Skip to main content

Infoblox

Infoblox is a network infrastructure and DNS security platform that provides comprehensive DNS (Domain Name System), DHCP (Dynamic Host Configuration Protocol), and IPAM (IP Address Management) services, collectively known as DDI. The platform serves as a critical network control point for managing IP addresses, DNS records, and network identity across enterprise environments.

CategoryThreat intelligence, Network security
DirectionQuery source
Sign-inAPI Key
Query languagesSTIX
Websiteinfoblox.com

Before you start​

Huntbase signs in to Infoblox with API Key. Create the credential in Infoblox first, then keep it to hand for the Connect step.

  1. In the Infoblox Portal, click your user name at the top right and select Profile › User API Keys.
  2. Click Create, enter a name that identifies the purpose of the key, and select an expiry date.
  3. Click Save & Close, then click Copy in the confirmation dialog. The key is shown only once.
Watch out for
  • Infoblox notifies you daily from 14 days before the key expires. Replace the key in Huntbase before it expires, or queries stop working.
  • You can also create service account users and API keys that belong to them, so the connection does not depend on one person.

For the vendor's own instructions, see Infoblox user API key documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Infoblox​

  1. Go to Connections and click New connection, or click New connection on the Infoblox product page.
  2. On Product, pick Infoblox and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Infoblox lives:

FieldRequiredNotes
Server AddressYesThe Infoblox Portal API host, csp.infoblox.com. For a non-US realm use the regional host, such as csp.eu.infoblox.com.
PortYes443. Defaults to 443.
Certificate (PEM)No
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.

Credentials​

The only Method is API Key. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
API TokenYesThe user API key itself. Do not add a Token prefix. Secret — not shown again after you save it.

Query it​

Once connected, Infoblox can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​