Importing MS endpoints REST into NFA Application Definitions

[Legacy User]

Has anyone managed to *successfully* script something that will import application definitions into NFA at all?

 

Scenario:

MS have a REST page that that gives us all the end point IPs, ports etc. for Office 365/Azure etc. on https://endpoints.office.com/endpoints/worldwide 

What I'd like to do, is read this in, and convert it to something useful that can then be imported into NFA so we can separate out Office365/Azure/etc. from other traffic in reporting.  So rather than "x% of your traffic was HTTPS" etc. we can break it down further to "x% is Outlook 365, y% is Skype for Business and z% is Azure."

I literally have no idea where to start and if someone's already worked out how to import all that massive list, it would help save a lot of work.    

I've seen the SQL queries to manually import straight into the database but something that should be a basic bit of functionality to import from your own list is sadly lacking.

Eventually, I want to do similar for Meraki, AWS etc.to give a more granular report of what's going where and using up precious bandwidth!

 

Thanks in advance!

[Christopher Walsh]

NFA allows you to import application mappings from CSV files using the racmd -import command.

NFA provides you with several .csv templates for each type of application mappings that are available, ie host, subnet, tos, nbar2.  Once you have the csv files configured correctly you can import the files. More details are in the link below:

 

More details 

Import Application Mapping Rules - CA Network Flow Analysis - 9.5.0 - CA Technologies Documentation 

 

I don't think it is currently possible to import them via rest directly from Microsoft at this time.

NFA will be adding some more API support in the next release, 10.0, but not sure that will be an option yet.