Infoblox Threat Defense
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Observability
Preview
Preview
Serverless Security
Preview
Preview
Stack
Preview
9.0+
Preview since 9.0
| Version | 0.1.0 Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. (View all) |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Elastic |
| Ingestion method(s) | Network Protocol |
| Minimum Kibana version(s) | 9.0.0 8.18.0 |
To use pre-release integrations, go to the Integrations page in Kibana, scroll down, and toggle on the Display beta integrations option.
Infoblox Threat Defense is a DNS-based security solution that protects networks from cyber threats by detecting and blocking malicious domain activity in real time. It uses threat intelligence, DNS firewalling, and behavioral analytics to identify threats like malware, phishing, and data exfiltration at the DNS layer — often before they reach endpoints or firewalls. Available as a cloud-native platform (BloxOne Threat Defense), it integrates with security tools (like SIEMs and firewalls) and supports both on-prem and hybrid deployments.
This integration supports CEF-formatted logs transmitted through a syslog server over TCP, UDP, or TLS protocols.
The Infoblox Threat Defense integration collects the following types of events.
Audit: - The audit log reports all administrative activities performed by specific user accounts.
Service: - The Service Log reports all service events.
Atlas Notifications: - Atlas Notifications reports all internal notification events.
SOC Insights: - The SOC Insights log reports information about SOC Insights security events.
Threat Defense Query/Response (TD DNS): - The Threat Defense Query/Response Log reports DNS query requests and responses in Infoblox Threat Defense.
Threat Defense Threat Feeds Hit (TD RPZ): - The Threat Defense Threat Feeds Hit Log reports Infoblox Threat Defense feeds hit information.
DDI DHCP Lease (DDI DHCP): - The DDI DHCP Lease Log reports information about Dynamic Host Configuration Protocol (DHCP) lease assignments and terminations.
DDI Query/Response (DDI DNS): - The DDI Query/Response Log reports DNS query requests and responses in Universal DDI.
While the Infoblox Threat Defense integration collects logs for various event types, we have consolidated them into a single data stream named event.
Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions.
- To collect logs through the syslog server, you need to deploy a Data Connector VM by following the instructions provided here.
- Once the Data Connector is successfully deployed, you need to configure the traffic flow to forward logs to your syslog server. Refer to this link for guidance.
- In Kibana navigate to Management > Integrations.
- In "Search for integrations" top bar, search for
Infoblox Threat Defense. - Select "Infoblox Threat Defense" integration from the search results.
- Click on the "Add Infoblox Threat Defense" button to add the integration.
- Enable the data collection mode from the following: TCP, or UDP.
- Add all the required configuration parameters, such as listen address and listen port for the TCP and UDP, and ssl for the TLS.
- Click on "Save and Continue" to save the integration.
This is the Event dataset.
The InfobloxDHCPOptions field will not be populated because it contains a special pattern with special characters that decode_cef cannot parse. As a result, this field will be dropped.
Example
{
"@timestamp": "2021-03-03T11:57:45.000Z",
"agent": {
"ephemeral_id": "51dcb43b-622f-429e-883b-0c83aeadf1ff",
"id": "9c56e688-154e-40f0-a189-cd993c9bad5a",
"name": "elastic-agent-38377",
"type": "filebeat",
"version": "8.18.0"
},
"data_stream": {
"dataset": "infoblox_threat_defense.event",
"namespace": "55748",
"type": "logs"
},
"destination": {
"as": {
"number": 1221,
"organization": {
"name": "Telstra Pty Ltd"
}
},
"ip": "1.128.0.1"
},
"ecs": {
"version": "8.17.0"
},
"elastic_agent": {
"id": "9c56e688-154e-40f0-a189-cd993c9bad5a",
"snapshot": false,
"version": "8.18.0"
},
"event": {
"action": "delete",
"agent_id_status": "verified",
"category": [
"network"
],
"code": "DHCP-LEASE-DELETE",
"created": "2021-03-03T11:57:45.000Z",
"dataset": "infoblox_threat_defense.event",
"ingested": "2025-07-16T10:51:05Z",
"kind": "event",
"original": "CEF:0|Infoblox|Data Connector|2.1.3|DHCP-LEASE-DELETE|DHCP Lease Delete|1|src=175.16.199.0 InfobloxClientID=01:00:1A:2B:3C:4D:5E InfobloxHostID=dhcp/host/1516583 InfobloxFingerprintPr=true InfobloxRangeEnd=67.43.156.10 InfobloxRangeStart=67.43.156.0 smac=00:1A:2B:3C:4D:5E InfobloxIPSpace=ipam/ip_space/1f99d3a6-2982-11f0-b65e-fe20d626f7e6 InfobloxSubnet=175.16.199.0/24 InfobloxFingerprint=VMware::Windows: shost= InfobloxLeaseUUID=a91838a3-4679-11f0-b018-ee5154718d37 InfobloxLifetime=3600 InfobloxLeaseOp=Delete app=DHCP cat=DHCP Lease Delete InfobloxDUID= InfobloxHost= dst=1.128.0.1",
"severity": 21,
"type": [
"info"
]
},
"host": {
"id": "1516583"
},
"infoblox_threat_defense": {
"event": {
"application_protocol": "DHCP",
"created": "2021-03-03T11:57:45.000Z",
"destination": {
"address": "1.128.0.1"
},
"device": {
"event_category": "DHCP Lease Delete",
"event_class_id": "DHCP-LEASE-DELETE",
"product": "Data Connector",
"vendor": "Infoblox",
"version": "2.1.3"
},
"infoblox": {
"client_id": "01:00:1A:2B:3C:4D:5E",
"fingerprint": "VMware::Windows:",
"fingerprint_pr": true,
"host_id": "dhcp/host/1516583",
"ip_space": {
"value": "ipam/ip_space/1f99d3a6-2982-11f0-b65e-fe20d626f7e6"
},
"lease": {
"op": "Delete",
"uuid": "a91838a3-4679-11f0-b018-ee5154718d37"
},
"lifetime": 3600,
"range": {
"end": "67.43.156.10",
"start": "67.43.156.0"
},
"subnet": "175.16.199.0/24"
},
"name": "DHCP Lease Delete",
"severity": 1,
"source": {
"address": "175.16.199.0",
"mac_address": "00:1a:2b:3c:4d:5e"
},
"syslog": {
"appname": "dataconnector",
"facility": {
"code": 16,
"name": "local0"
},
"msgid": "DHCP-LEASE-DELETE",
"priority": 134,
"severity": {
"code": 6,
"name": "Informational"
},
"version": "1"
},
"version": "0"
}
},
"input": {
"type": "udp"
},
"log": {
"source": {
"address": "192.168.255.1:53981"
}
},
"network": {
"application": "dhcp"
},
"observer": {
"product": "Data Connector",
"vendor": "Infoblox",
"version": "2.1.3"
},
"related": {
"hosts": [
"1516583"
],
"ip": [
"1.128.0.1",
"67.43.156.10",
"67.43.156.0",
"175.16.199.0"
]
},
"source": {
"geo": {
"city_name": "Changchun",
"continent_name": "Asia",
"country_iso_code": "CN",
"country_name": "China",
"location": {
"lat": 43.88,
"lon": 125.3228
},
"region_iso_code": "CN-22",
"region_name": "Jilin Sheng"
},
"ip": "175.16.199.0",
"mac": "00-1A-2B-3C-4D-5E"
},
"tags": [
"preserve_original_event",
"preserve_duplicate_custom_fields",
"forwarded",
"infoblox_threat_defense-event"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
| @timestamp | Event timestamp. | date |
| data_stream.dataset | Data stream dataset. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| event.dataset | Event dataset. | constant_keyword |
| event.module | Event module. | constant_keyword |
| infoblox_threat_defense.event.application_protocol | keyword | |
| infoblox_threat_defense.event.created | date | |
| infoblox_threat_defense.event.destination.address | ip | |
| infoblox_threat_defense.event.destination.dns_domain | keyword | |
| infoblox_threat_defense.event.device.action | keyword | |
| infoblox_threat_defense.event.device.address | ip | |
| infoblox_threat_defense.event.device.event_category | keyword | |
| infoblox_threat_defense.event.device.event_class_id | keyword | |
| infoblox_threat_defense.event.device.host_ip | ip | |
| infoblox_threat_defense.event.device.host_name | keyword | |
| infoblox_threat_defense.event.device.product | keyword | |
| infoblox_threat_defense.event.device.vendor | keyword | |
| infoblox_threat_defense.event.device.version | keyword | |
| infoblox_threat_defense.event.infoblox.an_count | keyword | |
| infoblox_threat_defense.event.infoblox.ar_count | keyword | |
| infoblox_threat_defense.event.infoblox.b1.connection_type | keyword | |
| infoblox_threat_defense.event.infoblox.b1.dhcp_fingerprint | keyword | |
| infoblox_threat_defense.event.infoblox.b1.dns_tags | keyword | |
| infoblox_threat_defense.event.infoblox.b1.feed.name | keyword | |
| infoblox_threat_defense.event.infoblox.b1.feed.type | keyword | |
| infoblox_threat_defense.event.infoblox.b1.network | keyword | |
| infoblox_threat_defense.event.infoblox.b1.oph.ip_address | ip | |
| infoblox_threat_defense.event.infoblox.b1.oph.name | keyword | |
| infoblox_threat_defense.event.infoblox.b1.policy.action | keyword | |
| infoblox_threat_defense.event.infoblox.b1.policy.name | keyword | |
| infoblox_threat_defense.event.infoblox.b1.region | keyword | |
| infoblox_threat_defense.event.infoblox.b1.src_os_version | keyword | |
| infoblox_threat_defense.event.infoblox.b1.threat.indicator | keyword | |
| infoblox_threat_defense.event.infoblox.c_site_id | keyword | |
| infoblox_threat_defense.event.infoblox.client_id | keyword | |
| infoblox_threat_defense.event.infoblox.dhcp_options | keyword | |
| infoblox_threat_defense.event.infoblox.dns_q.class | keyword | |
| infoblox_threat_defense.event.infoblox.dns_q.flags | keyword | |
| infoblox_threat_defense.event.infoblox.dns_q.type | keyword | |
| infoblox_threat_defense.event.infoblox.dns_r_code | keyword | |
| infoblox_threat_defense.event.infoblox.dns_view | keyword | |
| infoblox_threat_defense.event.infoblox.domain.cat | keyword | |
| infoblox_threat_defense.event.infoblox.duid | keyword | |
| infoblox_threat_defense.event.infoblox.event.occurred_time | date | |
| infoblox_threat_defense.event.infoblox.event.version | keyword | |
| infoblox_threat_defense.event.infoblox.event_occurred_time | date | |
| infoblox_threat_defense.event.infoblox.fingerprint | keyword | |
| infoblox_threat_defense.event.infoblox.fingerprint_pr | boolean | |
| infoblox_threat_defense.event.infoblox.host_id | keyword | |
| infoblox_threat_defense.event.infoblox.host_name | keyword | |
| infoblox_threat_defense.event.infoblox.http.req_body | flattened | |
| infoblox_threat_defense.event.infoblox.http.resp_body | flattened | |
| infoblox_threat_defense.event.infoblox.insight.description | keyword | |
| infoblox_threat_defense.event.infoblox.insight.feed_source | keyword | |
| infoblox_threat_defense.event.infoblox.insight.id | keyword | |
| infoblox_threat_defense.event.infoblox.insight.status | keyword | |
| infoblox_threat_defense.event.infoblox.insight.threat_type | keyword | |
| infoblox_threat_defense.event.infoblox.insight.user_comment | keyword | |
| infoblox_threat_defense.event.infoblox.ip_space.name | keyword | |
| infoblox_threat_defense.event.infoblox.ip_space.value | keyword | |
| infoblox_threat_defense.event.infoblox.lease.op | keyword | |
| infoblox_threat_defense.event.infoblox.lease.uuid | keyword | |
| infoblox_threat_defense.event.infoblox.lifetime | long | |
| infoblox_threat_defense.event.infoblox.log_name | keyword | |
| infoblox_threat_defense.event.infoblox.notification.sub_type | keyword | |
| infoblox_threat_defense.event.infoblox.notification.type | keyword | |
| infoblox_threat_defense.event.infoblox.ns_count | keyword | |
| infoblox_threat_defense.event.infoblox.on_prem_host_name | keyword | |
| infoblox_threat_defense.event.infoblox.policy.id | keyword | |
| infoblox_threat_defense.event.infoblox.pool_id | keyword | |
| infoblox_threat_defense.event.infoblox.range.end | ip | |
| infoblox_threat_defense.event.infoblox.range.start | ip | |
| infoblox_threat_defense.event.infoblox.resource.desc | keyword | |
| infoblox_threat_defense.event.infoblox.resource.id | keyword | |
| infoblox_threat_defense.event.infoblox.resource.type | keyword | |
| infoblox_threat_defense.event.infoblox.rpz.rule | keyword | |
| infoblox_threat_defense.event.infoblox.rpz.value | keyword | |
| infoblox_threat_defense.event.infoblox.service_id | keyword | |
| infoblox_threat_defense.event.infoblox.stats.events_blocked_count | keyword | |
| infoblox_threat_defense.event.infoblox.stats.events_not_blocked_count | keyword | |
| infoblox_threat_defense.event.infoblox.subject.groups | keyword | |
| infoblox_threat_defense.event.infoblox.subject.type | keyword | |
| infoblox_threat_defense.event.infoblox.subnet | keyword | |
| infoblox_threat_defense.event.infoblox.threat.class | keyword | |
| infoblox_threat_defense.event.infoblox.threat.confidence | long | |
| infoblox_threat_defense.event.infoblox.threat.family | keyword | |
| infoblox_threat_defense.event.infoblox.threat.level | long | |
| infoblox_threat_defense.event.infoblox.threat.property | keyword | |
| infoblox_threat_defense.event.infoblox_notification.type | keyword | |
| infoblox_threat_defense.event.message | keyword | |
| infoblox_threat_defense.event.name | keyword | |
| infoblox_threat_defense.event.outcome | keyword | |
| infoblox_threat_defense.event.severity | long | |
| infoblox_threat_defense.event.source.address | ip | |
| infoblox_threat_defense.event.source.hostname | keyword | |
| infoblox_threat_defense.event.source.mac_address | keyword | |
| infoblox_threat_defense.event.source.port | long | |
| infoblox_threat_defense.event.source.user_name | keyword | |
| infoblox_threat_defense.event.stats.base_event_count | long | |
| infoblox_threat_defense.event.status | keyword | |
| infoblox_threat_defense.event.syslog.appname | keyword | |
| infoblox_threat_defense.event.syslog.facility.code | long | |
| infoblox_threat_defense.event.syslog.facility.name | keyword | |
| infoblox_threat_defense.event.syslog.hostname | keyword | |
| infoblox_threat_defense.event.syslog.msgid | keyword | |
| infoblox_threat_defense.event.syslog.priority | long | |
| infoblox_threat_defense.event.syslog.severity.code | long | |
| infoblox_threat_defense.event.syslog.severity.name | keyword | |
| infoblox_threat_defense.event.syslog.version | keyword | |
| infoblox_threat_defense.event.transport_protocol | keyword | |
| infoblox_threat_defense.event.version | keyword | |
| input.type | Type of Filebeat input. | keyword |
| log.offset | Log offset. | long |
| log.source.address | Source address from which the log event was read/sent from. | keyword |
This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 0.1.0 | Enhancement (View pull request) Initial release. |
9.0.0 8.18.0 |