Skip to main content

Infoblox Threat Defense with DDI

Download With Dependencies

Utilize the Infoblox Threat Defense with DDI integration to manage SOC Insight incident response, indicator enrichment, and block cyber threats.

Note: Support for this Pack was moved to Partner starting August 25, 2025. In case of any issues arise, please contact the Partner directly at support@infoblox.com or https://support.infoblox.com/.

The Infoblox Threat Defense with DDI integration leverages DNS as a security control point to detect and block cyber threats. This integration enables threat intelligence sharing, automated SOC Insight incident response, automated indicator enrichment, and DNS-based security controls within your Cortex XSOAR environment.

DNS Security

  • Protects the network at the DNS level, which is often the very first point of contact for cyberattacks, ensuring that threats are intercepted and mitigated before they can progress deeper into the infrastructure.
  • Blocks and unblocks malicious domains and IP addresses by preventing access to harmful destinations while allowing administrators to manage and maintain control over legitimate network usage.

Threat Intelligence

  • Provides SOC teams with actionable SOC Insights with detailed information about indicators, events, assets, and analyst comments, to detect, investigate, and respond to threats more effectively.
  • Provides visibility into indicators of compromise (IoCs) and enriches them with context for faster investigation.

DDI

  • Tightly integrates security with DNS, DHCP, and IPAM, turning these core network services into enforcement points where malicious activity can be detected and blocked in real time.

Pack Use-cases

  • Retrieve comprehensive threat intelligence about domains, hosts, and IP addresses.
  • Detect and block malicious domains and IP addresses using the Threat Defense platform.
  • Identify lookalike domains that may indicate potential phishing attempts.
  • Manage custom security lists for blocking or allowing specific domains and IP addresses.
  • Automate threat response by integrating with existing security workflows.
  • Enrich indicators with DNS-based threat intelligence data for better security decisions.
  • Unblock previously blocked indicators when they are no longer considered malicious.

Support

Contact

Note: Support for this Pack was moved to Partner starting August 25, 2025. In case of any issues arise, please contact the Partner directly at support@infoblox.com or https://support.infoblox.com/.

The Infoblox Threat Defense with DDI integration leverages DNS as a security control point to detect and block cyber threats. This integration enables threat intelligence sharing, automated SOC Insight incident response, automated indicator enrichment, and DNS-based security controls within your Cortex environment.

DNS Security

  • Protects the network at the DNS level, which is often the very first point of contact for cyberattacks, ensuring that threats are intercepted and mitigated before they can progress deeper into the infrastructure.
  • Blocks and unblocks malicious domains and IP addresses by preventing access to harmful destinations while allowing administrators to manage and maintain control over legitimate network usage.

Threat Intelligence

  • Provides SOC teams with actionable SOC Insights with detailed information about indicators, events, assets, and analyst comments, to detect, investigate, and respond to threats more effectively.
  • Provides visibility into indicators of compromise (IoCs) and enriches them with context for faster investigation.

DDI

  • Tightly integrates security with DNS, DHCP, and IPAM, turning these core network services into enforcement points where malicious activity can be detected and blocked in real time.

Pack Use-cases

  • Retrieve comprehensive threat intelligence about domains, hosts, and IP addresses.
  • Detect and block malicious domains and IP addresses using the Threat Defense platform.
  • Identify lookalike domains that may indicate potential phishing attempts.
  • Manage custom security lists for blocking or allowing specific domains and IP addresses.
  • Automate threat response by integrating with existing security workflows.
  • Enrich indicators with DNS-based threat intelligence data for better security decisions.
  • Unblock previously blocked indicators when they are no longer considered malicious.

Support

Contact

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

CertificationRead more
Supported ByPartner
CreatedMarch 1, 2023
Last ReleaseNovember 4, 2025
WORKS WITH THE FOLLOWING INTEGRATIONS:
DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.