Purpose
This guide explains how to configure the Arbor Networks APS (Availability Protection System) Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, manage cloud-signaling requests, query blocked hosts, configure GRE tunnels, and manage country/host/domain/URL blacklists and whitelists (both globally and per protection group) directly from a Logsign Incident. This is a DDoS-mitigation-oriented Response integration, configured under Settings > Integrations > Responses > +Device.
This is a different product from Arbor Edge Defense (AED). Arbor Networks APS and AED are separate NETSCOUT/Arbor products with different APIs; do not assume configuration or methods from one apply to the other.
Prerequisites
- An Arbor Networks APS appliance with its API reachable from the Logsign server.
- A client certificate for API authentication (Arbor APS uses certificate-based auth for its API, not a username/password).
- Use least privilege. If your APS deployment supports scoped API certificates/roles, restrict this integration's certificate to the specific blacklist/whitelist/protection-group management functions it needs.
Step 1: Obtain an API Certificate from Arbor APS
- Log in to the Arbor APS management console with an administrator account.
- Generate or export an API client certificate for Logsign to use, following your Arbor APS version's certificate-based API authentication process (the exact console navigation path was not independently verified during this research).
- Note the APS appliance's hostname.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Arbor Networks APS, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Arbor APS device in Logsign. |
| Hostname | Yes | Hostname of your Arbor APS appliance. |
| Certificate Content | Yes | The API client certificate from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
Some methods may reference field names your account sees differently in the Logsign UI, since a small number of this integration's manifest field labels don't always match their underlying property names exactly. If a field does not appear to accept input as expected, try the alternate naming style (camelCase vs snake_case) before assuming a connection problem, and report it to Logsign support so the manifest can be corrected.
Cloud signaling
- get-active-cloud-signaling: fetches active cloud-signaling entries, with filters for prefixes, request type, mitigation timestamp, and search/sort/paging.
- add-prefixes-to-cloud-signaling: adds prefixes to cloud signaling. Arg: prefixes (required).
Blocked host queries and GRE
- blocked-host-query: queries blocked hosts by time range, with optional filters for source addresses, direction, and attack category. Args required: start time, end time.
- configure-gre-tunnels: configures GRE tunnels. Args: subnet_bit_length, local_ip, gre_remote_ips.
Outbound blacklist/whitelist
- add-countries-to-outbound-blacklist: blacklists a country for outbound traffic. Args: country_code (required), annotation.
- add-hosts-to-outbound-blacklist: blacklists a host for outbound traffic. Arg: host_address (required).
- add-hosts-to-outbound-whitelist: whitelists a host for outbound traffic. Arg: host_address (required).
Protection groups
- create-protection-group: creates a protection group. Args required: name, prefixes, server_type; optional: description, active, protection_level.
- blacklist-a-country / blacklist-a-domain / blacklist-a-host: blacklists an entry within a specific protection group. Args required: the entry value (country_code, domain, or host) plus pgid.
- whitelist-a-host: whitelists a host within a specific protection group. Args required: host, pgid.
Global blacklist/whitelist
- blacklist-a-url: globally blacklists a URL. Arg: url (required).
- add-countries-to-blacklist / add-domains-to-blacklist / add-hosts-to-blacklist / add-urls-to-blacklist: globally blacklists a country/domain/host/URL. Required entry value, plus optional cid, pgid, annotation.
- add-hosts-to-whitelist: globally whitelists a host. Arg: host (required), plus optional cid, pgid, annotation.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong, expired, or revoked Certificate Content. | Re-generate the API client certificate in Arbor APS and update the Certificate Content field. |
| A method's required field does not seem to accept the expected input | Possible naming inconsistency between the field label and its underlying property name. | Try both the camelCase and snake_case variants of the field name if the first attempt is rejected, and report the specific method to Logsign support so the manifest can be corrected. |
| whitelist-a-host fails with a missing-field error | The method requires pgid in addition to host. | Supply the target protection group's ID. |
Notes and Limits
- This is a large, DDoS-mitigation-focused integration with 18 methods spanning cloud signaling, blocked-host queries, GRE tunnel configuration, and blacklist/whitelist management at both global and per-protection-group scope; review Arbor APS's own documentation for how these concepts (protection groups, cloud signaling, CID/PGID scoping) relate to your deployment before using this integration in production automation.
- The exact console navigation path for generating an API client certificate was not independently verified against a live Arbor APS appliance during this research; the field names and method behavior above are taken directly from Logsign's integration code, not from a live call against an Arbor APS appliance. If you observe different behavior in production, report it to Logsign support.