Infoblox SOC Insights Plugin for Risk Exchange

This document explains how to configure the Infoblox SOC Insights v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin is used to fetch devices from the Monitor > Reports > Security > Insights page of the Infoblox SOC Insights. This plugin does not support performing action on the devices on Infoblox SOC Insights.

Netskope normalization score calculation => Device Threat Level Info (-1): 1000, Device Threat Level Low (1): 667, Device Threat Level Medium (2): 333, Device Threat Level High (3): 0.

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Connectivity to the Infoblox platform.
• A subscription for Infoblox SOC Insights service.
• Access to generate an API Key and pull devices.
• Connectivity to the following host: https://*.infoblox.com/

Infoblox SOC Insights Plugin Support

This plugin is used to fetch devices from the Monitor > Reports > Security > Insights page in Infoblox SOC Insights. This plugin does not support performing action on the devices on Infoblox SOC Insights.

Mappings

Mappings are used to view the pulled devices and their respective details. Fields mapped during plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.

Pull Mappings

Permissions

Users should have admin access for the Infoblox instance.

{
    "insightList": [
        {
            "tClass": "Suspicious",
            "tFamily": "EmergentDomain",
            "insightId": "a4b3eb6c-faa6-46cd-8fac-60894a309b09",
            "feedSource": "suspicious-noed",
            "startedAt": "2025-04-14T07:00:00Z",
            "threatType": "Suspicious",
            "status": "Active",
            "persistentDate": "2025-04-14T07:00:00Z",
            "spreadingDate": "2025-05-10T19:00:00Z",
            "numEvents": "148",
            "mostRecentAt": "2025-06-01T22:46:12.549319Z",
            "eventsBlockedCount": "148",
            "dateChanged": "2025-05-21T00:54:49.407214Z",
            "priorityText": "HIGH"
        },
    ]
}

{
    "assets": [
        {
            "cmac": "00:0c:29:a6:2f:6c",
            "count": 45,
            "qip": "10.196.217.119",
            "threatLevelMax": "2",
            "threatIndicatorDistinctCount": "45",
            "timeMax": "2025-05-07T10:00:00.000",
            "timeMin": "2025-05-07T10:00:00.000"
        },
        {
            "cmac": "00:0c:29:9e:95:c6",
            "count": 75,
            "qip": "10.196.217.122",
            "threatLevelMax": "2",
            "threatIndicatorDistinctCount": "75",
            "timeMax": "2025-05-07T10:00:00.000",
            "timeMin": "2025-05-07T10:00:00.000"
        },
    ]
}

Performance Matrix

Here are the readings conducted on a Large CE Stack with these VM specifications by pulling 500k devices from the Infoblox SOC Insights plugin.

User Agent

netskope-ce-5.1.1-cre-infoblox-soc-insights-v1.0.0

Workflow

1. Get your Infoblox Base URL and API Key.
2. Configure Infoblox SOC Insights Plugin.
3. Add a Business Rule.
4. Add Actions.
5. Validate the Infoblox SOC Insights Plugin.

Click play to watch a video.

Get your Infoblox Base URL and API Key

For getting the Base URL and API Key, you have to follow the below steps:

1. Log in to your Infoblox account, and from the URL, you can find the Base URL. Copy the Base URL.
   For example, https://*.infoblox.com/.

2. Go to Profile from the upper right corner.

3. Go to User API Keys.
4. Click Create and provide a Name for the key and an Expiration date.

5. Click Save and Close, and then copy the API Key. You will use this and the Base URL to configure the Infolblox SOC Insights plugin.

Configure Infoblox SOC Insights Plugin

1. In Cloud Exchange, go to Settings > Plugins. Search for and select the Infoblox SOC Insights v1.0.0 (CRE) plugin box.

2. Add a plugin configuration name and change sync interval if needed.

3. Click Next. Enter the configuration parameters:
   • Base URL: API Base URL of your Infoblox instance. For example: https://csp.infoblox.com.
   • API Key: API Key generated from your Infoblox instance.
   • Initial Range (in days): Number of days to pull the data for the initial run.

4. Click Next. Select the Entity from the Entity dropdown. The Entity fields can be created with the Schema Editor, or using the + Add Field from the field dropdown. Provide the field mapping. For the suggested mappings, refer to the Mappings section.

5. Click Save.

Add a Risk Exchange Business Rule for Infoblox SOC Insights

1. In Risk Exchange, go to Business Rules.
2. Click Create New Rule in the top right corner.
3. Enter a Rule Name. Select the Entity for the Fields that were configured for the Infoblox SOC Insights plugin, and configure the query based on your requirements. When finished, click Save.

Add Risk Exchange Actions for Infoblox SOC Insights

The Infoblox SOC Insights plugin only supports No Action action:

No Action

No action will be performed for this action. Users can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

Configure the Action

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select the required Business Rule, Configuration, and Action from their respective dropdown.
3. Enable the Require Approval toggle if Approval is needed before performing action.
4. If Require Approval is enabled, then to approve the action, go to Risk Exchange > Action Logs, select the action to be approved, and then click Approve.

Validate the Infoblox SOC Insights Plugin

Validate in Cloud Exchange

To verify the devices pulled from Infoblox SOC Insights, go to the Logging and search for the logs from the Infoblox SOC Insights plugin. You can provide a filter like: message Like “[CRE Infoblox SOC Insights]”.

To check the records pulled and stored in Cloud Exchange, go to Records in Risk Exchange. Select the entity that you used while adding the mapping in the plugin configuration.

Validate in Infoblox

Devices are pulled from Infoblox SOC Insights at Monitor > Reports > Security > Insights.

After clicking Investigate Insight for any of the Insights, go to the Assets section. This is where the plugin is pulling the Devices in Cloud Exchange.

Troubleshooting the Infoblox SOC Insights Plugin

Receiving error in the plugin workflow

CRE Infoblox SOC Insights [configuration_name]: Validation error occurred, Received exit code 401, Unauthorized, Verify API Key provided in the configuration parameters.

What to do: Verify the API Key for Infoblox SOC Insights. For reference, go to Get your Infoblox Base URL and API Key.

Devices are not pulled from Infoblox SOC Insights

If no data for the Devices are pulled, it might be due to either:

• No device is available on the platform to pull
• Mapping is not added in the plugin
• If the devices have null values in Unique fields, it will store only one record in the Cloud Exchange.

What to do:

1. Go to Infoblox SOC Insights and check if the devices are available to pull from Monitor > Reports > Security > Insights.
2. Edit the plugin configuration and check the Entity Source page. There should be some fields mapped in order to pull the same.
3. If a field is marked as Unique and multiple records contain a null value for that field, Cloud Exchange will overwrite the existing values with the latest values from the most recent record.

Fetched records count does not match with the actual count

If the fetched records count does not match the actual count, it might be due to multiple insights have the same devices available.

What to do:

1. Verify the devices from the Infoblox SOC Insights, by following the steps from Validate in Infoblox Platform
2. For example, below are two different insights available on the platform, but each of them has the same asset “34.96.34.4” available.

Limitations

• Due to API limitations, when retrieving devices from Infoblox SOC Insights, if an insight contains data for more than 10,000 devices, only the first 10,000 will be fetched. Any additional devices beyond this limit will not be retrieved.
• The Initial Range configuration parameter only accepts values between 1 and 30 days. Providing a value greater than 30 days will result in a 500 Internal Server Error due to API limitations.
• Due to API limitations, some device IP addresses (particularly for EC2 instances) may differ from the values displayed on the platform.