---
url: https://docs.realmsec.info/integration/infoblox_threat_defense.md
---

# Infoblox Threat Defense

Realm Security integrates seamlessly with Infoblox NIOS appliances, enabling intelligent routing and analysis of security event logs.

[Infoblox Data Connector](https://docs.infoblox.com/space/BloxOneCloud/35429862/Deploying+the+Data+Connector+Solution) supports sending log data to configured destinations using the generic syslog protocol in CEF format.

Data Flow:

```text
Sources > Infoblox Data Connector > Syslog Destination

(NIOS, Infoblox Threat Defense, Universal DDI) > Infoblox Data Connector > (Realm Data Collector)
```

## Setup Infoblox Source in Realm

1. Login to Realm console.
2. Go to **Sources > Add > Infoblox / Data Connector** and add a new Source.
   > **Name:** `Infoblox`
   > **Description:** `Infoblox logs`
3. If a collector is already set up, go to **Collectors** and select your collector. If not, go to **Collectors > Add** and give it a name and description.
4. Add an Infoblox stream to the Collector. Click **Add Stream**.
   > **Product Format:** `Infoblox / Data Connector`
   > **Source:** `Infoblox`
   > **Framing Trailer:** `LF`
5. Click **Add Stream**.
6. The port number listed for the Infoblox stream is the syslog receiving port on the collector. You will need this when configuring Infoblox Syslog export.

## Prerequisites

* Ensure you have administrative access to your Infoblox NIOS.
* Realm Collector is set up and running. See [Realm Collector install guide](/integration/collector) for setting up a collector.
* Realm Security syslog collector IP address or FQDN.
* Realm Collector receiving port number. In the Realm console, go to **Collectors > select collector** and copy the port number listed for the Infoblox Stream.

## Setup Infoblox Data Connector

Follow these steps to configure syslog forwarding from your [Infoblox Data Connector](https://docs.infoblox.com/space/BloxOneCloud/35428954/Data+Connector) to Realm Security Data Fabric.

### Deploy Data Connector

[Deploy](https://docs.infoblox.com/space/BloxOneCloud/367329512) the Infoblox Data Connector VM.

### Enable Connector Service

Navigate to the Infoblox Portal and enable the Data Connector service.

### Configure Sources

[Configure Sources](https://docs.infoblox.com/space/BloxOneCloud/35366317/Configuring+Sources): specify the data sources that the Data Connector will use.

### Configure Destination

[Configure a Destination](https://docs.infoblox.com/space/BloxOneCloud/35430092/Configuring+Destinations) to send data to the Realm Data Collector.

> You can configure multiple destinations of different types on the same Data Connector — for example, a single Data Connector can be used to create cloud and syslog destinations.

1. Log in to the Infoblox Portal.
2. Click **Configure > Administration > Data Connector**.
3. Select the **Destination Configuration** tab and click **Create**.
4. From the **Create** drop-down list, select **Syslog**. Follow the instructions to set up a [Syslog destination](https://docs.infoblox.com/space/BloxOneCloud/35366990/Setting+Up+Syslog).
5. In the **Create Syslog Destination Configuration** wizard, enter:
   > **Name:** `Realm Data Collector`
   > **Description:** `Realm data collector via Syslog & CEF`
   > **State:** `Enabled` (use the slider to enable the destination)
   > **Format:** `CEF`
   > **Protocol:** `TCP`
   > **FQDN/IP:** IP or FQDN of the Realm Data Collector VM
   > **Port:** Receiving port for the Realm Collector Stream
6. Click **Save & Close**.

### Setup Traffic Flow

[Create a new Traffic Flow](https://docs.infoblox.com/space/BloxOneCloud/35367017/Creating+Traffic+Flows) if required. Traffic flows connect Data Connector sources to a destination.

1. Go to **Configure > Administration > Data Connector**.
2. In the **Traffic Flow Configuration** tab, click **Create Configuration**.
3. In the **Create New Data Configuration** wizard, enter:
   > **Name:** `Realm Data Collector`
   > **Description:** Describe all the sources that will be forwarded to the Realm Data Collector
   > **State:** `Enabled` (use the slider to enable the traffic flow)
4. Click **Next**.
5. Under **Log Source Configuration**, click **Add Log Type**.
   * Select an existing source or click **Add** to create a new source.
   * **Infoblox Cloud Source:** Select from `Audit Log`, `Internal Notifications`, `Service Log`, `Threat Defense Threat Feeds Hits Log`, `Threat Defense Query/Response Log`, `DDI DHCP Lease Log`, or `DDI Query/Response Log`.
   * **CDC-NIOS source:** Select from `IPAM Metadata/DHCP Lease Information`, `Query/Response Log`, or `RPZ Logs`.
6. Click **Next**.
7. **Destination Configuration:** Select one of the available destinations or click **Add** to create a new destination.
8. Click **Next**.
9. **Service Instance:** Choose a service instance from the drop-down menu.
10. **Summary:** Review the details of the traffic flow.
11. Click **Save & Close**.

## Verify Configuration

Navigate to **Configure > Administration > Data Connector > Traffic Flow Configuration > Destination Configuration**, select **Realm Data Collector**, then select the individual Traffic Flow configuration to review Last Health Check & Traffic Flow status.

Confirm with Realm Security Data Fabric that logs are being received and correctly parsed.

## Support

For additional details, refer to the official [Infoblox Data Connector documentation](https://docs.infoblox.com/space/BloxOneCloud/35428954/Data+Connector).

If you encounter any issues or require assistance, contact Realm Security support.

## Event Metadata

The following additional metadata fields will be included with the events.

| Field Name | Value |
| ---------- | --------------- |
| \_sourceCategory | `infoblox/threat_defense`|