infoblox_threat_defense:tide
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| infoblox_threat_defense:tide [2026/02/02 10:46] – [Your Uploaded Data] bstafford | infoblox_threat_defense:tide [2026/03/31 22:44] (current) – bstafford | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== TIDE ====== | ====== TIDE ====== | ||
| TIDE is Threat Intelligence Data Exchange. It is effectively a very large Threat Database that is managed by the Infoblox Threat Intelligence Team. From its database, the Infoblox RPZ feeds are generated. | TIDE is Threat Intelligence Data Exchange. It is effectively a very large Threat Database that is managed by the Infoblox Threat Intelligence Team. From its database, the Infoblox RPZ feeds are generated. | ||
| + | |||
| + | NOTE: When you add indicators via TIDE, be aware that the associated RPZ feed will filter out anything that is in Infoblox' | ||
| ===== Active Indicators ===== | ===== Active Indicators ===== | ||
| Line 8: | Line 10: | ||
| Test RPZ data [[infoblox_threat_defense: | Test RPZ data [[infoblox_threat_defense: | ||
| + | |||
| + | NOTE: If you upload data to a custom TIDE profile, then if any indicator in that profile matches the Infoblox Allowlist feed, that indicator will be suppressed from the customer TIDE profile RPZ feed. i.e. if you try to add brave[.]com to your custom TIDE data, it won't appear in the associate RPZ feed because that indicator is also on Infoblox Allowlist. You can't download the Infoblox Allowlist but you can check any specific indicator against Dossier to see if it is on the Infoblox Allowlist (JSON data via API will have it as ' | ||
| ===== List TIDE Data ===== | ===== List TIDE Data ===== | ||
infoblox_threat_defense/tide.1770029178.txt.gz · Last modified: by bstafford