Infoblox Threat Defense with DDI v2.0.3

Utilize the Infoblox Threat Defense with DDI integration to manage SOC Insight incident response, indicator enrichment, and block cyber threats.

Author:
Infoblox Inc.
Support:
partner
URL:
https://support.infoblox.com/
Default data source:
InfobloxBloxOneThreatDefense
agentixxsiam
Data Enrichment & Threat Intelligence

Classifiers (2)

Incident fields (37)

Incident types (2)

Integrations (2)

Layouts (2)

Modeling rules (1)

Playbooks (8)

README

Note: Support for this Pack was moved to Partner starting August 25, 2025. In case of any issues arise, please contact the Partner directly at support@infoblox.com or https://support.infoblox.com/.

The Infoblox Threat Defense with DDI integration leverages DNS as a security control point to detect and block cyber threats. This integration enables threat intelligence sharing, automated SOC Insight incident response, automated indicator enrichment, and DNS-based security controls within your Cortex XSOAR environment.

DNS Security

  • Protects the network at the DNS level, which is often the very first point of contact for cyberattacks, ensuring that threats are intercepted and mitigated before they can progress deeper into the infrastructure.
  • Blocks and unblocks malicious domains and IP addresses by preventing access to harmful destinations while allowing administrators to manage and maintain control over legitimate network usage.

Threat Intelligence

  • Provides SOC teams with actionable SOC Insights with detailed information about indicators, events, assets, and analyst comments, to detect, investigate, and respond to threats more effectively.
  • Provides visibility into indicators of compromise (IoCs) and enriches them with context for faster investigation.

DDI

  • Tightly integrates security with DNS, DHCP, and IPAM, turning these core network services into enforcement points where malicious activity can be detected and blocked in real time.

Pack Use-cases

  • Retrieve comprehensive threat intelligence about domains, hosts, and IP addresses.
  • Detect and block malicious domains and IP addresses using the Threat Defense platform.
  • Identify lookalike domains that may indicate potential phishing attempts.
  • Manage custom security lists for blocking or allowing specific domains and IP addresses.
  • Automate threat response by integrating with existing security workflows.
  • Enrich indicators with DNS-based threat intelligence data for better security decisions.
  • Unblock previously blocked indicators when they are no longer considered malicious.

Support

Contact