InfobloxBloxOneThreatDefense
Infoblox Threat Defense with DDI integration leverages DNS as the first line of defense to detect and block cyber threats, while also using threat intelligence to manage SOC Insight incident response and enrich indicators.
Data Enrichment & Threat Intelligence · Infoblox Threat Defense with DDI
Details
| ID | InfobloxBloxOneThreatDefense |
|---|---|
| Provider | Infoblox |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.5.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Infoblox Threat Defense with DDI integration leverages DNS as the first line of defense to detect and block cyber threats, while also using threat intelligence to manage insight incident response and enrich indicators.
This integration was integrated and tested with version 1.0.0 of Infoblox Threat Defense with DDI.
Configure Infoblox Threat Defense with DDI in Cortex
| Parameter | Description | Required |
|---|---|---|
| Service API Key | True | |
| Source Reliability | Reliability of the source providing the intelligence data. | False |
| Create relationships | Create relationships between indicators as part of Enrichment. | False |
| Fetch incidents | False | |
| Incident type | False | |
| Ingestion Type | Select the ingestion type to fetch as XSOAR incident. Default is SOC Insight. | False |
| SOC Insight Status | Retrieve the SOC Insights as specified status. | False |
| SOC Insight Threat Type | Retrieve the SOC Insights as specified threat type. | False |
| SOC Insight Priority Level | Retrieve the SOC Insights as specified priority level. | False |
| DNS Security Event Feed Name | Retrieve the DNS Security Events as specified feed name or custom list name. | False |
| DNS Security Event Network | Retrieve the DNS Security Events as specified network name. | False |
| DNS Security Event Policy Action | Retrieve the DNS Security Events as specified policy action. | False |
| DNS Security Event Policy Name | Retrieve the DNS Security Events as specified policy name. | False |
| DNS Security Event Queried Name | Retrieve the DNS Security Events as specified queried name. | False |
| DNS Security Event Threat Class | Retrieve the DNS Security Events as specified threat class. | False |
| DNS Security Event Threat Family | Retrieve the DNS Security Events as specified threat family. | False |
| DNS Security Event Threat Indicator | Retrieve the DNS Security Events as specified threat indicator. | False |
| DNS Security Event Threat Level | Retrieve the DNS Security Events as specified threat level. | False |
| Max Fetch | The maximum number of SOC Insights or DNS Security Events to fetch each time. If the value is greater than 200, it will be considered as 200. The maximum is 200. | False |
| First fetch timestamp | The date or relative timestamp from which to begin fetching incidents. Note: This parameter is only applicable for DNS Security Events. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2025, 01 May 2025 04:45:33, 2025-05-17T14:05:44Z. |
False |
| Incidents Fetch Interval | False | |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
bloxone-td-dossier-lookup-get
The Dossier Lookup API returns detailed information on the specified indicator from the requested sources.
Base Command
bloxone-td-dossier-lookup-get
Input
| Argument Name | Description | Required |
|---|---|---|
| indicator_type | The type of indcator to search by. Possible values are: host, ip, url, hash, email. | Required |
| value | The indicator to search on. | Required |
| sources | The sources to query. Multiple sources can be specified. If no source is specified, the call will search on all available sources. (You can see the list of the available sources by running bloxone-td-dossier-source-list). | Optional |
| interval_in_seconds | The interval in seconds between each poll. Default is 10. | Optional |
| timeout | The timeout in seconds until polling ends. Default is 600. | Optional |
| job_id | used for polling. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BloxOneTD.DossierLookup.source | String | The Dossier source. |
| BloxOneTD.DossierLookup.target | String | The targeted indicator. |
| BloxOneTD.DossierLookup.task_id | String | The Dossier task ID. |
| BloxOneTD.DossierLookup.type | String | The indicator type. |
Command example
!bloxone-td-dossier-lookup-get indicator_type="ip" value="11.22.33.44" sources="activity,threatfox,ccb"
Context Example
{
"BloxOneTD": {
"DossierLookup": [
{
"params": {
"source": "ccb",
"target": "11.22.33.44",
"type": "ip"
},
"status": "success",
"task_id": "97bdeca2-b66d-47b1-b1ef-9e4833654df2",
"time": 6401,
"v": "3.0.0"
},
{
"data": {
"impacted_devices": [],
"requests_by_day": []
},
"params": {
"source": "activity",
"target": "11.22.33.44",
"type": "ip"
},
"status": "success",
"task_id": "4074cb34-2bec-485d-8d6d-9e9cc88d5229",
"time": 1708,
"v": "3.0.0"
},
{
"data": {
"matches": []
},
"params": {
"source": "threatfox",
"target": "11.22.33.44",
"type": "ip"
},
"status": "success",
"task_id": "73892ea3-1e22-433f-bc74-f59133b914d0",
"time": 8,
"v": "3.0.0"
}
]
}
}
Human Readable Output
Lookalike Domain List
Task Id Type Target Source d418b8d6-831c-4f6f-a31a-6d48995d2267 ip 11.22.33.44 threatfox 91945be3-0cef-4d03-afd7-e4f25864553d ip 11.22.33.44 ccb 7145a1ca-40a9-43df-b0a3-c4281e5abd7e ip 11.22.33.44 activity
bloxone-td-dossier-source-list
Get available Dossier sources.
Base Command
bloxone-td-dossier-source-list
Input
There are no input arguments for this command.
Context Output
| Path | Type | Description |
|---|---|---|
| BloxOneTD.DossierSource | String | Available Dossier sources. |
Command example
#### Context Example
```json
{
"BloxOneTD": {
"DossierSource": [
"ccb",
"activity",
"geo",
"threatfox"
]
}
}
Human Readable Output
Results
DossierSource activity ccb geo threatfox
bloxone-td-lookalike-domain-list
Get lookalike domain lists.
Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.
Base Command
bloxone-td-lookalike-domain-list
Input
| Argument Name | Description | Required |
|---|---|---|
| filter | The free query filter argument. | Optional |
| target_domain | Filter by target domain. | Optional |
| detected_at | Filter by values that are greater than or equal to the given value. You can use ISO format (e.g. ‘2023-02-14T00:11:22Z’) or use a relative time (e.g. “3 days”). | Optional |
| limit | Maximum number of results to return from the query. Default is 50. | Optional |
| offset | Return results starting at this offset. Should be an integer. Default is 0. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| BloxOneTD.LookalikeDomain.detected_at | Date | The date of the lookalike detection. |
| BloxOneTD.LookalikeDomain.lookalike_domain | String | The lookalike domain. |
| BloxOneTD.LookalikeDomain.lookalike_host | String | The lookalike host. |
| BloxOneTD.LookalikeDomain.reason | String | The reason for the detection. |
| BloxOneTD.LookalikeDomain.target_domain | String | The domain that was targeted by the lookalike domain. |
Command example
!bloxone-td-lookalike-domain-list detected_at="1y"
Context Example
{
"BloxOneTD": {
"LookalikeDomain": [
{
"detected_at": "2023-01-27T18:43:01Z",
"lookalike_domain": "test.a.com",
"lookalike_host": "test.a.com",
"reason": "Domain is a lookalike to test.com. The creation date is 2023-01-22.",
"target_domain": "test.com"
},
{
"detected_at": "2023-01-28T18:36:27Z",
"lookalike_domain": "test.b.com",
"lookalike_host": "test.b.com",
"reason": "Domain is a lookalike to test.com and has suspicious registration, behavior, or associations with known threats. The creation date is 2022-11-30.",
"suspicious": true,
"target_domain": "test.com"
},
{
"detected_at": "2023-01-28T18:37:03Z",
"lookalike_domain": "test.c.com",
"lookalike_host": "test.c.com",
"reason": "Domain is a lookalike to test.com. The creation date is 2022-09-18.",
"target_domain": "test.com"
}
]
}
}
Human Readable Output
Results
Detected At Lookalike Domain Lookalike Host Reason Target Domain 2023-01-27T18:43:01Z test.a.com test.a.com Domain is a lookalike to test.com. The creation date is 2023-01-22. test.com 2023-01-28T18:36:27Z test.b.com test.b.com Domain is a lookalike to test.com and has suspicious registration, behavior, or associations with known threats. The creation date is 2022-11-30. test.com 2023-01-28T18:37:03Z test.c.com test.c.com Domain is a lookalike to test.com. The creation date is 2022-09-18. test.com
infobloxcloud-block-ip
The given IP addresses will be added to the provided block list.
Base Command
infobloxcloud-block-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | Specify the IP addresses to block. Supports comma-separated values. | Required |
| custom_list_name | Specify the name of the custom list to add the given IP addresses to. Default is Default Block. | Optional |
| custom_list_type | Specify the type of the custom list to add the given IP addresses to. Possible values are: default_block, custom_list, threat_insight, dga, dnsm, zero_day_dns, threat_insight_nde. Default is default_block. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.CustomList.id | String | The ID of the custom list. |
| InfobloxCloud.CustomList.name | String | The name of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.items | String | The items in the custom list. |
| InfobloxCloud.CustomList.items_described | Array | The items described in the custom list. |
| InfobloxCloud.CustomList.item_count | Number | The number of items in the custom list. |
| InfobloxCloud.CustomList.confidence_level | String | The confidence level of the custom list. |
| InfobloxCloud.CustomList.created_time | String | The time the custom list was created. |
| InfobloxCloud.CustomList.last_updated_time | String | The time the custom list was last updated. |
| InfobloxCloud.CustomList.description | String | The description of the custom list. |
| InfobloxCloud.CustomList.policies | String | The policies of the custom list. |
| InfobloxCloud.CustomList.tags | String | The tags of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.threat_level | String | The threat level of the custom list. |
Command example
!infobloxcloud-block-ip ip=0.0.0.0
Context Example
{
"InfobloxCloud": {
"CustomList": {
"confidence_level": "HIGH",
"created_time": "2024-04-01T18:24:37Z",
"description": "Auto-generated",
"id": 456789,
"item_count": 2,
"items": [
"0.0.0.0/32",
"0.0.0.1/32"
],
"items_described": [
{
"description": "",
"item": "0.0.0.0/32",
"status": "ACTIVE",
"status_details": ""
},
{
"description": "",
"item": "0.0.0.1/32",
"status": "ACTIVE",
"status_details": ""
}
],
"name": "Test Block",
"policies": [
"Test Policy"
],
"tags": {
"test_key": "test_value"
},
"threat_level": "MEDIUM",
"type": "test_block",
"updated_time": "2025-07-29T08:47:54Z"
}
}
}
Human Readable Output
‘0.0.0.0’ indicators added to the ‘Test Block’ list
ID Name Type Description Items Confidence Level Threat Level Tags Created Time Updated Time 792594 Test Block test_block Auto-generated 0.0.0.0/32,
0.0.0.1/32HIGH MEDIUM test_key: test_value 2024-04-01T18:24:37Z 2025-07-29T08:47:54Z
infobloxcloud-unblock-ip
The given IP addresses will be added to the provided allow list.
Base Command
infobloxcloud-unblock-ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | Specify the IP addresses to unblock. Supports comma-separated values. | Required |
| custom_list_name | Specify the name of the custom list to add the given IP addresses to. Default is Default Allow. | Optional |
| custom_list_type | Specify the type of the custom list to add the given IP addresses to. Possible values are: default_allow, custom_list, threat_insight, threat_insight_nde. Default is default_allow. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.CustomList.id | String | The ID of the custom list. |
| InfobloxCloud.CustomList.name | String | The name of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.items | String | The items in the custom list. |
| InfobloxCloud.CustomList.items_described | Array | The items described in the custom list. |
| InfobloxCloud.CustomList.item_count | Number | The number of items in the custom list. |
| InfobloxCloud.CustomList.confidence_level | String | The confidence level of the custom list. |
| InfobloxCloud.CustomList.created_time | String | The time the custom list was created. |
| InfobloxCloud.CustomList.last_updated_time | String | The time the custom list was last updated. |
| InfobloxCloud.CustomList.description | String | The description of the custom list. |
| InfobloxCloud.CustomList.policies | String | The policies of the custom list. |
| InfobloxCloud.CustomList.tags | String | The tags of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.threat_level | String | The threat level of the custom list. |
Command example
!infobloxcloud-unblock-ip ip=0.0.0.0
Context Example
{
"InfobloxCloud": {
"CustomList": {
"confidence_level": "HIGH",
"created_time": "2024-04-01T18:24:37Z",
"description": "Auto-generated",
"id": 123456,
"item_count": 2,
"items": [
"0.0.0.0/32",
"0.0.0.1/32"
],
"items_described": [
{
"description": "",
"item": "0.0.0.0/32",
"status": "ACTIVE",
"status_details": ""
},
{
"description": "",
"item": "0.0.0.1/32",
"status": "ACTIVE",
"status_details": ""
}
],
"name": "Test Allow",
"policies": [
"Test Policy"
],
"tags": {
"test_key": "test_value"
},
"threat_level": "MEDIUM",
"type": "test_allow",
"updated_time": "2025-07-29T08:48:02Z"
}
}
}
Human Readable Output
‘0.0.0.0’ indicators added to the ‘Test Allow’ list
ID Name Type Description Items Confidence Level Threat Level Tags Created Time Updated Time 123456 Test Allow test_allow Auto-generated 0.0.0.0/32,
0.0.0.1/32HIGH MEDIUM test_key: test_value 2024-04-01T18:24:37Z 2025-07-29T08:48:02Z
infobloxcloud-block-domain
The given domains will be added to the provided block list.
Base Command
infobloxcloud-block-domain
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | Specify the Domains to block. Supports comma-separated values. | Required |
| custom_list_name | Specify the name of the custom list to add the given domains to. Default is Default Block. | Optional |
| custom_list_type | Specify the type of the custom list to add the given domains to. Possible values are: default_block, custom_list, threat_insight, dga, dnsm, zero_day_dns, threat_insight_nde. Default is default_block. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.CustomList.id | String | The ID of the custom list. |
| InfobloxCloud.CustomList.name | String | The name of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.items | String | The items in the custom list. |
| InfobloxCloud.CustomList.items_described | Array | The items described in the custom list. |
| InfobloxCloud.CustomList.item_count | Number | The number of items in the custom list. |
| InfobloxCloud.CustomList.confidence_level | String | The confidence level of the custom list. |
| InfobloxCloud.CustomList.created_time | String | The time the custom list was created. |
| InfobloxCloud.CustomList.last_updated_time | String | The time the custom list was last updated. |
| InfobloxCloud.CustomList.description | String | The description of the custom list. |
| InfobloxCloud.CustomList.policies | String | The policies of the custom list. |
| InfobloxCloud.CustomList.tags | String | The tags of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.threat_level | String | The threat level of the custom list. |
Command example
!infobloxcloud-block-domain domain="test.com"
Context Example
{
"InfobloxCloud": {
"CustomList": {
"confidence_level": "HIGH",
"created_time": "2024-04-01T18:24:37Z",
"description": "Auto-generated",
"id": 456789,
"item_count": 2,
"items": [
"test.com",
"test.org"
],
"items_described": [
{
"description": "",
"item": "test.com",
"status": "ACTIVE",
"status_details": ""
},
{
"description": "",
"item": "test.org",
"status": "ACTIVE",
"status_details": ""
}
],
"name": "Test Block",
"policies": [
"Test Policy"
],
"tags": null,
"threat_level": "MEDIUM",
"type": "test_block",
"updated_time": "2025-07-29T10:27:49Z"
}
}
}
Human Readable Output
‘test.com’ indicator added to the ‘Test Block’ list
ID Name Type Description Items Confidence Level Threat Level Created Time Updated Time 456789 Test Block test_block Auto-generated test.com,
test.orgHIGH MEDIUM 2024-04-01T18:24:37Z 2025-07-29T10:27:49Z
infobloxcloud-unblock-domain
The given domains will be added to the provided allow list.
Base Command
infobloxcloud-unblock-domain
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | Specify the Domains to unblock. Supports comma-separated values. | Required |
| custom_list_name | Specify the name of the custom list to add the given domains to. Default is Default Allow. | Optional |
| custom_list_type | Specify the type of the custom list to add the given domains to. Possible values are: default_allow, custom_list, threat_insight, threat_insight_nde. Default is default_allow. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.CustomList.id | String | The ID of the custom list. |
| InfobloxCloud.CustomList.name | String | The name of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.items | String | The items in the custom list. |
| InfobloxCloud.CustomList.items_described | Array | The items described in the custom list. |
| InfobloxCloud.CustomList.item_count | Number | The number of items in the custom list. |
| InfobloxCloud.CustomList.confidence_level | String | The confidence level of the custom list. |
| InfobloxCloud.CustomList.created_time | String | The time the custom list was created. |
| InfobloxCloud.CustomList.last_updated_time | String | The time the custom list was last updated. |
| InfobloxCloud.CustomList.description | String | The description of the custom list. |
| InfobloxCloud.CustomList.policies | String | The policies of the custom list. |
| InfobloxCloud.CustomList.tags | String | The tags of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.threat_level | String | The threat level of the custom list. |
Command example
!infobloxcloud-unblock-domain domain="test.com"
Context Example
{
"InfobloxCloud": {
"CustomList": {
"confidence_level": "HIGH",
"created_time": "2024-04-01T18:24:37Z",
"description": "Auto-generated",
"id": 123456,
"item_count": 2,
"items": [
"test.com",
"test.org"
],
"items_described": [
{
"description": "",
"item": "test.com",
"status": "ACTIVE",
"status_details": ""
},
{
"description": "",
"item": "test.org",
"status": "ACTIVE",
"status_details": ""
}
],
"name": "Test Allow",
"policies": [
"Test Policy"
],
"tags": {
"test_key": "test_value"
},
"threat_level": "MEDIUM",
"type": "test_allow",
"updated_time": "2025-07-29T10:27:56Z"
}
}
}
Human Readable Output
‘test.com’ indicator added to the ‘Test Allow’ list
ID Name Type Description Items Confidence Level Threat Level Tags Created Time Updated Time 123456 Test Allow test_allow Auto-generated test.com,
test.orgHIGH MEDIUM test_key: test_value 2024-04-01T18:24:37Z 2025-07-29T10:27:56Z
infobloxcloud-customlist-indicator-remove
The given indicators will be removed from the provided custom list.
Base Command
infobloxcloud-customlist-indicator-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| indicators | Specify the indicators to remove from the custom list. Format accepted is: “0.0.0.0, example.com”. | Required |
| custom_list_name | Specify the name of the custom list to remove the given indicators from. | Required |
| custom_list_type | Specify the type of the custom list to remove the given indicators from. Possible values are: default_allow, default_block, custom_list, threat_insight, dga, dnsm, zero_day_dns, threat_insight_nde. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.CustomList.id | String | The ID of the custom list. |
| InfobloxCloud.CustomList.name | String | The name of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.items | String | The items in the custom list. |
| InfobloxCloud.CustomList.items_described | Array | The items described in the custom list. |
| InfobloxCloud.CustomList.item_count | Number | The number of items in the custom list. |
| InfobloxCloud.CustomList.confidence_level | String | The confidence level of the custom list. |
| InfobloxCloud.CustomList.created_time | String | The time the custom list was created. |
| InfobloxCloud.CustomList.last_updated_time | String | The time the custom list was last updated. |
| InfobloxCloud.CustomList.description | String | The description of the custom list. |
| InfobloxCloud.CustomList.policies | String | The policies of the custom list. |
| InfobloxCloud.CustomList.tags | String | The tags of the custom list. |
| InfobloxCloud.CustomList.type | String | The type of the custom list. |
| InfobloxCloud.CustomList.threat_level | String | The threat level of the custom list. |
Command example
!infobloxcloud-customlist-indicator-remove indicators="0.0.0.0" custom_list_name="Test Allow" custom_list_type="test_allow"
Context Example
{
"InfobloxCloud": {
"CustomList": {
"confidence_level": "HIGH",
"created_time": "2024-04-01T18:24:37Z",
"description": "Auto-generated",
"id": 123456,
"item_count": 1,
"items": [
"example.com"
],
"items_described": [
{
"description": "",
"item": "example.com",
"status": "ACTIVE",
"status_details": ""
}
],
"name": "Test Allow",
"policies": [
"Test Policy",
],
"tags": {
"test_key": "test_value"
},
"threat_level": "MEDIUM",
"type": "test_allow",
"updated_time": "2025-07-31T11:07:41Z"
}
}
}
Human Readable Output
‘0.0.0.0’ indicators removed from the ‘Test Allow’ list
ID Name Type Description Items Confidence Level Threat Level Tags Created Time Updated Time 123456 Test Allow test_allow Auto-generated example.com HIGH MEDIUM test_key: test_value 2024-04-01T18:24:37Z 2025-07-31T11:07:41Z
ip
Gets the comprehensive IP reputation and threat intelligence from Infoblox Threat Defense, including threat indicators, IPAM address information, and standard IP reputation data.
Base Command
ip
Input
| Argument Name | Description | Required |
|---|---|---|
| ip | IP(s) for which to retrieve reputation and threat intelligence. Supports comma-separated values. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.IP.ip | String | The requested IP address. |
| IP.Address | String | IP address. |
| IP.Relationships.EntityA | String | The source of the relationship. |
| IP.Relationships.EntityB | String | The destination of the relationship. |
| IP.Relationships.Relationship | String | The name of the relationship. |
| IP.Relationships.EntityAType | String | The type of the source of the relationship. |
| IP.Relationships.EntityBType | String | The type of the destination of the relationship. |
| IP.ASN | String | The autonomous system name for the IP address, for example: “AS8948”. |
| IP.Hostname | String | The hostname that is mapped to this IP address. |
| IP.Geo.Location | String | The geolocation where the IP address is located, in the format: latitude:longitude. |
| IP.Geo.Country | String | The country in which the IP address is located. |
| IP.Geo.Description | String | Additional information about the location. |
| IP.DetectionEngines | Number | The total number of engines that checked the indicator. |
| IP.PositiveDetections | Number | The number of engines that positively detected the indicator as malicious. |
| IP.Malicious.Vendor | String | The vendor reporting the IP address as malicious. |
| IP.Malicious.Description | String | A description explaining why the IP address was reported as malicious. |
| IP.Tags | Unknown | (List) Tags of the IP address. |
| IP.FeedRelatedIndicators.value | String | Indicators that are associated with the IP address. |
| IP.FeedRelatedIndicators.type | String | The type of the indicators that are associated with the IP address. |
| IP.FeedRelatedIndicators.description | String | The description of the indicators that are associated with the IP address. |
| IP.MalwareFamily | String | The malware family associated with the IP address. |
| IP.Organization.Name | String | The organization of the IP address. |
| IP.Organization.Type | String | The organization type of the IP address. |
| IP.ASOwner | String | The autonomous system owner of the IP address. |
| IP.Region | String | The region in which the IP address is located. |
| IP.Port | String | Ports that are associated with the IP address. |
| IP.Internal | Boolean | Whether the IP address is internal or external. |
| IP.UpdatedDate | Date | The date that the IP address was last updated. |
| IP.Registrar.Abuse.Name | String | The name of the contact for reporting abuse. |
| IP.Registrar.Abuse.Address | String | The address of the contact for reporting abuse. |
| IP.Registrar.Abuse.Country | String | The country of the contact for reporting abuse. |
| IP.Registrar.Abuse.Network | String | The network of the contact for reporting abuse. |
| IP.Registrar.Abuse.Phone | String | The phone number of the contact for reporting abuse. |
| IP.Registrar.Abuse.Email | String | The email address of the contact for reporting abuse. |
| IP.Campaign | String | The campaign associated with the IP address. |
| IP.TrafficLightProtocol | String | The Traffic Light Protocol (TLP) color that is suitable for the IP address. |
| IP.CommunityNotes.note | String | Notes on the IP address that were given by the community. |
| IP.CommunityNotes.timestamp | Date | The time in which the note was published. |
| IP.Publications.source | String | The source in which the article was published. |
| IP.Publications.title | String | The name of the article. |
| IP.Publications.link | String | A link to the original article. |
| IP.Publications.timestamp | Date | The time in which the article was published. |
| IP.ThreatTypes.threatcategory | String | The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc. |
| IP.ThreatTypes.threatcategoryconfidence | String | The confidence level provided by the vendor for the threat type category For example, a confidence of 90 for the threat type category ‘malware’ means that the vendor rates that this is 90% confidence of being a malware. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| InfobloxCloud.IP.Threat.id | String | The unique identifier for the threat indicator. |
| InfobloxCloud.IP.Threat.type | String | The type of threat indicator. |
| InfobloxCloud.IP.Threat.ip | String | The IP address identified as a threat indicator. |
| InfobloxCloud.IP.Threat.profile | String | The threat profile or classification source. |
| InfobloxCloud.IP.Threat.property | String | The specific property or category of the threat. |
| InfobloxCloud.IP.Threat.class | String | The classification of the threat. |
| InfobloxCloud.IP.Threat.threat_level | Number | The numeric threat level score. |
| InfobloxCloud.IP.Threat.threat_label | String | The textual threat level label. |
| InfobloxCloud.IP.Threat.expiration | Date | The timestamp when the threat indicator will expire. |
| InfobloxCloud.IP.Threat.detected | Date | The timestamp when the threat activity was first detected. |
| InfobloxCloud.IP.Threat.received | Date | The timestamp when the threat indicator was received by the system. |
| InfobloxCloud.IP.Threat.imported | Date | The timestamp when the threat indicator was imported into the system. |
| InfobloxCloud.IP.Threat.up | String | The boolean status flag indicating whether the threat indicator is currently active. |
| InfobloxCloud.IP.Threat.batch_id | String | The batch ID of the threat indicator. |
| InfobloxCloud.IP.Threat.confidence | Number | The numeric confidence score representing the reliability of the threat indicator. |
| InfobloxCloud.IP.Threat.extended.notes | String | The additional notes or information about the threat indicator. |
| InfobloxCloud.IP.Threat.threat_score | Number | The numeric score representing the calculated threat severity. |
| InfobloxCloud.IP.Threat.threat_score_rating | String | The textual rating of the threat score. |
| InfobloxCloud.IP.Threat.threat_score_vector | String | The vector string representing threat scoring details. |
| InfobloxCloud.IP.Threat.risk_score | Number | The numeric risk score assigned to the threat indicator. |
| InfobloxCloud.IP.Threat.risk_score_rating | String | The textual rating of the risk score. |
| InfobloxCloud.IP.Threat.risk_score_vector | String | The vector string representing risk scoring details. |
| InfobloxCloud.IP.Threat.confidence_score | Number | The numeric confidence score for the threat assessment. |
| InfobloxCloud.IP.Threat.confidence_score_rating | String | The textual rating of the confidence score. |
| InfobloxCloud.IP.Threat.confidence_score_vector | String | The vector string representing confidence scoring details. |
| InfobloxCloud.IP.Threat.extended.cyberint_guid | String | The unique identifier for the threat indicator. |
| InfobloxCloud.IP.Threat.extended.attack_chain | String | The attack chain associated with the threat indicator. |
| InfobloxCloud.IP.Threat.extended.extended | String | The additional information or metadata associated with the threat indicator. |
| InfobloxCloud.IP.Threat.extended.protocol | String | The protocol associated with the threat indicator. |
| InfobloxCloud.IP.Threat.extended.references | String | The references associated with the threat indicator. |
| InfobloxCloud.IP.Threat.extended.threat_actor | String | The threat actor associated with the threat indicator. |
| InfobloxCloud.IP.Threat.extended.threat_actor_vector | String | The vector string representing threat actor details. |
| InfobloxCloud.IP.Threat.extended.risk_score | String | The numeric risk score assigned to the threat indicator. |
| InfobloxCloud.IP.Threat.extended.threat_score | String | The numeric threat score assigned to the threat indicator. |
| InfobloxCloud.IP.Threat.extended.sample_sha256 | String | The SHA-256 hash of the sample associated with the threat. |
| InfobloxCloud.IP.Threat.extended.original_profile | String | The original profile or classification source of the threat. |
| InfobloxCloud.IP.Address.address | String | The IP address assigned to the resource. |
| InfobloxCloud.IP.Address.comment | String | A user-provided comment or annotation for the address record. |
| InfobloxCloud.IP.Address.compartment_id | String | The compartment ID of the IP address. |
| InfobloxCloud.IP.Address.created_at | Date | The timestamp when the IP address was created. |
| InfobloxCloud.IP.Address.dhcp_info | Unknown | The DHCP information associated with the IP address. |
| InfobloxCloud.IP.Address.disable_dhcp | Boolean | A boolean flag indicating whether DHCP is disabled for the IP address. |
| InfobloxCloud.IP.Address.discovery_attrs | Unknown | The discovery attributes associated with the IP address. |
| InfobloxCloud.IP.Address.discovery_metadata | Unknown | The discovery metadata associated with the IP address. |
| InfobloxCloud.IP.Address.external_keys | Unknown | External keys associated with the IP address. |
| InfobloxCloud.IP.Address.host | Unknown | The host name of the IP address. |
| InfobloxCloud.IP.Address.hwaddr | String | The hardware address of the IP address. |
| InfobloxCloud.IP.Address.id | String | The unique identifier of the IP address. |
| InfobloxCloud.IP.Address.interface | String | The interface of the IP address. |
| InfobloxCloud.IP.Address.names | Unknown | The names associated with the IP address. |
| InfobloxCloud.IP.Address.parent | String | The parent of the IP address. |
| InfobloxCloud.IP.Address.protocol | String | The protocol of the IP address. |
| InfobloxCloud.IP.Address.range | String | The range of the IP address. |
| InfobloxCloud.IP.Address.space | String | The space of the IP address. |
| InfobloxCloud.IP.Address.state | String | The state of the IP address. |
| InfobloxCloud.IP.Address.tags | Unknown | The tags associated with the IP address. |
| InfobloxCloud.IP.Address.updated_at | Date | The timestamp when the IP address was last updated. |
| InfobloxCloud.IP.Address.usage | String | The usage of the IP address. |
| InfobloxCloud.IP.Address.names.name | String | The name of the IP address. |
| InfobloxCloud.IP.Address.names.type | Unknown | The type of the IP address. |
Command example
!ip ip="0.0.0.1"
Context Example
{
"DBotScore": {
"Indicator": "0.0.0.1",
"Reliability": "A - Completely reliable",
"Score": 3,
"Type": "ip",
"Vendor": "InfobloxThreatDefensewithDDI"
},
"IP": {
"Address": "0.0.0.1",
"Description": "Malware Download associated with the APT group",
"ThreatTypes": [
{
"threatcategory": "IP",
"threatcategoryconfidence": "100"
}
],
"Hostname": "name",
"DetectionEngines": 1,
"Tags": [
"cyberint_guid: simple_cyberint_guid",
"notes: Malware Download associated with the APT group",
"Protocol: ip4",
"State: used",
"temp: true"
],
"MalwareFamily": "APT",
"Malicious": {
"Vendor": "InfobloxThreatDefensewithDDI",
"Description": "Malware Download associated with the APT group"
}
},
"InfobloxCloud": {
"IP": {
"ip": "0.0.0.1",
"Threat": {
"id": "00000000-0000-0000-0000-000000000000",
"type": "IP",
"ip": "0.0.0.1",
"profile": "IID",
"property": "APT_Malware",
"class": "APT",
"threat_level": 100,
"expiration": "2042-11-01T09:29:18.721Z",
"detected": "2025-07-29T09:29:18.721Z",
"received": "2025-07-29T09:31:39.329Z",
"imported": "2025-07-29T09:31:39.329Z",
"up": "true",
"confidence": 100,
"batch_id": "00000000-0000-0000-0000-000000000000",
"threat_score": 10,
"threat_score_rating": "Critical",
"threat_score_vector": "simple_threat_vector",
"risk_score": 9.9,
"risk_score_rating": "Critical",
"risk_score_vector": "simple_risk_vector",
"confidence_score": 0.1,
"confidence_score_rating": "Unconfirmed",
"confidence_score_vector": "simple_confidence_vector",
"extended": {
"cyberint_guid": "simple_cyberint_guid",
"notes": "Malware Download associated with the APT group"
}
},
"Address": {
"address": "0.0.0.1",
"comment": "comment",
"compartment_id": "00000000-0000-0000-0000-000000000000",
"created_at": "2025-06-27T13:07:21.476126Z",
"disable_dhcp": false,
"external_keys": {
"e3": "3e3"
},
"host": "ipam/host/00000000-0000-0000-0000-000000000000",
"hwaddr": "00:00:00:00:00:00",
"id": "ipam/address/00000000-0000-0000-0000-000000000000",
"interface": "interface",
"names": [
{
"name": "name",
"type": "user"
}
],
"parent": "ipam/subnet/00000000-0000-0000-0000-000000000000",
"protocol": "ip4",
"range": "ipam/range/00000000-0000-0000-0000-000000000000",
"space": "ipam/ip_space/00000000-0000-0000-0000-000000000000",
"state": "used",
"tags": {
"temp": "true"
},
"updated_at": "2025-06-27T13:07:21.429056Z",
"usage": [
"IPAM RESERVED"
]
}
}
}
}
Human Readable Output
Information for the given Bad IP: 0.0.0.1
Threat Intelligence Summary
Batch Id Class Confidence Confidence Score Confidence Score Rating Confidence Score Vector Detected Expiration Extended Id Imported IP Profile Property Received Risk Score Risk Score Rating Risk Score Vector Threat Level Threat Score Threat Score Rating Threat Score Vector Type Up 00000000-0000-0000-0000-000000000000 APT 100 0.1 Unconfirmed simple_confidence_vector 2025-07-29T09:29:18.721Z 2042-11-01T09:29:18.721Z cyberint_guid: simple_cyberint_guid
notes: Malware Download associated with the APT group00000000-0000-0000-0000-000000000000 2025-07-29T09:31:39.329Z 0.0.0.1 IID APT_Malware 2025-07-29T09:31:39.329Z 9.9 Critical simple_risk_vector 100 10 Critical simple_threat_vector IP true Address Information
Address Comment Compartment Id Created At Disable Dhcp External Keys Host Hwaddr Id Interface Names Parent Protocol Range Space State Tags Updated At Usage 0.0.0.1 comment 00000000-0000-0000-0000-000000000000 2025-06-27T13:07:21.476126Z False e3: 3e3 ipam/host/00000000-0000-0000-0000-000000000000 00:00:00:00:00:00 ipam/address/00000000-0000-0000-0000-000000000000 interface - name: name
type: useripam/subnet/00000000-0000-0000-0000-000000000000 ip4 ipam/range/00000000-0000-0000-0000-000000000000 ipam/ip_space/00000000-0000-0000-0000-000000000000 used temp: true 2025-06-27T13:07:21.429056Z values: IPAM RESERVED
domain
Gets the comprehensive domain/host reputation and threat intelligence from Infoblox Threat Defense, including threat indicators, IPAM address information and standard domain reputation data.
Base Command
domain
Input
| Argument Name | Description | Required |
|---|---|---|
| domain | Domain(s) or Hosts(s) for which to retrieve reputation and threat intelligence. Supports comma-separated values. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.Domain.domain | String | The requested domain. |
| Domain.Name | String | The domain name, for example: “google.com”. |
| Domain.Relationships.EntityA | string | The source of the relationship. |
| Domain.Relationships.EntityB | string | The destination of the relationship. |
| Domain.Relationships.Relationship | string | The name of the relationship. |
| Domain.Relationships.EntityAType | string | The type of the source of the relationship. |
| Domain.Relationships.EntityBType | string | The type of the destination of the relationship. |
| Domain.DNS | String | A list of IP objects resolved by DNS. |
| Domain.DetectionEngines | Number | The total number of engines that checked the indicator. |
| Domain.PositiveDetections | Number | The number of engines that positively detected the indicator as malicious. |
| Domain.CreationDate | Date | The date that the domain was created. |
| Domain.UpdatedDate | String | The date that the domain was last updated. |
| Domain.ExpirationDate | Date | The expiration date of the domain. |
| Domain.DomainStatus | Datte | The status of the domain. |
| Domain.NameServers | Unknown | (List<String>) Name servers of the domain. |
| Domain.Organization | String | The organization of the domain. |
| Domain.Subdomains | Unknown | (List<String>) Subdomains of the domain. |
| Domain.Admin.Country | String | The country of the domain administrator. |
| Domain.Admin.Email | String | The email address of the domain administrator. |
| Domain.Admin.Name | String | The name of the domain administrator. |
| Domain.Admin.Phone | String | The phone number of the domain administrator. |
| Domain.Registrant.Country | String | The country of the registrant. |
| Domain.Registrant.Email | String | The email address of the registrant. |
| Domain.Registrant.Name | String | The name of the registrant. |
| Domain.Registrant.Phone | String | The phone number for receiving abuse reports. |
| Domain.Tags | Unknown | (List) Tags of the domain. |
| Domain.FeedRelatedIndicators.value | String | Indicators that are associated with the domain. |
| Domain.FeedRelatedIndicators.type | String | The type of the indicators that are associated with the domain. |
| Domain.FeedRelatedIndicators.description | String | The description of the indicators that are associated with the domain. |
| Domain.MalwareFamily | String | The malware family associated with the domain. |
| Domain.WHOIS.DomainStatus | String | The status of the domain. |
| Domain.WHOIS.NameServers | String | (List<String>) Name servers of the domain. |
| Domain.WHOIS.CreationDate | Date | The date that the domain was created. |
| Domain.WHOIS.UpdatedDate | Date | The date that the domain was last updated. |
| Domain.WHOIS.ExpirationDate | Date | The expiration date of the domain. |
| Domain.WHOIS.Registrant.Name | String | The name of the registrant. |
| Domain.WHOIS.Registrant.Email | String | The email address of the registrant. |
| Domain.WHOIS.Registrant.Phone | String | The phone number of the registrant. |
| Domain.WHOIS.Registrar.Name | String | The name of the registrar. |
| Domain.WHOIS.Registrar.AbuseEmail | String | The email address of the contact for reporting abuse. |
| Domain.WHOIS.Registrar.AbusePhone | String | The phone number of contact for reporting abuse. |
| Domain.WHOIS.Admin.Name | String | The name of the domain administrator. |
| Domain.WHOIS.Admin.Email | String | The email address of the domain administrator. |
| Domain.WHOIS.Admin.Phone | String | The phone number of the domain administrator. |
| Domain.WHOIS/History | String | List of Whois objects. |
| Domain.Malicious.Vendor | String | The vendor reporting the domain as malicious. |
| Domain.Malicious.Description | String | A description explaining why the domain was reported as malicious. |
| Domain.DomainIDNName | String | The internationalized domain name (IDN) of the domain. |
| Domain.Port | String | Ports that are associated with the domain. |
| Domain.Internal | Bool | Whether or not the domain is internal or external. |
| Domain.Category | String | The category associated with the indicator. |
| Domain.Campaign | String | The campaign associated with the domain. |
| Domain.TrafficLightProtocol | String | The Traffic Light Protocol (TLP) color that is suitable for the domain. |
| Domain.ThreatTypes.threatcategory | String | The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc. |
| Domain.ThreatTypes.threatcategoryconfidence | String | Threat Category Confidence is the confidence level provided by the vendor for the threat type category For example a confidence of 90 for threat type category ‘malware’ means that the vendor rates that this is 90% confidence of being a malware. |
| Domain.Geo.Location | String | The geolocation where the domain address is located, in the format: latitude:longitude. |
| Domain.Geo.Country | String | The country in which the domain address is located. |
| Domain.Geo.Description | String | Additional information about the location. |
| Domain.Tech.Country | String | The country of the domain technical contact. |
| Domain.Tech.Name | String | The name of the domain technical contact. |
| Domain.Tech.Organization | String | The organization of the domain technical contact. |
| Domain.Tech.Email | String | The email address of the domain technical contact. |
| Domain.CommunityNotes.note | String | Notes on the domain that were given by the community. |
| Domain.CommunityNotes.timestamp | Date | The time in which the note was published. |
| Domain.Publications.source | String | The source in which the article was published. |
| Domain.Publications.title | String | The name of the article. |
| Domain.Publications.link | String | A link to the original article. |
| Domain.Publications.timestamp | Date | The time in which the article was published. |
| Domain.Billing | String | The billing address of the domain. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| InfobloxCloud.Domain.Threat.id | String | The unique identifier for the threat indicator. |
| InfobloxCloud.Domain.Threat.type | String | The type of threat indicator. |
| InfobloxCloud.Domain.Threat.domain | String | The domain identified as a threat indicator. |
| InfobloxCloud.Domain.Threat.profile | String | The threat profile or classification source. |
| InfobloxCloud.Domain.Threat.property | String | The specific property or category of the threat. |
| InfobloxCloud.Domain.Threat.class | String | The classification of the threat. |
| InfobloxCloud.Domain.Threat.threat_level | Number | The numeric threat level score. |
| InfobloxCloud.Domain.Threat.threat_label | String | The textual threat level label. |
| InfobloxCloud.Domain.Threat.expiration | Date | The timestamp when the threat indicator will expire. |
| InfobloxCloud.Domain.Threat.detected | Date | The timestamp when the threat activity was first detected. |
| InfobloxCloud.Domain.Threat.received | Date | The timestamp when the threat indicator was received by the system. |
| InfobloxCloud.Domain.Threat.imported | Date | The timestamp when the threat indicator was imported into the system. |
| InfobloxCloud.Domain.Threat.up | String | The boolean status flag indicating whether the threat indicator is currently active. |
| InfobloxCloud.Domain.Threat.batch_id | String | The batch ID of the threat indicator. |
| InfobloxCloud.Domain.Threat.confidence | Number | The numeric confidence score representing the reliability of the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.notes | String | The additional notes or information about the threat indicator. |
| InfobloxCloud.Domain.Threat.threat_score | Number | The numeric score representing the calculated threat severity. |
| InfobloxCloud.Domain.Threat.threat_score_rating | String | The textual rating of the threat score. |
| InfobloxCloud.Domain.Threat.threat_score_vector | String | The vector string representing threat scoring details. |
| InfobloxCloud.Domain.Threat.risk_score | Number | The numeric risk score assigned to the threat indicator. |
| InfobloxCloud.Domain.Threat.risk_score_rating | String | The textual rating of the risk score. |
| InfobloxCloud.Domain.Threat.risk_score_vector | String | The vector string representing risk scoring details. |
| InfobloxCloud.Domain.Threat.confidence_score | Number | The numeric confidence score for the threat assessment. |
| InfobloxCloud.Domain.Threat.confidence_score_rating | String | The textual rating of the confidence score. |
| InfobloxCloud.Domain.Threat.confidence_score_vector | String | The vector string representing confidence scoring details. |
| InfobloxCloud.Domain.Threat.extended.cyberint_guid | String | The unique identifier for the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.attack_chain | String | The attack chain associated with the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.extended | String | The additional information or metadata associated with the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.protocol | String | The protocol associated with the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.references | String | The references associated with the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.threat_actor | String | The threat actor associated with the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.threat_actor_vector | String | The vector string representing threat actor details. |
| InfobloxCloud.Domain.Threat.extended.risk_score | String | The numeric risk score assigned to the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.threat_score | String | The numeric threat score assigned to the threat indicator. |
| InfobloxCloud.Domain.Threat.extended.sample_sha256 | String | The SHA-256 hash of the sample associated with the threat. |
| InfobloxCloud.Domain.Threat.extended.original_profile | String | The original profile or classification source of the threat. |
| InfobloxCloud.Domain.Threat.dga | String | The domain name generated by a DGA (Domain Generation Algorithm). |
| InfobloxCloud.Domain.Threat.host | String | The host name of the domain. |
| InfobloxCloud.Domain.Threat.tld | String | The top-level domain (TLD) of the threat. |
| InfobloxCloud.Domain.Address.addresses.address | String | The address of the IP address. |
| InfobloxCloud.Domain.Address.addresses.ref | String | The reference of the IP address. |
| InfobloxCloud.Domain.Address.addresses.space | String | The space of the IP address. |
| InfobloxCloud.Domain.Address.auto_generate_records | Boolean | A boolean flag indicating whether auto generate records is enabled for the IP address. |
| InfobloxCloud.Domain.Address.comment | String | The description for the IPAM host. |
| InfobloxCloud.Domain.Address.created_at | Date | Time when the object has been created. |
| InfobloxCloud.Domain.Address.host_names | Unknown | The name records to be generated for the host. |
| InfobloxCloud.Domain.Address.id | String | The resource identifier. |
| InfobloxCloud.Domain.Address.name | String | The name of the IPAM host. |
| InfobloxCloud.Domain.Address.host_names.alias | Boolean | A boolean flag indicating whether the name record is an alias. |
| InfobloxCloud.Domain.Address.host_names.name | String | The name of the host. |
| InfobloxCloud.Domain.Address.host_names.primary_name | Boolean | A boolean flag indicating whether the name record is the primary name. |
| InfobloxCloud.Domain.Address.host_names.zone | String | The zone of the host. |
| InfobloxCloud.Domain.Address.tags | Unknown | The tags associated with the IP address. |
| InfobloxCloud.Domain.Address.addresses | Unknown | The IP address assigned to the resource. |
Command example
!domain domain=test.com
Context Example
{
"DBotScore": {
"Indicator": "test.com",
"Reliability": "A - Completely reliable",
"Score": 3,
"Type": "domain",
"Vendor": "InfobloxBloxOneThreatDefense"
},
"Domain": {
"Description": "cyber actors, possibly associated with the APT group Agent Serpens, created a fake website mimicking a modeling agency to collect detailed visitor.",
"DetectionEngines": 1,
"Malicious": {
"Description": "cyber actors, possibly associated with the APT group Agent Serpens, created a fake website mimicking a modeling agency to collect detailed visitor.",
"Vendor": "InfobloxThreatDefensewithDDI"
},
"MalwareFamily": "Phishing",
"Name": "test.com",
"Relationships": [
{
"EntityA": "test.com",
"EntityAType": "Domain",
"EntityB": "0.0.0.1",
"EntityBType": "IP",
"Relationship": "resolves-to"
}
],
"Tags": [
"cyberint_guid: simple_cyberint_guid",
"notes: cyber actors, possibly associated with the APT group Agent Serpens, created a fake website mimicking a modeling agency to collect detailed visitor."
],
"ThreatTypes": [
{
"threatcategory": "HOST",
"threatcategoryconfidence": "100"
}
]
},
"InfobloxCloud": {
"Domain": {
"Address": {
"addresses": [
{
"address": "0.0.0.1",
"ref": "ipam/address/00000000-0000-0000-0000-000000000000",
"space": "ipam/ip_space/00000000-0000-0000-0000-000000000000"
}
],
"auto_generate_records": true,
"comment": "comment",
"created_at": "2025-07-22T05:26:46.834693Z",
"host_names": [
{
"alias": false,
"name": "test.com",
"primary_name": true,
"zone": "dns/auth_zone/8ce66502-8d4b-439e-8690-0c59d3122b9f"
}
],
"id": "ipam/host/00000000-0000-0000-0000-000000000000",
"name": "test.com",
"updated_at": "2025-07-22T05:26:57.219235Z"
},
"domain": "test.com",
"Threat": {
"batch_id": "00000000-0000-0000-0000-000000000001",
"class": "Phishing",
"confidence": 100,
"detected": "2025-05-08T16:39:38.959Z",
"dga": "false",
"domain": "test.com",
"expiration": "2025-09-05T16:39:38.959Z",
"extended": {
"cyberint_guid": "simple_cyberint_guid",
"notes": "cyber actors, possibly associated with the APT group Agent Serpens, created a fake website mimicking a modeling agency to collect detailed visitor."
},
"host": "test.com",
"id": "00000000-0000-0000-0000-000000000001",
"imported": "2025-05-08T16:41:37.894Z",
"profile": "IID",
"property": "Phishing_Lookalike",
"received": "2025-05-08T16:41:37.894Z",
"threat_level": 100,
"tld": "com",
"type": "HOST",
"up": "true"
}
}
}
}
Human Readable Output
Information for the given Bad Domain: test.com
Threat Intelligence Summary
Batch Id Class Confidence Detected Dga Domain Expiration Extended Host Id Imported Profile Property Received Threat Level Tld Type Up 00000000-0000-0000-0000-000000000001 Phishing 100 2025-05-08T16:39:38.959Z false test.com 2025-09-05T16:39:38.959Z cyberint_guid: simple_cyberint_guid
notes: cyber actors, possibly associated with the APT group Agent Serpens, created a fake website mimicking a modeling agency to collect detailed visitor.test.com 00000000-0000-0000-0000-000000000001 2025-05-08T16:41:37.894Z IID Phishing_Lookalike 2025-05-08T16:41:37.894Z 100 com HOST true Address Information
Addresses Auto Generate Records Comment Created At Host Names Id Name Updated At - address: 0.0.0.1
ref: ipam/address/00000000-0000-0000-0000-000000000000
space: ipam/ip_space/00000000-0000-0000-0000-000000000000True comment 2025-07-22T05:26:46.834693Z - alias: False
name: test.com
primary_name: True
zone: dns/auth_zone/8ce66502-8d4b-439e-8690-0c59d3122b9fipam/host/00000000-0000-0000-0000-000000000000 test.com 2025-07-22T05:26:57.219235Z
url
Gets the comprehensive URL reputation and threat intelligence from Infoblox Threat Defense, including threat indicators, and standard URL reputation data.
Base Command
url
Input
| Argument Name | Description | Required |
|---|---|---|
| url | URL(s) for which to retrieve reputation and threat intelligence. Supports comma-separated values. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.URL.url | String | The requested URL. |
| URL.Data | String | The URL. |
| URL.Relationships.EntityA | string | The source of the relationship. |
| URL.Relationships.EntityB | string | The destination of the relationship. |
| URL.Relationships.Relationship | string | The name of the relationship. |
| URL.Relationships.EntityAType | string | The type of the source of the relationship. |
| URL.Relationships.EntityBType | string | The type of the destination of the relationship. |
| URL.DetectionEngines | String | The total number of engines that checked the indicator. |
| URL.PositiveDetections | String | The number of engines that positively detected the indicator as malicious. |
| URL.Category | String | The category associated with the indicator. |
| URL.Malicious.Vendor | String | The vendor reporting the URL as malicious. |
| URL.Malicious.Description | String | A description of the malicious URL. |
| URL.Tags | Unknown | (List) Tags of the URL. |
| URL.FeedRelatedIndicators.value | String | Indicators that are associated with the URL. |
| URL.FeedRelatedIndicators.type | String | The type of the indicators that are associated with the URL. |
| URL.FeedRelatedIndicators.description | String | The description of the indicators that are associated with the URL. |
| URL.MalwareFamily | String | The malware family associated with the URL. |
| URL.Port | String | Ports that are associated with the URL. |
| URL.Internal | Bool | Whether or not the URL is internal or external. |
| URL.Campaign | String | The campaign associated with the URL. |
| URL.TrafficLightProtocol | String | The Traffic Light Protocol (TLP) color that is suitable for the URL. |
| URL.ThreatTypes.threatcategory | String | The threat category associated to this indicator by the source vendor. For example, Phishing, Control, TOR, etc. |
| URL.ThreatTypes.threatcategoryconfidence | String | Threat Category Confidence is the confidence level provided by the vendor for the threat type category For example a confidence of 90 for threat type category ‘malware’ means that the vendor rates that this is 90% confidence of being a malware. |
| URL.ASN | String | The autonomous system name for the URL, for example: ‘AS8948’. |
| URL.ASOwner | String | The autonomous system owner of the URL. |
| URL.GeoCountry | String | The country in which the URL is located. |
| URL.Organization | String | The organization of the URL. |
| URL.CommunityNotes.note | String | Notes on the URL that were given by the community. |
| URL.CommunityNotes.timestamp | Date | The time in which the note was published. |
| URL.Publications.source | String | The source in which the article was published. |
| URL.Publications.title | String | The name of the article. |
| URL.Publications.link | String | A link to the original article. |
| URL.Publications.timestamp | Date | The time in which the article was published. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| InfobloxCloud.URL.Threat.id | String | The unique identifier for the threat indicator. |
| InfobloxCloud.URL.Threat.type | String | The type of threat indicator. |
| InfobloxCloud.URL.Threat.url | String | The URL identified as a threat indicator. |
| InfobloxCloud.URL.Threat.profile | String | The threat profile or classification source. |
| InfobloxCloud.URL.Threat.property | String | The specific property or category of the threat. |
| InfobloxCloud.URL.Threat.class | String | The classification of the threat. |
| InfobloxCloud.URL.Threat.threat_level | Number | The numeric threat level score. |
| InfobloxCloud.URL.Threat.threat_label | String | The textual threat level label. |
| InfobloxCloud.URL.Threat.expiration | Date | The timestamp when the threat indicator will expire. |
| InfobloxCloud.URL.Threat.detected | Date | The timestamp when the threat activity was first detected. |
| InfobloxCloud.URL.Threat.received | Date | The timestamp when the threat indicator was received by the system. |
| InfobloxCloud.URL.Threat.imported | Date | The timestamp when the threat indicator was imported into the system. |
| InfobloxCloud.URL.Threat.up | String | The boolean status flag indicating whether the threat indicator is currently active. |
| InfobloxCloud.URL.Threat.batch_id | String | The batch ID of the threat indicator. |
| InfobloxCloud.URL.Threat.confidence | Number | The numeric confidence score representing the reliability of the threat indicator. |
| InfobloxCloud.URL.Threat.extended.notes | String | The additional notes or information about the threat indicator. |
| InfobloxCloud.URL.Threat.threat_score | Number | The numeric score representing the calculated threat severity. |
| InfobloxCloud.URL.Threat.threat_score_rating | String | The textual rating of the threat score. |
| InfobloxCloud.URL.Threat.threat_score_vector | String | The vector string representing threat scoring details. |
| InfobloxCloud.URL.Threat.risk_score | Number | The numeric risk score assigned to the threat indicator. |
| InfobloxCloud.URL.Threat.risk_score_rating | String | The textual rating of the risk score. |
| InfobloxCloud.URL.Threat.risk_score_vector | String | The vector string representing risk scoring details. |
| InfobloxCloud.URL.Threat.confidence_score | Number | The numeric confidence score for the threat assessment. |
| InfobloxCloud.URL.Threat.confidence_score_rating | String | The textual rating of the confidence score. |
| InfobloxCloud.URL.Threat.confidence_score_vector | String | The vector string representing confidence scoring details. |
| InfobloxCloud.URL.Threat.extended.cyberint_guid | String | The unique identifier for the threat indicator. |
| InfobloxCloud.URL.Threat.extended.attack_chain | String | The attack chain associated with the threat indicator. |
| InfobloxCloud.URL.Threat.extended.extended | String | The additional information or metadata associated with the threat indicator. |
| InfobloxCloud.URL.Threat.extended.protocol | String | The protocol associated with the threat indicator. |
| InfobloxCloud.URL.Threat.extended.references | String | The references associated with the threat indicator. |
| InfobloxCloud.URL.Threat.extended.threat_actor | String | The threat actor associated with the threat indicator. |
| InfobloxCloud.URL.Threat.extended.threat_actor_vector | String | The vector string representing threat actor details. |
| InfobloxCloud.URL.Threat.extended.risk_score | String | The numeric risk score assigned to the threat indicator. |
| InfobloxCloud.URL.Threat.extended.threat_score | String | The numeric threat score assigned to the threat indicator. |
| InfobloxCloud.URL.Threat.extended.sample_sha256 | String | The SHA-256 hash of the sample associated with the threat. |
| InfobloxCloud.URL.Threat.extended.original_profile | String | The original profile or classification source of the threat. |
Command example
!url url=https://test.com
Context Example
{
"DBotScore": {
"Indicator": "https://test.com",
"Reliability": "A - Completely reliable",
"Score": 3,
"Type": "url",
"Vendor": "InfobloxBloxOneThreatDefense"
},
"InfobloxCloud": {
"URL": {
"Threat": {
"id": "00000000-0000-0000-0000-000000000001",
"type": "URL",
"host": "test.com",
"url": "https://test.com",
"domain": "test.com",
"tld": "com",
"profile": "IID",
"property": "Scam_Generic",
"class": "Scam",
"threat_level": 100,
"expiration": "2025-10-05T12:12:00.22Z",
"detected": "2025-06-07T12:12:00.22Z",
"received": "2025-06-07T12:16:32.337Z",
"imported": "2025-06-07T12:16:32.337Z",
"up": "true",
"confidence": 100,
"batch_id": "00000000-0000-0000-0000-000000000000",
"extended": {
"cyberint_guid": "simple_cyberint_guid",
"notes": "Scam advertised. Lures victims to put their money into fake investments.",
"protocol": "https",
"references": "https://test.com"
}
},
"url": "https://test.com"
}
},
"URL": {
"Data": "https://test.com",
"Description": "Scam advertised. Lures victims to put their money into fake investments.",
"DetectionEngines": 1,
"Malicious": {
"Description": "Scam advertised. Lures victims to put their money into fake investments.",
"Vendor": "InfobloxThreatDefensewithDDI"
},
"MalwareFamily": "Scam",
"Tags": [
"cyberint_guid: simple_cyberint_guid",
"notes: Scam advertised. Lures victims to put their money into fake investments.",
"protocol: https",
"references: https://test.com"
],
"ThreatTypes": [
{
"threatcategory": "URL",
"threatcategoryconfidence": "100"
}
]
}
}
Human Readable Output
Information for the given Bad URL: https://test.com
Threat Intelligence Summary
Batch Id Class Confidence Detected Domain Expiration Extended Host Id Imported Profile Property Received Threat Level Tld Type Up URL 00000000-0000-0000-0000-000000000000 Scam 100 2025-06-07T12:12:00.22Z test.com 2025-10-05T12:12:00.22Z cyberint_guid: simple_cyberint_guid
notes: Scam advertised. Lures victims to put their money into fake investments.
protocol: https
references: https://test.comtest.com 00000000-0000-0000-0000-000000000001 2025-06-07T12:16:32.337Z IID Scam_Generic 2025-06-07T12:16:32.337Z 100 com URL true https://test.com
infobloxcloud-mac-enrich
Enrich a MAC address with DHCP lease information.
Base Command
infobloxcloud-mac-enrich
Input
| Argument Name | Description | Required |
|---|---|---|
| mac | Specify the MAC Address to enrich. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.DHCPLease.address | String | The IP address assigned in the DHCP lease. |
| InfobloxCloud.DHCPLease.client_id | String | The identifier of the DHCP client. |
| InfobloxCloud.DHCPLease.ends | String | The timestamp indicating when the DHCP lease ends. |
| InfobloxCloud.DHCPLease.fingerprint | String | The DHCP client fingerprint, indicating device type or OS. |
| InfobloxCloud.DHCPLease.fingerprint_processed | String | The processed fingerprint result, if available. |
| InfobloxCloud.DHCPLease.ha_group | Unknown | The high-availability group associated with the lease, if any. |
| InfobloxCloud.DHCPLease.hardware | String | The hardware (MAC) address of the DHCP client. |
| InfobloxCloud.DHCPLease.host | String | The reference or identifier for the host associated with this lease. |
| InfobloxCloud.DHCPLease.hostname | String | The hostname provided by the DHCP client. |
| InfobloxCloud.DHCPLease.iaid | Number | The Identity Association Identifier (IAID) for the DHCP lease. |
| InfobloxCloud.DHCPLease.last_updated | String | The timestamp when the lease was last updated. |
| InfobloxCloud.DHCPLease.options | String | The encoded DHCP options provided with the lease. |
| InfobloxCloud.DHCPLease.preferred_lifetime | String | The preferred lifetime of the lease. |
| InfobloxCloud.DHCPLease.protocol | String | The protocol used for the lease. |
| InfobloxCloud.DHCPLease.space | String | The identifier for the IP space to which this lease belongs. |
| InfobloxCloud.DHCPLease.starts | String | The timestamp indicating when the DHCP lease started. |
| InfobloxCloud.DHCPLease.state | String | The current state of the lease. |
| InfobloxCloud.DHCPLease.type | String | The type of DHCP lease. |
Command example
!infobloxcloud-mac-enrich mac="00:00:00:00:00:01"
Context Example
{
"InfobloxCloud": {
"DHCPLease": {
"address": "0.0.0.1",
"client_id": "01:00:00:00:00:00:01",
"ends": "2025-07-01T19:25:24Z",
"fingerprint": "VMware:Virtual Machine:Windows:",
"fingerprint_processed": "processed",
"hardware": "00:00:00:00:00:01",
"host": "dhcp/host/123456",
"hostname": "test-host01",
"iaid": 0,
"last_updated": "2025-07-01T18:25:24.792Z",
"options": "{\"Options\":[{\"Code\":\"57\",\"Value\":\"test\"},{\"Code\":\"61\",\"Value\":\"sample\"},{\"Code\":\"53\",\"Value\":\"world\"},{\"Code\":\"55\",\"Value\":\"bar\"}]}",
"preferred_lifetime": "2025-07-01T18:25:24Z",
"protocol": "",
"space": "ipam/ip_space/12345678-1234-1234-1234-123456789012",
"starts": "2025-07-01T18:25:24Z",
"state": "used",
"type": "DHCPv4"
}
}
}
Human Readable Output
DHCP Lease Information for MAC: 00:00:00:00:00:01
Address Client Id Ends Fingerprint Fingerprint Processed Hardware Host Hostname Iaid Last Updated Options Preferred Lifetime Space Starts State Type 0.0.0.1 01:00:00:00:00:00:01 2025-07-01T19:25:24Z VMware:Virtual Machine:Windows: processed 00:00:00:00:00:01 dhcp/host/123456 test-host01 0 2025-07-01T18:25:24.792Z - Code: 57
Value: test
- Code: 61
Value: sample
- Code: 53
Value: world
- Code: 55
Value: bar2025-07-01T18:25:24Z ipam/ip_space/12345678-1234-1234-1234-123456789012 2025-07-01T18:25:24Z used DHCPv4
infobloxcloud-soc-insight-list
List SOC Insights from Infoblox Cloud.
Base Command
infobloxcloud-soc-insight-list
Input
| Argument Name | Description | Required |
|---|---|---|
| status | Specify the status of SOC Insights to fetch. Possible values are: Active, Closed. | Optional |
| threat_type | Specify the threat type of SOC Insights to fetch. Possible values are: DGA, Undefined, Malicious, Open Resolver, Phishing, DNS Tunneling, MalwareDownload, Sinkhole, Zero Day DNS, Notional Data Exfiltration, MalwareC2DGA, MalwareC2, Restricted Country Communications, Suspicious, CompromisedHost, CompromisedDomain, Lookalike Threat, Sanctioned Feed Disabled, DNSTunnel. | Optional |
| priority | Specify the priority level of SOC Insights to fetch. Possible values are: INFO, MEDIUM, HIGH, CRITICAL. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.SOCInsight.insightId | String | The ID of the SOC Insight. |
| InfobloxCloud.SOCInsight.priorityText | String | The priority level of the SOC Insight. |
| InfobloxCloud.SOCInsight.tClass | String | The threat class of the SOC Insight. |
| InfobloxCloud.SOCInsight.tFamily | String | The threat family of the SOC Insight. |
| InfobloxCloud.SOCInsight.startedAt | String | The start time of the SOC Insight. |
| InfobloxCloud.SOCInsight.status | String | The status of the SOC Insight. |
| InfobloxCloud.SOCInsight.persistentDate | String | Timestamp when the threat was first observed as persistent. |
| InfobloxCloud.SOCInsight.spreadingDate | String | Timestamp when the threat was first observed as spreading. |
| InfobloxCloud.SOCInsight.dateChanged | String | Timestamp when the SOC Insight was last updated. |
| InfobloxCloud.SOCInsight.changer | String | The user or process that last changed the SOC Insight status or data. |
| InfobloxCloud.SOCInsight.feedSource | String | The source feed or provider of the SOC Insight. |
| InfobloxCloud.SOCInsight.threatType | String | The threat type of the SOC Insight. |
| InfobloxCloud.SOCInsight.numEvents | String | The number of events associated with the SOC Insight. |
| InfobloxCloud.SOCInsight.eventsNotBlockedCount | String | The number of events not blocked by the SOC Insight. |
| InfobloxCloud.SOCInsight.mostRecentAt | String | The most recent time the SOC Insight was updated. |
Command example
#### Context Example
```json
{
"InfobloxCloud": {
"SOCInsight": [
{
"changer": "abc@xyz.com",
"dateChanged": "2025-05-21T00:54:49.407214Z",
"eventsBlockedCount": "3",
"feedSource": "Insight Detection Framework",
"insightId": "00000000-0000-0000-0000-000000000000",
"mostRecentAt": "2025-07-19T19:25:11.723397Z",
"numEvents": "3",
"persistentDate": "2025-04-14T07:00:00Z",
"priorityText": "HIGH",
"spreadingDate": "2025-05-10T19:00:00Z",
"startedAt": "2025-04-14T07:00:00Z",
"status": "Active",
"tClass": "Suspicious",
"tFamily": "EmergentDomain",
"threatType": "Suspicious"
},
{
"tClass": "TI-RESTRICTED",
"tFamily": "OFAC",
"insightId": "00000000-0000-0000-0000-000000000001",
"feedSource": "Insight Detection Framework",
"startedAt": "2025-04-12T18:00:00Z",
"threatType": "Sanctioned Feed Disabled",
"status": "Active",
"persistentDate": "2025-04-12T15:00:00Z",
"numEvents": "246",
"mostRecentAt": "2025-08-07T23:59:19Z",
"eventsNotBlockedCount": "246",
"changer": "abc@xyz.com",
"dateChanged": "2025-08-06T13:58:01.050800Z",
"priorityText": "INFO"
}
]
}
}
Human Readable Output
SOC Insights
ID Priority Class Threat Type Status Threat Family Feed Source Most Recent At 00000000-0000-0000-0000-000000000000 HIGH Suspicious Suspicious Active EmergentDomain Insight Detection Framework 2025-07-19T19:25:11.723397Z 00000000-0000-0000-0000-000000000001 INFO TI-RESTRICTED Sanctioned Feed Disabled Active OFAC Insight Detection Framework 2025-08-07T23:59:19Z
infobloxcloud-soc-insight-event-list
List events for a specific SOC Insight.
Base Command
infobloxcloud-soc-insight-event-list
Input
| Argument Name | Description | Required |
|---|---|---|
| soc_insight_id | Specify the SOC Insight ID to fetch events for. | Required |
| limit | Specify the maximum number of events to fetch. Default is 50. | Optional |
| start_time | Specify the start time for the events. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| end_time | Specify the end time for the events. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| threat_level | Specify the threat level of the events. Possible values are: High, Medium, Low, Info. | Optional |
| confidence_level | Specify the confidence level of the events. Possible values are: High, Medium, Low, Info. | Optional |
| query | Specify the query to search for events. | Optional |
| query_type | Specify the query type to search for events. Possible values are: A, AAAA, ANY, TXT, RRSIG, CNAME, MX, NS, PTR, SOA, SRV. | Optional |
| source | Specify the source of the events. | Optional |
| device_ip | Specify the device IP of the events. | Optional |
| indicator | Specify the indicator of the events. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.Event.confidenceLevel | String | The confidence level of the threat detection. |
| InfobloxCloud.Event.deviceCountry | String | The country where the device is located. |
| InfobloxCloud.Event.deviceName | String | The name or identifier of the device. |
| InfobloxCloud.Event.deviceRegion | String | The region where the device is located. |
| InfobloxCloud.Event.dnsView | String | The DNS view used for the query. |
| InfobloxCloud.Event.feed | String | The feed that identified the threat. |
| InfobloxCloud.Event.source | String | The source of the threat detection. |
| InfobloxCloud.Event.action | String | The action taken on the detected threat. |
| InfobloxCloud.Event.policy | String | The policy applied to the detection. |
| InfobloxCloud.Event.deviceIp | String | The IP address of the device. |
| InfobloxCloud.Event.query | String | The DNS query that triggered the detection. |
| InfobloxCloud.Event.queryType | String | The type of DNS query. |
| InfobloxCloud.Event.response | String | The DNS response for the query. |
| InfobloxCloud.Event.class | String | The classification of the threat. |
| InfobloxCloud.Event.threatFamily | String | The family of the threat. |
| InfobloxCloud.Event.threatIndicator | String | The indicator of the threat. |
| InfobloxCloud.Event.detected | String | The timestamp when the event was detected. |
| InfobloxCloud.Event.property | String | The property of the event. |
| InfobloxCloud.Event.user | String | The user associated with the detection. |
| InfobloxCloud.Event.threatLevel | String | The severity level of the event. |
Command example
!infobloxcloud-soc-insight-event-list soc_insight_id="00000000-0000-0000-0000-000000000000"
Context Example
{
"InfobloxCloud": {
"Event": [
{
"action": "Allow - No Log",
"class": "TI-CONFIGURATIONISSUE",
"confidenceLevel": "High",
"detected": "2025-08-11 23:42:04 +0000 UTC",
"deviceIp": "0.0.0.0",
"deviceName": "0.0.0.0",
"policy": "DoH",
"property": "example.com",
"query": "example.com",
"queryType": "A",
"source": "unknown",
"threatFamily": "OPENRESOLVER",
"threatLevel": "Low",
"user": "unknown"
},
{
"action": "Block",
"class": "Suspicious",
"confidenceLevel": "High",
"detected": "2025-07-16 07:37:29 +0000 UTC",
"deviceIp": "0.0.0.1",
"deviceName": "0.0.0.1",
"policy": "Default Policy",
"property": "EmergentDomain",
"query": "example.org",
"queryType": "RRSIG",
"source": "Endpoint",
"threatFamily": "EmergentDomain",
"threatLevel": "High",
"user": "unknown"
}
]
}
}
Human Readable Output
Events for the given SOC Insight: 00000000-0000-0000-0000-000000000000
Confidence Level Threat Level Threat Family Action Class Detected High Low OPENRESOLVER Allow - No Log TI-CONFIGURATIONISSUE 2025-08-11 23:42:04 +0000 UTC High High EmergentDomain Block Suspicious 2025-07-16 07:37:29 +0000 UTC
infobloxcloud-soc-insight-indicator-list
List indicators for a specific SOC Insight.
Base Command
infobloxcloud-soc-insight-indicator-list
Input
| Argument Name | Description | Required |
|---|---|---|
| soc_insight_id | Specify the SOC Insight ID to fetch indicators for. | Required |
| limit | Specify the maximum number of indicators to fetch. Default is 50. | Optional |
| start_time | Specify the start time for the indicators. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| end_time | Specify the end time for the indicators. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| confidence | Specify the confidence of the indicators. Possible values are: 1, 2, 3. | Optional |
| indicator | Specify the indicator of the indicators. | Optional |
| action | Specify the action of the indicators. Possible values are: Blocked, Not Blocked. | Optional |
| actor | Specify the actor of the indicators. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.Indicator.action | String | The action taken for the indicator. |
| InfobloxCloud.Indicator.confidence | String | The confidence level of the indicator. |
| InfobloxCloud.Indicator.count | Number | The number of occurrences of the indicator. |
| InfobloxCloud.Indicator.feedName | String | The feed name that identified the indicator. |
| InfobloxCloud.Indicator.threatLevelMax | String | The maximum threat level associated with the indicator. |
| InfobloxCloud.Indicator.indicator | String | The value of the indicator. |
| InfobloxCloud.Indicator.timeMax | Date | The latest time the indicator was observed. |
| InfobloxCloud.Indicator.timeMin | Date | The earliest time the indicator was observed. |
Command example
!infobloxcloud-soc-insight-indicator-list soc_insight_id="00000000-0000-0000-0000-000000000000"
Context Example
{
"InfobloxCloud": {
"Indicator": [
{
"action": "Not Blocked",
"confidence": "3",
"count": 189,
"indicator": "example.org",
"threatLevelMax": "1",
"timeMax": "2025-08-11T23:00:00.000",
"timeMin": "2025-07-13T15:00:00.000"
},
{
"action": "Blocked",
"confidence": "1",
"count": 5,
"indicator": "example.com",
"threatLevelMax": "3",
"timeMax": "2025-08-11T12:00:00.000",
"timeMin": "2025-07-14T10:00:00.000"
}
]
}
}
Human Readable Output
Indicators for the given SOC Insight: 00000000-0000-0000-0000-000000000000
Action Confidence Max Threat Level Indicator Count Max Time Min Time Not Blocked 3 1 example.org 189 2025-08-11T23:00:00.000 2025-07-13T15:00:00.000 Blocked 1 3 example.com 5 2025-08-11T12:00:00.000 2025-07-14T10:00:00.000
infobloxcloud-soc-insight-asset-list
List assets for a specific SOC Insight.
Base Command
infobloxcloud-soc-insight-asset-list
Input
| Argument Name | Description | Required |
|---|---|---|
| soc_insight_id | Specify the SOC Insight ID to fetch assets for. | Required |
| limit | Specify the maximum number of assets to fetch. Default is 50. | Optional |
| start_time | Specify the start time for the assets. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| end_time | Specify the end time for the assets. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| qip | Specify the IP address of the assets. | Optional |
| cmac | Specify the MAC address of the assets. | Optional |
| os_version | Specify the OS version of the assets. | Optional |
| user | Specify the user of the assets. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.Asset.count | Number | The number of occurrences associated with the asset. |
| InfobloxCloud.Asset.qip | String | The IP address of the asset. |
| InfobloxCloud.Asset.location | String | The geographical location of the asset. |
| InfobloxCloud.Asset.threatLevelMax | String | The maximum threat level associated with the asset. |
| InfobloxCloud.Asset.threatIndicatorDistinctCount | String | The number of distinct threat indicators associated with the asset. |
| InfobloxCloud.Asset.timeMax | Date | The latest time the asset was observed. |
| InfobloxCloud.Asset.timeMin | Date | The earliest time the asset was observed. |
| InfobloxCloud.Asset.mostRecentAction | String | The most recent action taken for the asset. |
Command example
!infobloxcloud-soc-insight-asset-list soc_insight_id="00000000-0000-0000-0000-000000000000"
Context Example
{
"InfobloxCloud": {
"Asset": [
{
"count": 5,
"location": "Leidschendam,Netherlands",
"mostRecentAction": "Not Blocked",
"qip": "0.0.0.0",
"threatIndicatorDistinctCount": "1",
"threatLevelMax": "1",
"timeMax": "2025-08-11T12:00:00.000",
"timeMin": "2025-07-14T10:00:00.000"
},
{
"count": 1,
"location": "Minneapolis,United States",
"mostRecentAction": "Not Blocked",
"qip": "0.0.0.1",
"threatIndicatorDistinctCount": "1",
"threatLevelMax": "1",
"timeMax": "2025-08-07T12:00:00.000",
"timeMin": "2025-08-07T12:00:00.000"
}
]
}
}
Human Readable Output
Assets for the given SOC Insight: 00000000-0000-0000-0000-000000000000
Count QIP Max Threat Level Location Threat Indicator Distinct Count Time Max Time Min Most Recent Action 5 0.0.0.0 1 Leidschendam,Netherlands 1 2025-08-11T12:00:00.000 2025-07-14T10:00:00.000 Not Blocked 1 0.0.0.1 1 Minneapolis,United States 1 2025-08-07T12:00:00.000 2025-08-07T12:00:00.000 Not Blocked
infobloxcloud-soc-insight-comment-list
List comments for a specific SOC Insight.
Base Command
infobloxcloud-soc-insight-comment-list
Input
| Argument Name | Description | Required |
|---|---|---|
| soc_insight_id | Specify the SOC Insight ID to fetch comments for. | Required |
| start_time | Specify the start time for the comments. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| end_time | Specify the end time for the comments. Format: YYYY-MM-DDTHH:MM:SSZ, YYYY-MM-DD, N days, N hours. Example: 2025-04-25T00:00:00Z, 2025-04-25, 2 days, 5 hours, 01 Mar 2025, 01 Feb 2025 04:45:33, 15 Jun. |
Optional |
| limit | Specify the maximum number of comments to fetch. Default is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| InfobloxCloud.Comment.commentsChanger | String | The user who created or changed the comment. |
| InfobloxCloud.Comment.dateChanged | Date | The timestamp when the comment was created or modified. |
| InfobloxCloud.Comment.status | String | The status associated with the comment. |
| InfobloxCloud.Comment.newComment | String | The comment text. |
Command example
!infobloxcloud-soc-insight-comment-list soc_insight_id="00000000-0000-0000-0000-000000000000"
Context Example
{
"InfobloxCloud": {
"Comment": [
{
"commentsChanger": "abc.zyx.com",
"dateChanged": "2025-08-02T08:39:43.675",
"newComment": "\nAsset IP: 0.0.0.0\nScan ID: None\nReference ID: None\nQualys Scan Report URL: https://example.com/fo/report/report_view.php?&id=None\n",
"status": "Active"
},
{
"commentsChanger": "abc.zyx.com",
"dateChanged": "2025-07-15T05:24:29.803",
"newComment": "\nAsset IP: 0.0.0.0\nScan ID: None\nReference ID: None\nQualys Scan Report URL: https://example.com/fo/report/report_view.php?&id=None\n",
"status": "Active"
}
]
}
}
Human Readable Output
Comments for the given SOC Insight: 00000000-0000-0000-0000-000000000000
Comment Changer Date Changed Status Comment abc.zyx.com 2025-08-02T08:39:43.675 Active
Asset IP: 0.0.0.0
Scan ID: None
Reference ID: None
Qualys Scan Report URL: https://example.com/fo/report/report_view.php?&id=Noneabc.zyx.com 2025-07-15T05:24:29.803 Active
Asset IP: 0.0.0.0
Scan ID: None
Reference ID: None
Qualys Scan Report URL: https://example.com/fo/report/report_view.php?&id=None
Configuration parameters
credentials— (required)integrationReliability— Source Reliabilitycreate_relationships— Create relationshipsisFetch— Fetch incidentsincidentType— Incident typeingestion_type— Ingestion Typesoc_insight_status— SOC Insight Statussoc_insight_threat_type— SOC Insight Threat Typesoc_insight_priority_level— SOC Insight Priority Leveldns_events_feed_name— DNS Security Event Feed Namedns_events_network— DNS Security Event Networkdns_events_policy_action— DNS Security Event Policy Actiondns_events_policy_name— DNS Security Event Policy Namedns_events_queried_name— DNS Security Event Queried Namedns_events_threat_class— DNS Security Event Threat Classdns_events_threat_family— DNS Security Event Threat Familydns_events_threat_indicator— DNS Security Event Threat Indicatordns_events_threat_level— DNS Security Event Threat Levelmax_fetch— Max Fetchfirst_fetch— First fetch timestampincidentFetchInterval— Incidents Fetch Intervalinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (17)
-
bloxone-td-dossier-lookup-getThe Dossier Lookup API returns detailed information on the specified indicator from the requested sources.
-
bloxone-td-dossier-source-listGet available Dossier sources.
-
bloxone-td-lookalike-domain-listGet lookalike domain lists.
-
domainGets the comprehensive domain/host reputation and threat intelligence from Infoblox Threat Defense, including threat indicators, IPAM address information and standard domain reputation data.
-
infobloxcloud-block-domainThe given domains will be added to the provided block list.
-
infobloxcloud-block-ipThe given IP addresses will be added to the provided block list.
-
infobloxcloud-customlist-indicator-removeThe given indicators will be removed from the provided custom list.
-
infobloxcloud-mac-enrichEnrich a MAC address with DHCP lease information.
-
infobloxcloud-soc-insight-asset-listList assets for a specific SOC Insight.
-
infobloxcloud-soc-insight-comment-listList comments for a specific SOC Insight.
-
infobloxcloud-soc-insight-event-listList events for a specific SOC Insight.
-
infobloxcloud-soc-insight-indicator-listList indicators for a specific SOC Insight.
-
infobloxcloud-soc-insight-listList SOC Insights from Infoblox Cloud.
-
infobloxcloud-unblock-domainThe given domains will be added to the provided allow list.
-
infobloxcloud-unblock-ipThe given IP addresses will be added to the provided allow list.
-
ipGets the comprehensive IP reputation and threat intelligence from Infoblox Threat Defense, including threat indicators, IPAM address information, and standard IP reputation data.
-
urlGets the comprehensive URL reputation and threat intelligence from Infoblox Threat Defense, including threat indicators, and standard URL reputation data.
## Infoblox Threat Defense with DDI Help ### Creating Service API Key You can create multiple service API keys that are associated with respective service API keys for specific purposes. You must have the required permission to create service API keys. For information, see [Configuring Service API Key](https://docs.infoblox.com/space/BloxOneCloud/35430173). To create a service API key, complete the following: 1. From the SSO portal, click **User Access** from the left navigation panel and then click the **Service API Keys** tab. 2. On the Service API Keys tab, click **Create**. 3. In the Create Service API Keys dialog, complete the following: - **Name**: Enter the name of the user API key. Use a name that can identify the purpose of the key. - **Service User**: Enter the name of the service users or choose one from the drop-down list. You can associate up to 10 service API keys per service user. - **Expires at**: Click the calendar icon to select a date and time when the service API key should expire. This date determines the duration of key validity. 4. Click **Save & Close** to save the configuration. The new service API key is generated. 5. In the API Access Key Generated dialog, click **Copy** to copy the key and save it in a place where you can locate the key in the future. ### Instance Configuration 1. Configure an integration instance with a valid Service API Key. 2. Click **Test** to validate the connection. 3. To fetch Infoblox SOC Insights or DNS Security Events as an incidents in XSOAR, select the option `Fetches incidents` and follow the table to update configuration parameters. | **Parameter** | **Description** | |-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------| | Classifier | Select "Infoblox Cloud - Classifier" | | Incident type | Select "N/A" | | Mapper (incoming) | Select "Infoblox Cloud - Incoming Mapper" | | Service API Key | The Service API Key required to connect to Infoblox Cloud. | | Source Reliability | The reliability of the source providing the intelligence data. | | Create relationships | Creates relationships between indicators as part of Enrichment. | | Ingestion Type | Select the ingestion type to fetch as XSOAR incident. Default is SOC Insight. | | SOC Insight Status | Retrieve the SOC Insights as specified status. | | SOC Insight Threat Type | Retrieve the SOC Insights as specified threat type. | | SOC Insight Priority Level | Retrieve the SOC Insights as specified priority level. | | DNS Security Event Feed Name | Retrieve the DNS Security Events as specified feed name or custom list name. | | DNS Security Event Network | Retrieve the DNS Security Events as specified network name. | | DNS Security Event Policy Action | Retrieve the DNS Security Events as specified policy action. | | DNS Security Event Policy Name | Retrieve the DNS Security Events as specified policy name. | | DNS Security Event Queried Name | Retrieve the DNS Security Events as specified queried name. | | DNS Security Event Threat Class | Retrieve the DNS Security Events as specified threat class. | | DNS Security Event Threat Family | Retrieve the DNS Security Events as specified threat family. | | DNS Security Event Threat Indicator | Retrieve the DNS Security Events as specified threat indicator. | | DNS Security Event Threat Level | Retrieve the DNS Security Events as specified threat level. | | Max Fetch | The maximum number of incidents to fetch each time. If the value is greater than 200, it will be considered as 200. The maximum is 200. | | First fetch timestamp | The date or relative timestamp from which to begin fetching incidents. Note: This parameter is only applicable for DNS Security Events. | | Trust any certificate (not secure) | Indicates whether to allow connections without verifying the SSL certificate's validity. | | Use system proxy settings | Indicates whether to use XSOAR's system proxy settings to connect to the API. | | Incidents Fetch Interval | The incident fetch interval. | ### Support - For technical support or troubleshooting, please contact Infoblox Support at [https://www.infoblox.com/support/](https://www.infoblox.com/support/) - For documentation and resources, visit [https://docs.infoblox.com/](https://docs.infoblox.com/) ### Contact - For more information about Infoblox Threat Defense with DDI, visit [https://info.infoblox.com/contact-form/](https://info.infoblox.com/contact-form/) ### Notice - Submitting indicators using the **bloxone-td-lookalike-domain-list** command of this integration might make the indicator data publicly available. See the vendor’s documentation for more details.