The ARIA Cybesecurity Solutions Software-Defined Security (SDS) platform integrates with Demisto to add robustness when responding to incidents. The combination of ARIA hardware, in the form of a Secure Intelligent Adapter (SIA), and software, specifically Packet Intelligence and SDS orchestrator (SDSo), provides the elements required to react instantly when an incident is detected. When integrated with the ARIA solution, you can create playbooks that instruct one or more SIAs to add, modify, or delete rules automatically. These rule changes, which take effect immediately, can block conversations, redirect packets to a recorder or VLAN, or perform a variety of other actions.

This integration was integrated and tested with version xx of ARIA Packet Intelligence

playbook-Aria-Packet-Intelligence-Test

1.Block Conversation 2. Alert and Record Conversation

Populate this section with the .md file contents for detailed description.

1. Navigate to Settings > Integrations  > Servers & Services.
2. Search for ARIA Packet Intelligence.
3. Click Add instance to create and configure a new integration instance.
   • Name: a textual name for the integration instance.
   • SDSo Base URL (e.g. http://<IP address or FQDN of SDSo Node>:7443);
4. Click Test to validate the new instance.

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

1. aria-block-conversation: aria-block-conversation
2. aria-unblock-conversation: aria-unblock-conversation
3. aria-record-conversation: aria-record-conversation
4. aria-stop-recording-conversation: aria-stop-recording-conversation
5. aria-alert-conversation: aria-alert-conversation
6. aria-mute-alert-conversation: aria-mute-alert-conversation
7. aria-block-dest-port: aria-block-dest-port
8. aria-unblock-dest-port: aria-unblock-dest-port
9. aria-record-dest-port: aria-record-dest-port
10. aria-stop-recording-dest-port: aria-stop-recording-dest-port
11. aria-alert-dest-port: aria-alert-dest-port
12. aria-mute-alert-dest-port: aria-mute-alert-dest-port
13. aria-block-src-port: aria-block-src-port
14. aria-unblock-src-port: aria-unblock-src-port
15. aria-record-src-port: aria-record-src-port
16. aria-stop-recording-src-port: aria-stop-recording-src-port
17. aria-alert-src-port: aria-alert-src-port
18. aria-mute-alert-src-port: aria-mute-alert-src-port
19. aria-block-dest-subnet: aria-block-dest-subnet
20. aria-unblock-dest-subnet: aria-unblock-dest-subnet
21. aria-record-dest-subnet: aria-record-dest-subnet
22. aria-stop-recording-dest-subnet: aria-stop-recording-dest-subnet
23. aria-alert-dest-subnet: aria-alert-dest-subnet
24. aria-mute-alert-dest-subnet: aria-mute-alert-dest-subnet
25. aria-block-src-subnet: aria-block-src-subnet
26. aria-unblock-src-subnet: aria-unblock-src-subnet
27. aria-record-src-subnet: aria-record-src-subnet
28. aria-stop-recording-src-subnet: aria-stop-recording-src-subnet
29. aria-alert-src-subnet: aria-alert-src-subnet
30. aria-mute-alert-src-subnet: aria-mute-alert-src-subnet

Creates a rule that drops all packets matching the specified 5-tuple values.

aria-block-conversation

!aria-block-conversation src_ip="192.168.10.23" src_port="389" target_ip="192.168.0.1" target_port="390" protocol="tcp" rule_name="convBlock" label_sia_name="sia17"

{
    "Aria.BlockConversation": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "aa5395d0-be3b-b76d-b2c3-58f4fccb115b"
            }
        ],
        "Rule": {
            "Definition": "192.168.0.1/32 @ 390 & 192.168.10.23/32 @ 389 <> TCP : DROP, END",
            "Name": "convBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420423
        }
    }
}

Deletes a named rule from the 5-tuple logic block. This allows the previously blocked conversation to resume.

aria-unblock-conversation

!aria-unblock-conversation rule_name="convBlock" label_sia_name="sia17"

{
    "Aria.UnblockConversation": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "92bf73e5-c899-f2fa-76bb-a959cf053b61"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "convBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420426
        }
    }
}

Creates a rule that redirects a conversation matching 5-tuple values to the Packet Recorder. Packets are tagged with the VID specified in the instance.

aria-record-conversation

!aria-record-conversation src_ip="192.168.10.23" src_port="389" target_ip="192.168.0.1" target_port="390" protocol="tcp" rule_name="convRecord" vlan_id="1234" transport_type="email" tti_index="2" aio_index="4" trigger_type="one-shot" trigger_value="1" label_sia_name="sia17"

{
    "Aria.RecordConversation": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "7fc5d306-9d8e-65b5-8465-2e1fb8fb347e"
            }
        ],
        "Rule": {
            "Definition": "192.168.0.1/32 @ 390 & 192.168.10.23/32 @ 389 <> TCP : REDIRECT-VLAN A 1234, ALERT email 2 4 one-shot 1, END",
            "Name": "convRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420435
        }
    }
}

Removes the named rule from the 5-tuple block. This stops redirecting traffic to the Packet Recorder.

aria-stop-recording-conversation

!aria-stop-recording-conversation rule_name="convRecord" label_sia_name="sia17"

{
    "Aria.StopRecordingConversation": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "806b7df1-142a-7b1d-73ba-e3409b3ae1b7"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "convRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420445
        }
    }
}

Adds a rule that generates an alert when a conversation matching the specified 5-tuple values is detected.

aria-alert-conversation

!aria-alert-conversation src_ip="192.168.10.23" src_port="389" target_ip="192.168.0.1" target_port="390" protocol="tcp" rule_name="convAlert" transport_type="email" tti_index="2" aio_index="4" trigger_type="re-trigger-count" trigger_value="1000" label_sia_group="Engineering"

{
    "Aria.AlertConversation": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "4bb24d36-09d1-200c-dbe0-a22704846484"
            }
        ],
        "Rule": {
            "Definition": "192.168.0.1/32 @ 390 & 192.168.10.23/32 @ 389 <> TCP : ALERT email 2 4 re-trigger-count 1000, END",
            "Name": "convAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420453
        }
    }
}

Removes a named rule from the 5-tuple logic block, disabling the alerts.

aria-mute-alert-conversation

!aria-mute-alert-conversation rule_name="convAlert" label_sia_group="Engineering"

{
    "Aria.MuteAlertConversation": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "a00c637c-4811-45e0-ae55-fab9cab8c10a"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "convAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420460
        }
    }
}

Creates a rule that blocks packets destined for one or more specific ports.

aria-block-dest-port

!aria-block-dest-port port_range="389, 400-404" rule_name="destPortBlock" label_sia_region="US"

{
    "Aria.BlockDestPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "b7bfd2a3-51d1-e9ba-b5bf-d8b4d5f21b8f"
            }
        ],
        "Rule": {
            "Definition": "389, 400 - 404: DROP, END",
            "Name": "destPortBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420469
        }
    }
}

Removes a named rule from the destination port logic block. This allows the previously blocked traffic to resume.

aria-unblock-dest-port

!aria-unblock-dest-port rule_name="destPortBlock" label_sia_region="US"

{
    "Aria.UnblockDestPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "8c1e5ab0-1e77-1b27-68d7-cab420fdf8c3"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "destPortBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420477
        }
    }
}

Adds a rule that redirects traffic destined for one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.

aria-record-dest-port

!aria-record-dest-port port_range="390, 420, 421" rule_name="destPortRecord" vlan_id="1234" transport_type="email" tti_index="2" aio_index="4" trigger_type="one-shot" trigger_value="1" label_sia_name="sia17"

{
    "Aria.RecordDestPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "4361c6ed-042c-502f-a329-06d4e2c4b4a1"
            }
        ],
        "Rule": {
            "Definition": "390, 420, 421: REDIRECT-VLAN A 1234, ALERT email 2 4 one-shot 1, END",
            "Name": "destPortRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420486
        }
    }
}

Removes a named rule from the destination port logic block. This stops redirecting traffic to the Packet Recorder.

aria-stop-recording-dest-port

!aria-stop-recording-dest-port rule_name="destPortRecord" label_sia_name="sia17"

{
    "Aria.StopRecordingDestPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "9cb30bff-fb0f-eb7b-2790-6942e7585548"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "destPortRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420494
        }
    }
}

Creates a rule that generates an alert when traffic destined for one or more ports is detected.

aria-alert-dest-port

!aria-alert-dest-port port_range="389-400" rule_name="destPortAlert" transport_type="syslog" tti_index="2" aio_index="4" trigger_type="re-trigger-timed-sec" trigger_value="200" label_sia_name="sia17"

{
    "Aria.AlertDestPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "f1858475-74b5-cdd9-e427-763ddb897211"
            }
        ],
        "Rule": {
            "Definition": "389 - 400: ALERT syslog 2 4 re-trigger-timed-sec 200, END",
            "Name": "destPortAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420503
        }
    }
}

Removes a named rule from the destination port logic block, disabling the alerts.

aria-mute-alert-dest-port

!aria-mute-alert-dest-port rule_name="destPortAlert" label_sia_name="sia17"

{
    "Aria.MuteAlertDestPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "f034b7f4-258a-49ab-0226-7bc651c34e10"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "destPortAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420511
        }
    }
}

Adds a rule that blocks packets originating from one or more specific ports.

aria-block-src-port

!aria-block-src-port port_range="389, 400-404" rule_name="srcPortBlock" label_sia_region="US"

{
    "Aria.BlockSrcPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "93ad5260-f138-ed0c-6ac0-e1a6f721747e"
            }
        ],
        "Rule": {
            "Definition": "389, 400 - 404: DROP, END",
            "Name": "srcPortBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420518
        }
    }
}

Removes a named rule from the source port logic block. This allows the previously blocked traffic to resume.

aria-unblock-src-port

!aria-unblock-src-port rule_name="srcPortBlock" label_sia_region="US"

{
    "Aria.UnblockSrcPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "344f83ed-ff1f-1e54-3d82-e59530b02ae6"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "srcPortBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420526
        }
    }
}

Adds a rule that redirects traffic originating from one or more ports to the Packet Recorder. Packets are tagged with the VID specified in the instance.

aria-record-src-port

!aria-record-src-port port_range="390, 420" rule_name="srcPortRecord" sia_interface="B" vlan_id="1234" transport_type="email" tti_index="2" aio_index="4" trigger_type="one-shot" trigger_value="1" label_sia_name="sia17"

{
    "Aria.RecordSrcPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "b133454a-d7b9-50dd-fb9b-3cc769c49396"
            }
        ],
        "Rule": {
            "Definition": "390, 420: REDIRECT-VLAN B 1234, ALERT email 2 4 one-shot 1, END",
            "Name": "srcPortRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420533
        }
    }
}

Removes a named rule from the source port logic block. This stops redirecting traffic to the Packet Recorder.

aria-stop-recording-src-port

!aria-stop-recording-src-port rule_name="srcPortRecord" label_sia_name="sia17"

{
    "Aria.StopRecordingSrcPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "42ef11aa-5655-0b42-15e1-e94bdd966058"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "srcPortRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420541
        }
    }
}

Creates a rule that generates an alert when traffic originating from one or more ports is detected.

aria-alert-src-port

!aria-alert-src-port port_range="389-400" rule_name="srcPortAlert" transport_type="syslog" tti_index="2" aio_index="4" trigger_type="re-trigger-timed-sec" trigger_value="200" label_sia_name="sia17"

{
    "Aria.AlertSrcPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "c07dc77e-d661-9a09-2266-ad5d341e8e63"
            }
        ],
        "Rule": {
            "Definition": "389 - 400: ALERT syslog 2 4 re-trigger-timed-sec 200, END",
            "Name": "srcPortAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420549
        }
    }
}

Removes a named rule from the source port logic block, disabling the alerts.

aria-mute-alert-src-port

!aria-mute-alert-src-port rule_name="srcPortAlert" label_sia_name="sia17"

{
    "Aria.MuteAlertSrcPort": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "9a31502b-40db-98e9-ea12-b0b512045b4d"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "srcPortAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420558
        }
    }
}

Adds a rule that blocks packets destined for a specific IP address or range of IP addresses.

aria-block-dest-subnet

!aria-block-dest-subnet target_ip="192.168.1.2/24" rule_name="destSubnetBlock" label_sia_region="US"

{
    "Aria.BlockDestSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "4609e8c0-55a4-ec06-3548-71cc5b5a67be"
            }
        ],
        "Rule": {
            "Definition": "192.168.1.2/24: DROP, END",
            "Name": "destSubnetBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420567
        }
    }
}

Removes a named rule from the destination subnet logic block. This allows the previously blocked traffic to resume.

aria-unblock-dest-subnet

!aria-unblock-dest-subnet rule_name="destSubnetBlock" label_sia_region="US"

{
    "Aria.UnblockDestSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "deba7913-d38b-08bd-263c-7e00dd5765a7"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "destSubnetBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420574
        }
    }
}

Creates a rule that redirects traffic destined for a specific IP address or range of IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.

aria-record-dest-subnet

!aria-record-dest-subnet target_ip="192.168.10.23/32" rule_name="destSubnetRecord" vlan_id="1234" transport_type="email" tti_index="2" aio_index="4" trigger_type="one-shot" trigger_value="1" label_sia_name="sia17"

{
    "Aria.RecordDestSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "d832ae22-cb14-18e4-2e3f-8c08333feb0f"
            }
        ],
        "Rule": {
            "Definition": "192.168.10.23/32: REDIRECT-VLAN A 1234, ALERT email 2 4 one-shot 1, END",
            "Name": "destSubnetRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420583
        }
    }
}

Removes a named rule from the destination subnet logic block. This stops redirecting traffic to the Packet Recorder.

aria-stop-recording-dest-subnet

!aria-stop-recording-dest-subnet rule_name="destSubnetRecord" label_sia_name="sia17"

{
    "Aria.StopRecordingDestSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "1e6d1679-8652-13f8-f3e7-41a0e10c1335"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "destSubnetRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420591
        }
    }
}

Creates a rule that generates an alert when traffic destined for a specific IP address or range of IP addresses is detected.

aria-alert-dest-subnet

!aria-alert-dest-subnet target_ip="192.168.1.2/24" rule_name="destSubnetAlert" transport_type="syslog" tti_index="2" aio_index="4" trigger_type="re-trigger-timed-sec" trigger_value="200" label_sia_name="sia17"

{
    "Aria.AlertDestSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "d53a30dd-f6b8-b2c1-9f5c-4cd2e455bcc9"
            }
        ],
        "Rule": {
            "Definition": "192.168.1.2/24: ALERT syslog 2 4 re-trigger-timed-sec 200, END",
            "Name": "destSubnetAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420599
        }
    }
}

Removes a named rule from the destination subnet logic block, disabling the alerts.

aria-mute-alert-dest-subnet

!aria-mute-alert-dest-subnet rule_name="destSubnetAlert" label_sia_name="sia17"

{
    "Aria.MuteAlertDestSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "8b23a582-25b6-a2d9-7d76-39b3e1ce1584"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "destSubnetAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420608
        }
    }
}

Adds a rule that blocks packets originating from a specific IP address or range of IP addresses.

aria-block-src-subnet

!aria-block-src-subnet src_ip="192.168.1.2/24" rule_name="srcSubnetBlock" label_sia_region="US"

{
    "Aria.BlockSrcSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "a8916b20-5d9a-0337-23ce-1c399922df05"
            }
        ],
        "Rule": {
            "Definition": "192.168.1.2/24: DROP, END",
            "Name": "srcSubnetBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420616
        }
    }
}

Removes a named rule from the source subnet logic block. This allows the previously blocked traffic to resume.

aria-unblock-src-subnet

!aria-unblock-src-subnet rule_name="srcSubnetBlock" label_sia_region="US"

{
    "Aria.UnblockSrcSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "c7405878-aa74-9301-7422-b91ae84be8eb"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "srcSubnetBlock"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420624
        }
    }
}

Creates a rule that redirects traffic originating from one or more specific IP addresses to the Packet Recorder. Packets are tagged with the VID specified in the instance.

aria-record-src-subnet

!aria-record-src-subnet src_ip="192.168.1.2/24" rule_name="srcSubnetRecord" vlan_id="1234" transport_type="email" tti_index="2" aio_index="4" trigger_type="one-shot" trigger_value="1" label_sia_name="sia17"

{
    "Aria.RecordSrcSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "7bc02e02-c6d5-2b80-5423-1a6fc245c3f9"
            }
        ],
        "Rule": {
            "Definition": "192.168.1.2/24: REDIRECT-VLAN A 1234, ALERT email 2 4 one-shot 1, END",
            "Name": "srcSubnetRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420632
        }
    }
}

Removes a named rule from the source subnet logic block. This stops redirecting traffic to the Packet Recorder.

aria-stop-recording-src-subnet

!aria-stop-recording-src-subnet rule_name="srcSubnetRecord" label_sia_name="sia17"

{
    "Aria.StopRecordingSrcSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "52dc6968-2269-ae46-7dfc-accbda8973e5"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "srcSubnetRecord"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420640
        }
    }
}

Adds a rule that generates an alert when traffic originating from a specific IP address or range of IP addresses is detected.

aria-alert-src-subnet

!aria-alert-src-subnet src_ip="192.168.1.2/24" rule_name="srcSubnetAlert" transport_type="syslog" tti_index="2" aio_index="4" trigger_type="re-trigger-timed-sec" trigger_value="200" label_sia_name="sia17"

{
    "Aria.AlertSrcSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "8a0d8a84-3248-aadb-db11-dbe96562d1ef"
            }
        ],
        "Rule": {
            "Definition": "192.168.1.2/24: ALERT syslog 2 4 re-trigger-timed-sec 200, END",
            "Name": "srcSubnetAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420648
        }
    }
}

Removes a named rule from the source subnet logic block, disabling the alerts.

aria-mute-alert-src-subnet

!aria-mute-alert-src-subnet rule_name="srcSubnetAlert" label_sia_name="sia17"

{
    "Aria.MuteAlertSrcSubnet": {
        "Endpoints": [
            {
                "FQN": "...",
                "IPAddress": "10.1.1.0",
                "Model": "sia-lx2160",
                "OS": "GNU/Linux",
                "Processor": "sia-lx2160",
                "Processors": 1,
                "completion": true,
                "trid": "07e9f255-efb0-d60e-8118-ba947c4be47f"
            }
        ],
        "Rule": {
            "Definition": "",
            "Name": "srcSubnetAlert"
        },
        "Status": {
            "code": 201,
            "command_state": "Success",
            "timestamp": 1571420656
        }
    }
}

For more information, please see the ARIA_SOAR_Integration_Guide_Demisto.