Saucepan

User Tools

Site Tools

Trace: • rpz_feeds • test_domains
infoblox_threat_defense:threat_insight

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
infoblox_threat_defense:threat_insight [2025/12/10 00:37] – bstaffordinfoblox_threat_defense:threat_insight [2026/01/21 09:17] (current) – bstafford
Line 28: Line 28:
 Syslog of Hit (src = client that made the query to NIOS) Syslog of Hit (src = client that made the query to NIOS)
 <code>src=10.10.20.20 spt=53198 view=_default qtype=A msg="rpz QNAME CNAME rewrite ws-zw9yt1viqsxqrc8ilpp06my7qoinq3kxphttfio969l15lqsvw.example.com [A] via ws-zw9yt1viqsxqrc8ilpp06my7qoinq3kxphttfio969l15lqsvw.example.com.threatinsightfeed.local" CAT=RPZ</code> <code>src=10.10.20.20 spt=53198 view=_default qtype=A msg="rpz QNAME CNAME rewrite ws-zw9yt1viqsxqrc8ilpp06my7qoinq3kxphttfio969l15lqsvw.example.com [A] via ws-zw9yt1viqsxqrc8ilpp06my7qoinq3kxphttfio969l15lqsvw.example.com.threatinsightfeed.local" CAT=RPZ</code>
 +
 +A major differentiator between Threat Insight and Threat Insight in the Cloud is that Threat Insight in the Cloud, although slower due to the time spent transporting data to the cloud, blocking of malicious DNS traffic is more advanced and has a greater processing capability to deal with a wider range of threats. For example, it can protect against DGA and Fast Flux activity and deal with "lower and slower" exfiltration attempts, while Threat Insight on-premise is faster it can’t protect against Data Exfiltration, DNS Messenger, Fast Flux, DGA.
 +
infoblox_threat_defense/threat_insight.1765327040.txt.gz · Last modified: by bstafford