URL: /api/aed/v2/alerts/{{alert_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alert_id	string	Required	Unique alert identifier.

Input Example

{"path_parameters":{"alert_id":"2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Get Report

Generates a detailed report from Netscout Arbor based on the specified name, report type, start time, and end time.

Endpoint

URL: /api/aed/v2/reports

Method: GET

Input

Argument Name	Type	Required	Description
parameters.name	string	Required	Name of report requested.
parameters.reportType	string	Required	Report Type.
parameters.startTime	string	Required	Start time of the report requested.
parameters.endTime	string	Required	End time of the report requested.
parameters.recipients	string	Optional	A sting formatted comma separated list of recipients.
parameters.params	string	Optional	A JSON-formatted object describing the specified elements of the report.

Input Example

{"parameters":{"name":"Executive Summary - Month","reportType":"ExecSummary","startTime":"September 14, 2023, 12:00:00 AM","endTime":"October 14, 2023 12:00:00 AM","recipients":"[email protected], [email protected]","params":"{\"test\": 1}"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

List Alerts

Retrieve a list of all alerts from Netscout Arbor DDoS Protection to monitor and analyze potential threats.

Endpoint

URL: /api/aed/v2/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Optional	The alert type.
parameters.title	string	Optional	Name of the alert.
parameters.description	string	Optional	Description of the alert.
parameters.severity	string	Optional	Severity of the alert.
parameters.startTime	string	Optional	Start time for the alert.
parameters.endTime	string	Optional	End time for the alert.
parameters.status	string	Optional	Status of the alerts (ALL, ACTIVE, INACTIVE).
parameters.pgid	string	Optional	Protection group identifier.
parameters.pgName	string	Optional	Protection group name.
parameters.q	string	Optional	List of (+) delimited search strings.
parameters.select	string	Optional	List of (,) delimited filter strings.
parameters.sort	string	Optional	Key used to sort results.
parameters.direction	string	Optional	The direction results are sorted (ASC or DESC).
parameters.limit	number	Optional	Parameters for the List Alerts action
parameters.page	number	Optional	Parameters for the List Alerts action

Input Example

{"parameters":{"type":"suspicious login","title":"Multiple Sign-on Attempts","description":"At 10.30.20.1 there were (3) failed attempts to authenticate.","severity":"High","startTime":"September 14, 2023, 12:00:00 AM","endTime":"October 14, 2023 12:00:00 AM","status":"ALL","pgid":"21","pgName":"PG_Name","q":"test+name","select":"name","sort":"id","direction":"DESC","limit":1,"page":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT