infoblox_threat_defense:endpoints
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| infoblox_threat_defense:endpoints [2025/02/17 00:54] – bstafford | infoblox_threat_defense:endpoints [2026/02/15 02:36] (current) – [Endpoint Config] bstafford | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== | + | ====== |
| ===== Best Practice ===== | ===== Best Practice ===== | ||
| [[https:// | [[https:// | ||
| ===== Internal Host Detection ===== | ===== Internal Host Detection ===== | ||
| - | The endpoint | + | Endpoint |
| - | * Set under Manage > Endpoints > Endpoint Groups > Bypass mode. | + | * Set under Manage |
| * Set the FQDN and a TXT record. | * Set the FQDN and a TXT record. | ||
| - | Client | + | Endpoint |
| - | ===== BloxOne | + | ===== Endpoint |
| You should be able to resolve '' | You should be able to resolve '' | ||
| Line 18: | Line 18: | ||
| < | < | ||
| + | PowerShell can follow this file | ||
| + | < | ||
| + | |||
| + | On Windows, you can also find the registry keys at | ||
| + | < | ||
| + | |||
| + | ===== PTR and Internal Zones ===== | ||
| The files above are where Internal Domains are configured. Also, this is where BloxOne Endpoint automatically adds internal domains to the " | The files above are where Internal Domains are configured. Also, this is where BloxOne Endpoint automatically adds internal domains to the " | ||
| + | * <any DNS suffix assigned to your network interface> | ||
| * local | * local | ||
| + | * ipv4only.arpa | ||
| * 10.in-addr.arpa | * 10.in-addr.arpa | ||
| * 16.172.in-addr.arpa | * 16.172.in-addr.arpa | ||
| Line 38: | Line 47: | ||
| * 31.172.in-addr.arpa | * 31.172.in-addr.arpa | ||
| * 168.192.in-addr.arpa | * 168.192.in-addr.arpa | ||
| + | * 254.169.in-addr.arpa | ||
| * c.f.ip6.arpa | * c.f.ip6.arpa | ||
| * d.f.ip6.arpa | * d.f.ip6.arpa | ||
| - | * ipv4only.arpa | ||
| - | * 254.169.in-addr.arpa | ||
| * 8.e.f.ip6.arpa | * 8.e.f.ip6.arpa | ||
| * 9.e.f.ip6.arpa | * 9.e.f.ip6.arpa | ||
| Line 47: | Line 55: | ||
| * b.e.f.ip6.arpa | * b.e.f.ip6.arpa | ||
| + | This can be summarised as | ||
| + | * * <any DNS suffix assigned to your network interface> | ||
| + | * local | ||
| + | * ipv4only.arpa | ||
| + | * 10.0.0.0/8 | ||
| + | * 172.16.0.0/ | ||
| + | * 192.168.0.0/ | ||
| + | * 169.254.0.0/ | ||
| + | * fc00::/7 (fc00::/8 and fd00::/8) | ||
| + | * fe80::/16 | ||
| + | * fe90::/16 | ||
| + | * fea0::/16 | ||
| + | * feb0::/16 | ||
| + | ===== Config Files ===== | ||
| The following file is written every few seconds. | The following file is written every few seconds. | ||
| < | < | ||
| Line 143: | Line 165: | ||
| If the admin changes the " | If the admin changes the " | ||
| + | ===== Follow Query Logs ==== | ||
| + | This will print the latest 5 lines of DNS logs and then prints queries live as they are made. | ||
| + | < | ||
| ===== Palo Alto Networks ===== | ===== Palo Alto Networks ===== | ||
| - | When using Palo Alto Networks, if you have a split-tunnel VPN where only internal data goes over the VPN, don't forget to set " | + | When using Palo Alto Networks |
| ===== Updates ===== | ===== Updates ===== | ||
| Line 154: | Line 178: | ||
| ===== PowerShell Scripts ===== | ===== PowerShell Scripts ===== | ||
| - | Scripts that extract data from the Endpoint config. | + | Scripts that extract data from the Endpoint config. Courtesy of CoPilot. |
| ==== Show Local IP ==== | ==== Show Local IP ==== | ||
| Show the local DNS server IP issued by DHCP. This isn't visible via '' | Show the local DNS server IP issued by DHCP. This isn't visible via '' | ||
| Line 215: | Line 239: | ||
| if (-not $found) { | if (-not $found) { | ||
| Write-Output "No line containing ' | Write-Output "No line containing ' | ||
| + | }</ | ||
| + | ==== Show SSID History ==== | ||
| + | Show all SSID connected to and DNS IP addresses | ||
| + | < | ||
| + | $folderPath = " | ||
| + | |||
| + | |||
| + | # Define the regex pattern for the file names (GUID format) | ||
| + | $guidPattern = " | ||
| + | |||
| + | |||
| + | # Define the regex pattern to match the template | ||
| + | $pattern = " | ||
| + | |||
| + | |||
| + | |||
| + | # Get all files in the folder | ||
| + | $files = Get-ChildItem -Path $folderPath | ||
| + | |||
| + | # Iterate over each file | ||
| + | foreach ($file in $files) { | ||
| + | # Check if the file name matches the GUID pattern | ||
| + | if ($file.Name -match $guidPattern) { | ||
| + | # Read the content of the file | ||
| + | $fileContent = Get-Content -Path $file.FullName | ||
| + | | ||
| + | |||
| + | # Iterate over each line in the file | ||
| + | foreach ($line in $fileContent) { | ||
| + | # Check if the line matches the pattern | ||
| + | if ($line -match $pattern) { | ||
| + | $guid = $matches[1] | ||
| + | $ssid = $matches[2] | ||
| + | $dhcp = $matches[3] | ||
| + | $ips = $matches[4] -split "," | ||
| + | |||
| + | # Print the extracted data | ||
| + | Write-Output "" | ||
| + | # | ||
| + | Write-Output " | ||
| + | # | ||
| + | foreach ($ip in $ips) { | ||
| + | if ($ip -ne "" | ||
| + | Write-Output " | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | } | ||
| + | |||
| + | } | ||
| }</ | }</ | ||
infoblox_threat_defense/endpoints.1739753641.txt.gz · Last modified: by bstafford