Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Infoblox BloxOne CDF retrieves DNS Events from the InfoBlox BloxOne Cloud platform and ingests the data into the ThreatQ platform in the form of Events and Related Indicators.

The integration provides the following feed:

• Infoblox BloxOne - DNS Events - retrieves DNS events and related indicators from InfoBlox BloxOne.

The integration ingests Event and Indicator type system objects.   

Prerequisites

The following is required in order to run the integration:

• An Infoblox BloxOne instance.
• An Infoblox BloxOne API Key.  

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration yaml file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration yaml file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the file on your local machine

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

6. The feed will be added to the integrations page.  You will still need to configure and then enable the feed.

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API IP/Hostname	Enter your Infoblox BloxOne instance hostname or IP address.
   API Key	Enter your API key for your Infoblox BloxOne instance.
   Add RPZ Events	Optional - Enable this parameter to ingest Infoblox BloxOne events as ThreatQ events.  While the RPZ Filters listed below are optional, it is highly recommended that you utilize them in order to avoid ingesting an extreme amount of events.
   RPZ Network (If Add RPZ Events is selected)	Optional - Filter RPZ events by Source Network (NAT case) / On-Prem Host name / AT Endpoint.
   RPZ Query IP (If Add RPZ Events is selected)	Optional - Filter RPZ events by the device IP that sent the DNS query.
   RPZ Policy Name (If Add RPZ Events is selected)	Optional - Filter RPZ events by the policy on InfoBlox BloxOne that created the event.
   RPZ Threat Level (If Add RPZ Events is selected)	Optional - Filter the RPZ events by the threat level of the event.  Options include: Low Medium High
   RPZ Threat Category (If Add RPZ Events is selected)	Optional - Filter the RPZ events by the Threat Category (Threat Class).
   Add Analytic Events	Optional - Enable this parameter to ingest Infoblox BloxOne analytic (Threat Insight) events into ThreatQ.   While the Analytic Filters listed below are optional, it is highly recommended that you utilize them in order to avoid ingesting an extreme amount of events.
   Analytic Network (If Add Analytic Events is selected)	Optional - Filter Analytic events by Source Network (NAT case) / On-Prem Host name / AT Endpoint.
   Analytic Query IP (If Add Analytic Events is selected)	Optional - Filter Analytic events by the device IP that sent the DNS query.
   Analytic Policy Name (If Add Analytic Events is selected)	Optional - Filter Analytic events by the policy that created the event.
   Analytic Threat Level (If Add Analytic Events is selected)	Optional - Filter Analytic events by the threat level.  Options include: Low Medium High
   Analytic Threat Category (If Add Analytic Events is selected)	Optional - Filter Analytic events by the Threat Category (Threat Class).

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "result": [
        {
            "app_category": "",
            "app_name": "",
            "category": "",
            "confidence": "HIGH",
            "country": "",
            "device": "test-VirtualBox",
            "dhcp_fingerprint": "",
            "dns_view": "",
            "endpoint_groups": "All BloxOne Endpoints (Default)",
            "event_time": "2024-05-29T08:07:22.000Z",
            "feed_name": "Default Block",
            "feed_type": "FQDN",
            "mac_address": "08:00:27:97:03:68",
            "network": "BloxOne Endpoint",
            "os_version": "Ubuntu 24.04 LTS",
            "policy_action": "Block",
            "policy_name": "Default Global Policy",
            "private_ip": "10.0.2.15",
            "qip": "84.232.150.150",
            "qname": "shadowserver.org.",
            "qtype": "A",
            "rcode": "NXDOMAIN",
            "rdata": "NXDOMAIN",
            "rip": "84.232.150.150",
            "severity": "MEDIUM",
            "tclass": "DefaultCustomList",
            "tfamily": "Default Block",
            "threat_indicator": "shadowserver.org",
            "tproperty": "Default Block",
            "user": "test",
            "user_groups": "$ib_authn_b1e$"
        }
    ],
    "status_code": "200"
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 1.0.0
  • Initial release