infoblox_threat_defense:endpoints
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| infoblox_threat_defense:endpoints [2025/01/17 13:10] – bstafford | infoblox_threat_defense:endpoints [2026/02/15 02:36] (current) – [Endpoint Config] bstafford | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== | + | ====== |
| ===== Best Practice ===== | ===== Best Practice ===== | ||
| [[https:// | [[https:// | ||
| ===== Internal Host Detection ===== | ===== Internal Host Detection ===== | ||
| - | The endpoint | + | Endpoint |
| - | * Set under Manage > Endpoints > Endpoint Groups > Bypass mode. | + | * Set under Manage |
| * Set the FQDN and a TXT record. | * Set the FQDN and a TXT record. | ||
| - | Client | + | Endpoint |
| - | ===== BloxOne | + | ===== Endpoint |
| - | You should be able to resolve '' | + | You should be able to resolve '' |
| Config file on Windows: | Config file on Windows: | ||
| Line 18: | Line 18: | ||
| < | < | ||
| + | PowerShell can follow this file | ||
| + | < | ||
| + | |||
| + | On Windows, you can also find the registry keys at | ||
| + | < | ||
| + | |||
| + | ===== PTR and Internal Zones ===== | ||
| The files above are where Internal Domains are configured. Also, this is where BloxOne Endpoint automatically adds internal domains to the " | The files above are where Internal Domains are configured. Also, this is where BloxOne Endpoint automatically adds internal domains to the " | ||
| + | * <any DNS suffix assigned to your network interface> | ||
| * local | * local | ||
| + | * ipv4only.arpa | ||
| * 10.in-addr.arpa | * 10.in-addr.arpa | ||
| * 16.172.in-addr.arpa | * 16.172.in-addr.arpa | ||
| Line 38: | Line 47: | ||
| * 31.172.in-addr.arpa | * 31.172.in-addr.arpa | ||
| * 168.192.in-addr.arpa | * 168.192.in-addr.arpa | ||
| + | * 254.169.in-addr.arpa | ||
| * c.f.ip6.arpa | * c.f.ip6.arpa | ||
| * d.f.ip6.arpa | * d.f.ip6.arpa | ||
| - | * ipv4only.arpa | ||
| - | * 254.169.in-addr.arpa | ||
| * 8.e.f.ip6.arpa | * 8.e.f.ip6.arpa | ||
| * 9.e.f.ip6.arpa | * 9.e.f.ip6.arpa | ||
| Line 47: | Line 55: | ||
| * b.e.f.ip6.arpa | * b.e.f.ip6.arpa | ||
| + | This can be summarised as | ||
| + | * * <any DNS suffix assigned to your network interface> | ||
| + | * local | ||
| + | * ipv4only.arpa | ||
| + | * 10.0.0.0/8 | ||
| + | * 172.16.0.0/ | ||
| + | * 192.168.0.0/ | ||
| + | * 169.254.0.0/ | ||
| + | * fc00::/7 (fc00::/8 and fd00::/8) | ||
| + | * fe80::/16 | ||
| + | * fe90::/16 | ||
| + | * fea0::/16 | ||
| + | * feb0::/16 | ||
| + | ===== Config Files ===== | ||
| The following file is written every few seconds. | The following file is written every few seconds. | ||
| < | < | ||
| Line 143: | Line 165: | ||
| If the admin changes the " | If the admin changes the " | ||
| + | ===== Follow Query Logs ==== | ||
| + | This will print the latest 5 lines of DNS logs and then prints queries live as they are made. | ||
| + | < | ||
| ===== Palo Alto Networks ===== | ===== Palo Alto Networks ===== | ||
| - | When using Palo Alto Networks, if you have a split-tunnel VPN where only internal data goes over the VPN, don't forget to set " | + | When using Palo Alto Networks |
| ===== Updates ===== | ===== Updates ===== | ||
| Line 152: | Line 176: | ||
| < | < | ||
| < | < | ||
| + | |||
| + | ===== PowerShell Scripts ===== | ||
| + | Scripts that extract data from the Endpoint config. Courtesy of CoPilot. | ||
| + | ==== Show Local IP ==== | ||
| + | Show the local DNS server IP issued by DHCP. This isn't visible via '' | ||
| + | < | ||
| + | $filePath = " | ||
| + | |||
| + | # Read the file line by line | ||
| + | Get-Content $filePath | ForEach-Object { | ||
| + | # Check if the line contains " | ||
| + | if ($_ -match " | ||
| + | # Extract the IP address using a regular expression | ||
| + | $ipAddress = $matches[1] | ||
| + | # Print the IP address to the screen | ||
| + | Write-Output "Found IP address: $ipAddress" | ||
| + | } | ||
| + | }</ | ||
| + | ==== Show Local Domains ==== | ||
| + | Read the file and extract the local domains. Ignore the default ones from Infoblox. You may want to ignore local domains. This will then give you the list of Application domains that are configured "Allow - Local Resolution" | ||
| + | < | ||
| + | $filePath = " | ||
| + | # List of words to ignore | ||
| + | $ignoreWords = @( | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | ) | ||
| + | |||
| + | # Read the file line by line | ||
| + | $fileContent = Get-Content -Path $filePath | ||
| + | |||
| + | # Initialize a flag to indicate if the target line is found | ||
| + | $found = $false | ||
| + | |||
| + | # Iterate over each line in the file | ||
| + | foreach ($line in $fileContent) { | ||
| + | if ($line -match " | ||
| + | # If the line contains the target word, split it into words | ||
| + | $words = $line -split " | ||
| + | | ||
| + | # Print each word on a new line, ignoring specified words | ||
| + | foreach ($word in $words) { | ||
| + | if ($ignoreWords -notcontains $word) { | ||
| + | Write-Output $word | ||
| + | } | ||
| + | } | ||
| + | | ||
| + | # Set the flag to true and break the loop | ||
| + | $found = $true | ||
| + | break | ||
| + | } | ||
| + | } | ||
| + | # If the target line was not found, print a message | ||
| + | if (-not $found) { | ||
| + | Write-Output "No line containing ' | ||
| + | }</ | ||
| + | ==== Show SSID History ==== | ||
| + | Show all SSID connected to and DNS IP addresses | ||
| + | < | ||
| + | $folderPath = " | ||
| + | |||
| + | |||
| + | # Define the regex pattern for the file names (GUID format) | ||
| + | $guidPattern = " | ||
| + | |||
| + | |||
| + | # Define the regex pattern to match the template | ||
| + | $pattern = " | ||
| + | |||
| + | |||
| + | |||
| + | # Get all files in the folder | ||
| + | $files = Get-ChildItem -Path $folderPath | ||
| + | |||
| + | # Iterate over each file | ||
| + | foreach ($file in $files) { | ||
| + | # Check if the file name matches the GUID pattern | ||
| + | if ($file.Name -match $guidPattern) { | ||
| + | # Read the content of the file | ||
| + | $fileContent = Get-Content -Path $file.FullName | ||
| + | | ||
| + | |||
| + | # Iterate over each line in the file | ||
| + | foreach ($line in $fileContent) { | ||
| + | # Check if the line matches the pattern | ||
| + | if ($line -match $pattern) { | ||
| + | $guid = $matches[1] | ||
| + | $ssid = $matches[2] | ||
| + | $dhcp = $matches[3] | ||
| + | $ips = $matches[4] -split "," | ||
| + | |||
| + | # Print the extracted data | ||
| + | Write-Output "" | ||
| + | # | ||
| + | Write-Output " | ||
| + | # | ||
| + | foreach ($ip in $ips) { | ||
| + | if ($ip -ne "" | ||
| + | Write-Output " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | } | ||
| + | }</ | ||
infoblox_threat_defense/endpoints.1737119429.txt.gz · Last modified: by bstafford