Purpose
This guide explains how to configure the Arbor Edge Defense (AED) Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, manage country/host/domain/URL blacklists and whitelists (both globally and per protection group), manage protection groups, and read TAXII threat-intelligence configuration directly from a Logsign Incident. This is a DDoS/perimeter-defense-oriented Response integration, configured under Settings > Integrations > Responses > +Device.
This is a different product from Arbor Networks APS (Availability Protection System). AED and APS are separate NETSCOUT/Arbor products with different APIs and different authentication schemes (AED uses a static API token, APS uses a client certificate); do not assume configuration or methods from one apply to the other.
Prerequisites
- An Arbor Edge Defense appliance with its API reachable from the Logsign server.
- An API token for API authentication (AED uses a static bearer token, not a username/password or certificate).
- Use least privilege. If your AED deployment supports scoped API tokens/roles, restrict this integration's token to the specific blacklist/whitelist/protection-group management functions it needs.
Step 1: Obtain an API Token from Arbor Edge Defense
- Log in to the Arbor Edge Defense management console with an administrator account.
- Generate an API token for Logsign to use, following your AED version's API authentication process (the exact console navigation path was not independently verified during this research).
- Note the AED appliance's server URL (base address of its REST API).
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Arbor Edge Defense, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Server Url | Yes | Base URL of the AED appliance's REST API. |
| Api Token | Yes | The API token from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Skips TLS certificate verification when enabled. Defaults to enabled; disable it once the AED appliance presents a certificate your environment trusts, to avoid connecting to an unverified endpoint. |
Click Create to save the device.
Available Methods
Global Countries
- get_countries / get_country: list all countries or look up one by code. Arg for get_country: country (required).
- get_blacklisted_countries / set_blacklisted_country / delete_blacklisted_country: read, add, or remove a country from the global blacklist. Arg: country (required).
Global Hosts
- get_blacklisted_hosts / get_blacklisted_host: read the global host blacklist, or look up one entry. Arg for get_blacklisted_host: host_address (required).
- set_blacklisted_hosts (Containment) / delete_blacklisted_hosts (its automatic Recovery action): blacklist or remove a host globally. Args required: host_address, expire_time (30 Minutes, 1 Hour, 3 Hour, 6 Hour, 12 Hour, 1 Day, 1 Week, 1 Month, or Permanent). When the expiry is reached, Logsign automatically runs delete_blacklisted_hosts on the same host to lift the block.
- get_whitelisted_hosts / get_whitelisted_host / set_whitelisted_hosts / delete_whitelisted_hosts: read, look up, add, or remove a host from the global whitelist. Arg: host_address (required). No expiry; whitelisting is not time-boxed.
Global Domains and URLs
- get_protection_groups_blacklisted_domains / set_protection_groups_blacklisted_domains / delete_protection_groups_blacklisted_domains / get_protection_groups_blacklisted_domain: read, add, remove, or look up a domain on the global domain blacklist. Arg: domain (required).
- get_protection_groups_blacklisted_urls / set_protection_groups_blacklisted_urls / delete_protection_groups_blacklisted_urls: read, add, or remove a URL from the global URL blacklist. Arg: url (required).
Protection Groups
- get_protection_groups: lists all protection groups.
- set_protection_groups: creates a protection group. Args required: name, prefixes, server_type.
- get_protection_group_by_pgid / delete_protection_group_by_pgid / patch_protection_group_by_pgid: look up, delete, or update a protection group. Arg: pgid (required).
Protection Group-Scoped Blacklist/Whitelist
Each of the following operates within a single protection group, identified by pgid:
- Countries: get_protection_groups_blacklisted_countries_by_pgid / set_ / delete_ / get_protection_groups_blacklisted_country_by_pgid. Args: pgid (required), country (required for set/get single).
- Domains: get_protection_groups_blacklisted_domains_by_pgid / set_ / delete_ / get_protection_groups_blacklisted_domain_by_pgid. Args: pgid (required), domain (required for set/get single).
- Hosts (blacklist, with expiry): get_protection_groups_blacklisted_hosts_by_pgid / get_protection_groups_blacklisted_host_by_pgid; set_protection_groups_blacklisted_hosts_by_pgid (Containment) / delete_protection_groups_blacklisted_hosts_by_pgid (its automatic Recovery action). Args for set: pgid, host_address, expire_time (all required, same expiry options as the global host blacklist).
- Hosts (whitelist): get_protection_groups_whitelisted_hosts_by_pgid / set_ / delete_ / get_protection_groups_whitelisted_host_by_pgid. Args: pgid, host_address (both required).
- URLs: get_protection_groups_blacklisted_urls_by_pgid / set_ / delete_. Args: pgid, url (both required for set).
TAXII Configuration
- get_taxii_configuration_clients (Analysis): lists configured TAXII clients. No args.
- get_taxii_configuration_collections (Analysis): lists TAXII collections. No args.
- set_taxii_configuration_collections (Containment): updates the TAXII collection configuration. Arg: title (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong, expired, or revoked Api Token. | Re-generate the API token on the AED appliance and update the Api Token field. |
| A blacklist/whitelist call fails for a specific protection group | The pgid does not match an existing protection group. | Use get_protection_groups to confirm the correct pgid before calling a _by_pgid method. |
| Blacklisted host is not automatically removed after the selected duration | Logsign's automatic recovery relies on the expire_time value supplied when the host was blacklisted; a Permanent entry never auto-expires. | Confirm the original set_blacklisted_hosts or set_protection_groups_blacklisted_hosts_by_pgid call used a non-Permanent expire_time, and call the matching delete_ method manually if needed. |
Notes and Limits
- This is a large, perimeter-defense-focused integration spanning global and per-protection-group country/host/domain/URL blacklisting and whitelisting, protection group management, and TAXII configuration; review Arbor Edge Defense's own documentation for how these concepts (protection groups, TAXII collections) relate to your deployment before using this integration in production automation.
- The exact console navigation path for generating an API token was not independently verified against a live Arbor Edge Defense appliance during this research; the field names and method behavior above are taken directly from Logsign's integration code.