---
url: https://docs.realmsec.info/integration/infoblox.md
---

# Infoblox NIOS

Realm Security integrates with Infoblox NIOS to collect DNS, DHCP, NTP, authentication, and other appliance logs. NIOS forwards logs directly over syslog to a Realm Collector running in your environment.

Data Flow:

```text
Infoblox NIOS Grid Members > Syslog > Realm Collector > Realm Cloud
```

> **Note:** This page covers sending syslog directly from NIOS appliances. To forward Infoblox Threat Defense logs through the Infoblox Data Connector in CEF format, see the [Infoblox](/integration/infoblox) integration instead.

## Prerequisites

* Administrative access to the NIOS Grid Manager, with permission to edit **Grid Properties** (and **Member Properties** if you override syslog settings per member).
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* The IP address of the Realm Collector. NIOS accepts only an IPv4 or IPv6 address for an external syslog server — an FQDN cannot be used.
* Network connectivity from the NIOS Grid members (LAN1 or MGMT interface) to the Realm Collector on the stream port.

## Setup Infoblox NIOS Source in Realm

1. Login to Realm console.
2. Go to **Sources > Add > Infoblox NIOS** and add a new Source.
   > **Name:** `Infoblox NIOS`\
   > **Description:** `Infoblox NIOS syslog`
3. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description.
4. Add an Infoblox NIOS stream to the Collector. Click **Add Stream**.
   > **Product Format:** `Infoblox NIOS`\
   > **Port:** Select a unique port for this collector or use the Realm generated port.\
   > **Source:** `Infoblox NIOS`
5. Click **Add Stream**.
6. Take note of the port assigned to the Infoblox NIOS stream. You will need it when configuring the external syslog server in NIOS.

## Configure NIOS Syslog Forwarding

For full background, see Infoblox's [Using a Syslog Server](https://docs.infoblox.com/space/nios85/35784616/Using+a+Syslog+Server) documentation. The steps below configure syslog forwarding at the Grid level, which applies to all Grid members.

### Enable External Syslog

1. Log in to the NIOS Grid Manager.
2. Go to **Grid > Grid Manager > Members**.
3. From the Toolbar, click **Grid Properties > Edit**.
4. In the **Grid Properties** editor, select the **Monitoring** tab.
5. In the **Syslog** section, check **Log to External Syslog Servers**.

### Add the Realm Collector as a Syslog Server

1. In the **External Syslog Servers** table, click the **Add** icon.
2. Configure the server:
   > **Address:** IP address of the Realm Collector\
   > **Transport:** `TCP`\
   > **Interface:** `Any`\
   > **Source:** `Any`\
   > **Node ID:** `Host Name`\
   > **Port:** Port number assigned to the Infoblox NIOS stream in Realm\
   > **Severity:** `info`\
   > **Logging Category:** `Send all`
3. Click **Add** to add the server to the table.
4. Click **Save & Close**.
5. If a **Restart** banner appears at the top of the screen, click **Restart** to apply the changes.

Field reference:

| Field | Recommended Value | Notes |
| ----- | ----------------- | ----- |
| **Transport** | `TCP` | `TCP` provides reliable delivery. `UDP` is supported by NIOS but messages may be dropped. Use `Secure TCP` only if your Realm Collector stream is configured for TLS — contact Realm Security support first, as this requires a server certificate to be uploaded to NIOS. |
| **Interface** | `Any` | `LAN` sends from the LAN1 port. `MGMT` sends from the MGMT port if configured, otherwise LAN1. Choose the interface that has a route to the Realm Collector. |
| **Source** | `Any` | `Internal` sends only messages the appliance generates. `External` sends only messages the appliance receives from other devices. `Any` sends both. |
| **Node ID** | `Host Name` | Identifies the sending appliance in each message. `Host Name` uses the appliance FQDN. Other options are `LAN` (LAN1 IP, the NIOS default), `IP and Host Name`, and `MGMT` (MGMT IP, or LAN1 if MGMT is not configured). |
| **Port** | Realm stream port | Do not use the NIOS default (`514` for TCP/UDP, `6514` for Secure TCP) unless it matches the port assigned to the Realm stream. |
| **Severity** | `info` | NIOS sends messages at the selected level and all levels above it. `info` includes DNS and DHCP activity. Avoid `debug` unless requested by Realm Security support, as it significantly increases volume. |
| **Logging Category** | `Send all` | `Send all` forwards all categories without prefixes. `Send selected categories` limits forwarding to the categories you choose and prefixes each message with its category name. |

> **Note:** If you choose **Send selected categories**, select from DNS, ADP, DHCP, DTC, Cloud, NTP, File Distribution, Authentication, and Microsoft Integration. To log individual DNS queries and responses, query and response logging must also be enabled under the Grid DNS properties in NIOS.

### Override Syslog Settings for a Member (Optional)

To send a specific Grid member's logs to a different collector, or with different settings:

1. Go to **Grid > Grid Manager > Members**, select the member, and click **Edit**.
2. In the **Member Properties** editor, select the **Monitoring** tab, then the **Basic** tab.
3. In the **Syslog** section, click **Override**.
4. Configure the external syslog server as described in [Add the Realm Collector as a Syslog Server](#add-the-realm-collector-as-a-syslog-server).
5. Click **Save & Close**, then click **Restart** if prompted.

## Verify Configuration

1. In the Realm console, go to **Collectors**, select your collector, and check the Infoblox NIOS stream for incoming events.
2. If no events arrive, confirm that the Grid members can reach the Realm Collector IP address on the stream port, and that any firewalls between them allow TCP traffic on that port.

## Support

For additional details, refer to the official Infoblox [Using a Syslog Server](https://docs.infoblox.com/space/nios85/35784616/Using+a+Syslog+Server) documentation.

If you encounter any issues or require assistance, contact Realm Security support.