Infoblox Cloud Data Connector (CEF)
Infoblox BloxOne DNS query, threat defense, and SOC Insights events
Recommendation
High-value events at high volume detected through aggregation or jobs, or high-value context used mainly in investigations.
Retention is set per table, so the retention for this source is advisory.
How the matrix worksC5 Network activity
Network activity: firewall, DNS, DHCP, web proxy, flow, load balancer, mail gateway and message flow, web access to internet-facing services
T3 High-volume aggregation
Primary, high or very-high volume, and the generic detection use is aggregation, threat-intelligence matching, baselining, or investigation.
Rows that belong to this source
DeviceVendor =~ "Infoblox" and DeviceProduct =~ "Data Connector"Rules query these rows through the InfobloxCDC parser.
Rows to keep in Analytics
Combine these with the filter, and with the other sources you collect, in the split rule builder.
Keep response policy zone (RPZ) threat defense hits in Analytics. Other DNS queries go to the data lake.
DeviceEventClassID has_cs "RPZ"Sources for this recommendation
- Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
- CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.