DATASHEET

BloxOne™ Threat Defense Essentials

Strengthen and Optimize Your Security Posture from the Foundation

The Need for Foundational Security at Scale

BLOXONE THREAT DEFENSE Protecting your infrastructure and data is more complicated than it once
ESSENTIALS KEY CAPABILITIES was. That's because the traditional network security model is inadequate.
• The perimeter has shifted and your users directly access
• Secure existing networks and digital
cloud-based applications from everywhere.
transformations like SD-WAN, IoT and
cloud leveraging existing infrastructure • ISD-WAN drives network transformation and branch offices directly
• Block data exfiltration: Detect and block connect to Internet with no ability to replicate full HQ security stack.
DNS-based data exfiltration using analytics • IoT leads to an explosion in the number of devices that can't be
and machine learning protected using traditional endpoint protection technologies.
• Enhance visibility: Get precise visibility
• Most security systems are complex, and do not easily scale to
and rich network context including IPAM
the level needed to protect these dynamic environments.
and asset metadata about your network
devices for better correlation of events
What organizations need is a scalable, simple and automated security
• Simplify Investigations: Research security solution that protects the entire network without the need to deploy or
hits with an easy to use threat lookup tool manage additional infrastructure.

• Offload strained security devices:

Decrease the burden on strained perimeter
Infoblox Provides a Scalable Platform That Maximizes
security devices, such as firewalls, IPS and Brand Protection
web proxies by using your already available BloxOne Threat Defense Essentials strengthens and optimizes your
DNS servers as the first line of defense; security posture from the foundation. It maximizes brand protection by
achieve up to 60 times reduction in traffic securing your existing networks as well as digital imperatives like SD-WAN,
sent to NGFWs*
IoT and the cloud. It protects customers from data exfiltration, provides
scalable malware mitigation, delivers precise visibility for faster correlation
*Based on real customer data
of events and reduces burden on strained perimeter security devices.

Infoblox Grid
DNS, DHCP, IPAM
DNS
Firewall
Delivered via Cloud
(on-premises)
Security Portal (CSP)

Threat Intelligence Pre-integrated, RPZ

files ready for use
Threat Insight
Figure 1: BloxOne
Threat Defense
Essentials Architecture
 4. Bogon: Bogons are often source addresses of DDoS
attacks and is an informal name for an IP packet on the
“Sharing information among a user, community and public Internet that claims to be from an area of the IP
getting collective intelligence on attack vectors and address space reserved, but not yet allocated or delegated
by an Internet Authority or Registry. Bogons are usually the
methods keeps victims from having to ask, ‘Is it just
result of accidental or malicious misconfiguration.
us, or is someone else getting hit by this attack?’”
5/6. DHS AIS_IP and DHS AIS_Hostname (2 feeds): AIS is
— Elderwood Data Breach a part of the Department of Homeland Security’s (DHS’s)
effort to create an ecosystem in which, as soon as a company
or federal agency observes an attempted compromise, the
Threat Intelligence Data Feeds indicator is shared with AIS program partners, including
Here are the threat intelligence data feeds that are available Infoblox. Indicators from the AIS program are classified
as part of BloxOne Threat Defense Essentials package: and normalized by Infoblox to ease consumption.

7/8. DHS AIS NCCIC Watch list Hostnames and Domains

1. Base hostnames: The base hostnames set enables and DHS AIS NCCIC Watch list IPs (2 feeds): Indicators
protection against known hostnames that are dangerous contained in these feeds appear on the watch list from the
as destinations and are sources of threats, such as APTs, National Cybersecurity and Communications Integration
bots, compromised host/domains, exploit kits, malicious Center (NCCIC), which are not verified or validated by DHS
name servers and sinkholes. or Infoblox.
2. Anti-malware: Enables protection against hostnames
containing known malicious threats, such as malware
command and control (C&C), malware download and
active phishing sites For More Information

3. Ransomware: Enables protection against hostnames To learn more about the ways that BloxOne Threat Defense
containing malware that restricts access to the computer Essentials secures your data and infrastructure, please visit:
system it infects and demands a ransom for the removal [Link]
of the restriction
For more details on threat intelligence data feeds, please visit:
[Link]
[Link].

Infoblox enables next-level network experiences with its Secure Cloud-Managed Network Services. As the pioneer in providing the
world’s most reliable, secure and automated networks, we are relentless in our pursuit of network simplicity. A recognized industry
leader, Infoblox has 50 percent market share comprised of 8,000 customers, including 350 of the Fortune 500.

Corporate Headquarters | 3111 Coronado Dr. | Santa Clara, CA | 95054

+1.408.986.4000 | 1.866.463.6256 (toll-free, U.S. and Canada) | info@[Link] | [Link]

© 2020 Infoblox, Inc. All rights reserved. Infoblox logo, and other marks appearing herein are property of Infoblox, Inc. All other marks are the property of
their respective owner(s).