axgate-ngfw-nf-add-blacklist-batch
Add a blacklist entry per input row, combining that row's fields like the single add-blacklist options.
Syntax
... | axgate-ngfw-nf-add-blacklist-batch profile=STRING [label=STRING] [expiry=STRING]
Options
- profile=STRING
- Required. AXGATE NGFW (NF) profile code.
- label=STRING
- Optional. Label to tag the entries (default: Logpresso).
- expiry=STRING
- Optional. Expiration period from now: <number><unit> with s/m/h/d/w/mon (e.g. 30d, 12h, 1mon). The device expiry is date-only, so units under a day (s/m/h) are truncated to the resulting date. No expiration if omitted.
Input fields
The following fields are read from each row piped in.
| Field | Type | Required | Description |
|---|---|---|---|
| src_ip | String | △ | Source IP (ip alias accepted). e.g. 192.0.2.1 |
| dst_ip | String | △ | Destination IP. e.g. 192.0.2.2 |
| protocol | String | N | tcp/udp/icmp or 1-254 |
| src_port | Integer | N | Source port (requires tcp/udp) |
| dst_port | Integer | N | Destination port (requires tcp/udp) |
Note
At least one of src_ip and dst_ip is required (marked △ in the table). When both are given, they must be the same IP version.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _result | String | Result | Per-row result (SUCCESS/FAIL) |
| _error | String | Error | Failure reason when result is FAIL |
The original fields of each input row pass through unchanged; the two fields above are added to each row.