Infoblox Threat Defense with DDI (v2.0.4)
Utilize the Infoblox Threat Defense with DDI integration to manage SOC Insight incident response, indicator enrichment, and block cyber threats.
- Author
- Infoblox Inc.
- Support
- partner
- URL
- https://support.infoblox.com/
- Default data source
- InfobloxBloxOneThreatDefense
- Categories
- Data Enrichment & Threat Intelligence
Incident fields (37)
- Infoblox Cloud Application Category
- Infoblox Cloud Application Name
- Infoblox Cloud Category
- Infoblox Cloud Confidence
- Infoblox Cloud DHCP Fingerprint
- Infoblox Cloud DNS View
- Infoblox Cloud Endpoint Groups
- Infoblox Cloud Event Count
- Infoblox Cloud Event Not Blocked Count
- Infoblox Cloud Event Time
- Infoblox Cloud Feed Name
- Infoblox Cloud Feed Source
- Infoblox Cloud Feed Type
- Infoblox Cloud Insight Changed Time
- Infoblox Cloud Insight ID
- Infoblox Cloud Insight Most Recent Time
- Infoblox Cloud Insight Persistent Time
- Infoblox Cloud Insight Priority
- Infoblox Cloud Insight Spreading Time
- Infoblox Cloud Insight Start Time
- Infoblox Cloud Insight Status
- Infoblox Cloud Network
- Infoblox Cloud Private IP
- Infoblox Cloud QIP
- Infoblox Cloud QNAME
- Infoblox Cloud QTYPE
- Infoblox Cloud RCODE
- Infoblox Cloud RDATA
- Infoblox Cloud RIP
- Infoblox Cloud Severity
- Infoblox Cloud Threat Class
- Infoblox Cloud Threat Family
- Infoblox Cloud Threat Indicator
- Infoblox Cloud Threat Property
- Infoblox Cloud Threat Type
- Infoblox Cloud User
- Infoblox Cloud User Groups
Integrations (2)
- Infoblox BloxOne Threat Defense Event Collector
- Infoblox Threat Defense with DDI
Layouts (2)
- Infoblox Cloud DNS Security Event
- Infoblox Cloud SOC Insight
Modeling rules (1)
- Infoblox Blox One Threat Defense Modeling Rule
Playbooks (8)
- Block Indicator - Infoblox Cloud
- Domain Enrichment - Infoblox Cloud
- IP Enrichment - Infoblox Cloud
- Incident Response - Infoblox Cloud
- Indicator Enrichment - Infoblox Cloud
- MAC Enrichment - Infoblox Cloud
- URL Enrichment - Infoblox Cloud
- Unblock Indicator - Infoblox Cloud
README
Note: Support for this Pack was moved to Partner starting August 25, 2025. In case of any issues arise, please contact the Partner directly at support@infoblox.com or https://support.infoblox.com/.
The Infoblox Threat Defense with DDI integration leverages DNS as a security control point to detect and block cyber threats. This integration enables threat intelligence sharing, automated SOC Insight incident response, automated indicator enrichment, and DNS-based security controls within your Cortex XSOAR environment.
DNS Security
- Protects the network at the DNS level, which is often the very first point of contact for cyberattacks, ensuring that threats are intercepted and mitigated before they can progress deeper into the infrastructure.
- Blocks and unblocks malicious domains and IP addresses by preventing access to harmful destinations while allowing administrators to manage and maintain control over legitimate network usage.
Threat Intelligence
- Provides SOC teams with actionable SOC Insights with detailed information about indicators, events, assets, and analyst comments, to detect, investigate, and respond to threats more effectively.
- Provides visibility into indicators of compromise (IoCs) and enriches them with context for faster investigation.
DDI
- Tightly integrates security with DNS, DHCP, and IPAM, turning these core network services into enforcement points where malicious activity can be detected and blocked in real time.
Pack Use-cases
- Retrieve comprehensive threat intelligence about domains, hosts, and IP addresses.
- Detect and block malicious domains and IP addresses using the Threat Defense platform.
- Identify lookalike domains that may indicate potential phishing attempts.
- Manage custom security lists for blocking or allowing specific domains and IP addresses.
- Automate threat response by integrating with existing security workflows.
- Enrich indicators with DNS-based threat intelligence data for better security decisions.
- Unblock previously blocked indicators when they are no longer considered malicious.
Support
- For technical support or troubleshooting, please contact Infoblox Support at https://www.infoblox.com/support/
- For documentation and resources, visit https://docs.infoblox.com/
Contact
- For more information about Infoblox Threat Defense with DDI, visit https://info.infoblox.com/contact-form/