infoblox_threat_defense:tide
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| infoblox_threat_defense:tide [2024/12/27 15:12] – created bstafford | infoblox_threat_defense:tide [2026/03/31 22:44] (current) – bstafford | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== TIDE ====== | ====== TIDE ====== | ||
| TIDE is Threat Intelligence Data Exchange. It is effectively a very large Threat Database that is managed by the Infoblox Threat Intelligence Team. From its database, the Infoblox RPZ feeds are generated. | TIDE is Threat Intelligence Data Exchange. It is effectively a very large Threat Database that is managed by the Infoblox Threat Intelligence Team. From its database, the Infoblox RPZ feeds are generated. | ||
| + | |||
| + | NOTE: When you add indicators via TIDE, be aware that the associated RPZ feed will filter out anything that is in Infoblox' | ||
| ===== Active Indicators ===== | ===== Active Indicators ===== | ||
| Line 7: | Line 9: | ||
| Infoblox has harmless test domains that are in various RPZ feeds. This allows you to test that a given RPZ feed is active and working as well as generate example logs, etc. | Infoblox has harmless test domains that are in various RPZ feeds. This allows you to test that a given RPZ feed is active and working as well as generate example logs, etc. | ||
| - | Test RPZ data [[infoblox: | + | Test RPZ data [[infoblox_threat_defense: |
| + | |||
| + | NOTE: If you upload data to a custom TIDE profile, then if any indicator in that profile matches the Infoblox Allowlist feed, that indicator will be suppressed from the customer TIDE profile RPZ feed. i.e. if you try to add brave[.]com to your custom TIDE data, it won't appear in the associate RPZ feed because that indicator is also on Infoblox Allowlist. You can't download the Infoblox Allowlist but you can check any specific indicator against Dossier to see if it is on the Infoblox Allowlist (JSON data via API will have it as ' | ||
| ===== List TIDE Data ===== | ===== List TIDE Data ===== | ||
| Line 141: | Line 145: | ||
| SUBRL is SPAM URI (Uniform Resource Identifier) Real-time Block List. | SUBRL is SPAM URI (Uniform Resource Identifier) Real-time Block List. | ||
| + | * Infoblox Curated Data - Data created by Infoblox | ||
| + | * Infoblox 3rd Party Data - Data from Infoblox 3rd Parties that make into Infoblox 3rd party feeds (e.g. DHS, Farsight, etc) | ||
| + | * Your Uploaded Data - Your data that you uploaded to TIDE | ||
| =====Your Uploaded Data===== | =====Your Uploaded Data===== | ||
| * 0011A00001AaA1aAAA: | * 0011A00001AaA1aAAA: | ||
| Line 177: | Line 184: | ||
| Upload with CURL | Upload with CURL | ||
| < | < | ||
| + | You will see output like | ||
| + | < | ||
| The recommended limit for the number of records in a given data submission is 50,000. The maximum number of records should be no more than 60,000 at this point in time. | The recommended limit for the number of records in a given data submission is 50,000. The maximum number of records should be no more than 60,000 at this point in time. | ||
| Line 232: | Line 241: | ||
| APIKEY=SET_APIKEY | APIKEY=SET_APIKEY | ||
| curl -X GET -H " | curl -X GET -H " | ||
| + | |||
| + | ====Sitting ducks==== | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | ====Lookalikes==== | ||
| + | < | ||
| + | |||
| + | |||
| + | |||
| + | ====Compromised Domains==== | ||
| + | < | ||
| + | |||
| ==== Get Newly Observed Domains==== | ==== Get Newly Observed Domains==== | ||
| < | < | ||
infoblox_threat_defense/tide.1735312330.txt.gz · Last modified: by bstafford