[Recommended] Infoblox SOC Insight Data Connector via AMA connector for Microsoft Sentinel
The Infoblox SOC Insight Data Connector allows you to easily connect your Infoblox BloxOne SOC Insight data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.
This data connector ingests Infoblox SOC Insight CDC logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.
This is autogenerated content. For changes, contact the solution provider.
Connector attributes
| Connector attribute | Description |
|---|---|
| Log Analytics table(s) | CommonSecurityLog (InfobloxCDC_SOCInsights) |
| Data collection rules support | Workspace transform DCR |
| Supported by | Infoblox |
Query samples
Return all logs involving DNS Tunneling
InfobloxCDC_SOCInsights
| where ThreatType == "DNS Tunneling"
Return all logs involving a configuration issue
InfobloxCDC_SOCInsights
| where ThreatClass == "TI-CONFIGURATIONISSUE"
Return all high threat level logs
InfobloxCDC_SOCInsights
| where ThreatLevel == "High"
Return raised status logs
InfobloxCDC_SOCInsights
| where Status == "RAISED"
Return logs involving a high amount of unblocked DNS hits
InfobloxCDC_SOCInsights
| where NotBlockedCount >= 100
Return each Insight by ThreatFamily
InfobloxCDC_SOCInsights
| summarize dcount(InfobloxInsightID) by ThreatFamily
Prerequisites
To integrate with [Recommended] Infoblox SOC Insight Data Connector via AMA make sure you have:
- ****: To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. Learn more
- ****: Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed. Learn more
Vendor installation instructions
Workspace Keys
In order to use the playbooks as part of this solution, find your Workspace ID and Workspace Primary Key below for your convenience.
Workspace Key
Parsers
This data connector depends on a parser based on a Kusto Function to work as expected called InfobloxCDC_SOCInsights which is deployed with the Microsoft Sentinel Solution.
SOC Insights
This data connector assumes you have access to Infoblox BloxOne Threat Defense SOC Insights. You can find more information about SOC Insights here.
Infoblox Cloud Data Connector
This data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the Infoblox Data Connector is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this quick-start guide for more information and licensing requirements.
- Secure your machine
Make sure to configure the machine's security according to your organization's security policy
Next steps
For more information, go to the related solution in the Azure Marketplace.