Infoblox BloxOne Plugin for Risk Exchange

This document explains how to configure the Infoblox BloxOne v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin fetches applications data from Monitor > Reports > Security > Application Discovery > All Applications and devices from Configure > Security > Endpoints page of the Infoblox BloxOne platform. This plugin supports performing Update application status action on the applications and doesn’t support any action on the devices.

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Your Infoblox BloxOne Base URL and API Key.
• Connectivity to Infoblox BloxOne platform.

Infoblox Plugin Support

This plugin fetches applications data from Monitor > Reports > Security > Application Discovery > All Applications and devices from Configure > Security > Endpoints page of the Infoblox BloxOne platform. This plugin supports performing Update application status action on the applications and doesn’t support any action on the devices.

Mappings

The below mapping can be used to pull the Applications and Devices and their respective details. Mapped fields during plugin configuration will be visible on the Records page once the data is pulled. Below is the suggested mapping that should be used while configuring the plugin.

Pull Mapping for Application

Pull Mapping for Devices

{
  "results": [
    {
      "app_name": "<Application Name>",
      "status": "<APPROVED or UNAPPROVED>"
    }
  ]
}

{"results":[{"calculated_status":"ACTIVE","city_name":"san francisco","client_id":"b1a011e8328f75e7233db3c2a6d9c217","connected_time":"2024-09-12T05:34:19.398Z","country_name":"united states","created_time":"2024-09-12T05:34:19.398Z","device_info":"S-1-5-21-804185182-4086767973-266869295","device_region":"california","elb_ip_list":["string"],"group_id":53212,"group_name":"endpoint_group_a","is_uploading_logs":false,"log_level":"INFO","name":"endpoint_device_a","net_info":{"fqdn":"example1.corp-device.com","ipv4_addr_list":["10.5.77.12","11.2.5.39"],"mac_addr":["00:a0:c9:14:c8:29","12:cb:c0:31:ff:ee"],"state":{"protection":"UNKNOWN_SUB_STATUS","upgrade":"NO_OPERATION"}},"os_platform":"Windows 7 Enterprise","public_ip":"string","region":"ap-northeast-1","region_name":"Asia Pacific (Seoul)","serial_number":"string","tags":{},"updated_time":"2024-09-12T05:34:19.398Z","user_id":"user_a","user_id_verified":true,"version":"1.5.2"}],"total_result_count":0}

{
    "inserted_approvals": [
        {
            "app_name": "<Application Name>",
            "status": "<APPROVED or UNAPPROVED>"
        }
    ]
}

{
  "results": [
    {
      "app_name": "<Application Name>",
      "status": "<APPROVED or UNAPPROVED>"
    }
  ]
}

User Agent

netskope-ce-5.1.0-cre-infoblox-bloxone-v1.0.0

Workflow

1. Configure the Infoblox BloxOne plugin.
2. Configure a Business Rule.
3. Configure Actions.
4. Validate the plugin.

Configure the Infoblox BloxOne Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Infoblox BloxOne v1.0.0 (CRE) plugin.

   

2. Enter a plugin configuration name and change the sync interval if needed.

   

3. Click Next and enter your Infoblox BloxOne Base URL and API Key.

   

4. Click Next and select the Applications Entity from the Entity dropdown, and provide the field mapping(s) per your needs.

   

   Application Name will be required to pull applications and to perform action on the pulled applications.

   

   The Device ID field will be required to pull the Devices.

5. Click Save.

Configure a Risk Exchange Business Rule for Infoblox BloxOne

1. In Risk Exchange, go to Business Rules., and click Create New Rule in the top right corner.

2. Enter a Rule Name and select the Entity for the Fields configured for the Infoblox BloxOne plugin, and then configure the query based on your requirements. Here’s an example the fetches Applications containing Akamai in Application Name.

   

3. Click Save.

   

Configure Risk Exchange Actions for Infoblox BloxOne

The InfoBlox BloxOne supports the following actions:

• Update Application Status: Update Application Status will update the status of application.
• No Action: No action will be performed for this action. Users can generate alerts in CTO by using this action and enabling the generate alerts toggle button.

Update Application Status

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, your plugin Configuration, and the Update Application Status Action from their respective dropdowns.
3. Enable the Require Approval toggle if Approval is needed before performing action on the Applications.
4. Click Save.

No Action

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, your plugin Configuration, and the No Action Action from their respective dropdowns
3. Enable the Generate Alert toggle to generate alerts in the Ticket Orchestrator module.
4. Enable the Require Approval toggle if Approval is needed before performing action on the Devices.
5. Click Save.

Troubleshooting the Infoblox BloxOne Plugin

Unable to Pull Data

If you are unable to pull Devices and Applications from the CRE Infoblox BloxOne plugin, it could be due to one of these reasons:

• No Devices or Applications present on the platform.
• An error is received while pulling Devices and Applications from the platform.
• Mapping is not added while configuring the plugin in the entity source page.

What to do:

1. Check on the InfoBlox BloxOne platform to see if Devices or Applications exist or not.
2. Receiving 500 error: The server might be down, wait for a while and check later.
3. Receiving 401 error: The API Key provided in plugin configuration parameter is invalid or expired.
4. Make sure that the mapping is added, and the Device ID field is mapped for the Device entity, plus Application Name is mapped for Application entity.

Unable to View Devices or Applications details on the Records Page

If you are unable to view Devices and Applications details on the record table, it could be due to one of these reasons:

• Mapping for all the Infoblox BloxOne fields was not provided while configuring the Infoblox BloxOne plugin.
• Pulled Devices or Applications are displayed in a row with comma-separated values.

What to do:

1. Make sure the needed mappings where provided while configuring the plugin.
2. Make sure that the fields created in an entity are according to the recommended Mappings.