Blocking IPs on Arbor DDoS using FortiSOAR

[MuhammadFaruqi1]

Hi Team,

I have FSR7.3.x. 

I have installed and configured the Arbor DDoS connector in FSR. Now I want to block the IPs on Arbor DDoS through SOAR. But when I see the actions available in the connector, the Block IP or Block IoCs kind of action is not available. Kindly let me know if I want to block the IPs on Arbor through SOAR, how can I do this? I shall be extremely grateful.

The version of the Arbor DDoS connector is:

Arbor DDoS
Version 1.0.0-6388

Certified: No

Publisher: Community

The available actions are: 

GET ALERTS

Retrieves a list of all DDoS alerts or specific alerts from Arbor DDoS, based on the search criteria you have specified.

GET NETWORK SUMMARY REPORT

Retrieves network summary reports from Arbor DDoS, using various filters such as the name of the customer associated with the report, the unit associated with the report, etc. you have specified.

GET TOPTALKER REPORT

Retrieves the top talker external or internal reports from Arbor DDoS, based on the record ID, report type, and other search criteria you have specified.

Regards,

MFaruqi

FortiSOAR 

[sjinturkar_FTNT · Accepted solution]

Yes, you are spot on. This action is not present at the moment in the connector. We encourage our beloved community to participate in enhancing such connectors and submit back to us. 

More details about how to contribute can be found here.

Note: If you want Fortinet to improve this connector then please work with your account manager to raise a NFR.