Cisco Router Remote Trigger Black Hole

Publisher: World Wide Technology App Version: 1.7 Product Vendor: Cisco Systems Product Name: Cisco IOS-XE Product Version Supported (regex): ".*"

This app interfaces with Cisco IOS-XE devices to create a blackhole for configured IPs or networks in Cisco BGP networks; it supports containment actions like 'block ip', 'block network', correct actions like 'unblock ip', 'unblock network', and investigative actions like 'list blocked networks' on a Cisco CSR device. It uses the SSH interface to log on and perform its actions. The target host is required to have the SSH interface enabled and a user account configured for privilege access (15).

Configuration Variables

The below configuration variables are required for this App to operate on Cisco IOS-XE. These are specified when configuring an asset in Phantom. VARIABLE REQUIRED TYPE DESCRIPTION username required string User with access to the trigger node tag optional string Route Tag password required password Password trigger_host required string Device IP/Hostname route_to_null required string Null Route IP (x.x.x.x) Supported Actions

unblock network - Unblocks an IP network block network - Blocks an IP network unblock ip - Unblocks an IP block ip - Blocks an IP list blocked networks - Lists currently blocked networks test connectivity - Validate the asset configuration for connectivity action: 'unblock network'

Unblocks an IP network

Type: correct

Read only: True

Action Parameters PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS destination_network required IP/network to unBlock (X.X.X.X/NM) string
Action Output

No Output action: 'block network'

Blocks an IP network

Type: contain

Read only: True

Action Parameters PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS destination_network required IP/network to block (X.X.X.X/NM) string
Action Output

No Output action: 'unblock ip'

Unblocks an IP

Type: correct

Read only: True

Action Parameters PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS destination_network required IP to unBlock (X.X.X.X) string
Action Output

No Output action: 'block ip'

Blocks an IP

Type: contain

Read only: True

Action Parameters PARAMETER REQUIRED DESCRIPTION TYPE CONTAINS destination_network required IP to block (X.X.X.X) string
name required Name route string
Action Output

No Output action: 'list blocked networks'

Lists currently blocked networks

Type: investigate

Read only: True

Action Parameters

No parameters are required for this action Action Output DATA PATH TYPE CONTAINS action_result.data.*.blackholed-network string
action_result.status string
action_result.message string
action: 'test connectivity'

Validate the asset configuration for connectivity

Type: test

Read only: True

This action logs into the Cisco router using a SSH call Action Parameters

No parameters are required for this action Action Output

No Output