Infoblox Platform logs are delivered in parquet format. You can use the Apache parquet tools that Infoblox provides (click here to access the tools) to convert the parquet files to JSON format if necessary. For more information, see Converting Parquet to JSON.
...
| Field Name | Type | Description |
| opcode | INT32 | opcode for NOTIFY, STATUS, QUERY, UPDATE This is the DNS opcode as defined in RFC 5395. Possible values are |
| timestamp | INT64 | timestamp in second part |
| qname | STRING | DNS query name in FQDN |
| qtype | INT32 | DNS query type |
| qclass | INT32 | DNS query class |
| source | STRING | data source or DNS server ID |
| qip | STRING | Requester IP |
| qport | INT32 | Requester Port |
| rip | STRING | Responder IP |
| rport | INT32 | Responder Port |
| protocol | INT32 | DNS protocol for TCP or UDP |
| delay | FLOAT64 | Delay in response |
| rcode | INT32 | Return code |
| type | INT32 | Message type by ISC: 0: UDP_INVALID 1: UDP_QUERY_RESPONSE 2: UDP_UNANSWERED_QUERY 3: UDP_UNSOLICITED_RESPONSE 4: TCP 5: ICMP 6: UDP_QUERY_ONLY 7: UDP_RESPONSE_ONLY |
| qqr | BOOL | Query flag QR |
| qaa | BOOL | Query flag AA |
| qtc | BOOL | Query flag TC |
| qrd | BOOL | Query flag RD |
| qra | BOOL | Query flag RA |
| qad | BOOL | Query flag AD |
| qcd | BOOL | Query flag CD |
| qdo | BOOL | Query flag DO |
| rqr | BOOL | Response flag QR |
| raa | BOOL | Response flag AA |
| rtc | BOOL | Response flag TC |
| rrd | BOOL | Response flag RD |
| rra | BOOL | Response flag RA |
| rad | BOOL | Response flag AD |
| rcd | BOOL | Response flag CD |
| rdo | BOOL | Response flag DO |
| qqr1 | ARRAY[ResourceRecord] | query resource record list 1 |
| qqr2 | ARRAY[ResourceRecord] | query resource record list 2 |
| qqr3 | ARRAY[ResourceRecord] | query resource record list 3 |
| rrr1 | ARRAY[ResourceRecord] | response resource record list 1 |
| rrr2 | ARRAY[ResourceRecord] | response resource record list 2 |
| rrr3 | ARRAY[ResourceRecord] | response resource record list 3 |
| view | STRING | DNS view |
| anonymized | BOOL | Anonymized flag |
| nanosec | INT32 | Timestamp in nano second part |
| pid | STRING | Policy identifier |
| cid | STRING | Client identifier |
| tid | STRING | Transaction identifier |
| extra | [('sld', 'example.com'), ('pname', 'example'), ('domain_applications', 'example domain application'), ('client_region', 'Region'), ('client_country', 'Country'), ('qname_norm', 'Gname '), ('client_continent', 'Continent'), ('event_date', '2023-07-04 00:26:50.858'), ('response_region', 'Region'), ('application', '[{"category":"Endpoint Protection","id":"54c42618x4c42x18-9790xxxx-45cf5cf-b67gxb67g-2d97135a1442","name":"Name","vendor":"Name"}]'), ('egress_ip', '192.0.2.1'), ('device_name', '192.0.2.2'), ('record_type', '1'), ('all_tags', 'APP_Name_Technology - Other'), ('domain_categories', 'Technology - Other'), ('storage_id', '24010101'), ('response_country', 'Response country'), ('pdisplay_name', 'Display name'), ('network', 'Network name'), ('response', '192.0.2.3'), ('response_continent', 'sample'), ('device_ip', '192.0.2.4'), ('query_type', 'A')] | This existing map field contains all the enriched fields from the pipeline. |
| ancount | INT | Answers count |
| nscount | INT | Nameservers count |
| arcount | INT | Additional records count |
| username | STRING | Username for authenticated users |
| region | STRING | ATC's region |
| cmac | STRING | Client MAC address |
| version | STRING | Schema version |
...
{“opcode”:0,”timestamp”:1525857674,”qname”:”exampledomain.com.”,”qtype”:1,”qclass”:1,”source”:
“3b9eea03015cee5cca1bcb22b02c837c”,”qip”:”192.0.2.1″,”qport”:47″3b9eea03015cee5cca1bcb22b02c837c”,”qip”:”192.0.2.2″,”qport”:47697,”rip”:”
“,”rport”:-1,”protocol”:17,”delay”:1.0,”rcode”:3,”type”:1,”qqr”:false,”qaa”:false,”qtc”:false,”qrd”:false,”qra”:false,
“qad”:false,”qcd”:false,”qdo”:false,”rqr”:true,”raa”:false,”rtc”:false,”rrd”:true,”rra”:false,”rad”:true,”rcd”:false,
“rdo”:false,”rrr1″:{},”rrr2″:{},”rrr3″:{},”view”:””,”anonymized”:false,”nanosec”:220087857,”pid”:”120873″,
“cid”:”:c4f0717dbd1150904aab042e1843a91f”,”tid”:””}
...
Amazon S3 > <bucketname> /archivers/ rpz_enriched / year=xxxx / month=xx / day=xx /hour=xx
Example:
Amazon S3 > testbucket/rpz_enriched /year=2024/month=3/day=3/hour=15/
File format: part-00000-0228fa58-6334-464c-8502-37f04dd40528.c000.snappy.parquet
RPZ
| Field Name | Type | Description |
| opcode | INT32 | opcode for NOTIFY, STATUS, QUERY, UPDATE This is the opcode for the corresponding DNS traffic, such as |
| timestamp | INT64 | timestamp in second part |
| nanosecond | INT32 | Timestamp in nano second part |
| tcode | INT32 | RPZ Trigger code (adapted from ZyTrax) 0: QNAME Trigger on query name 1: CLIENT-IP Trigger on DNS client IP 2: IP Trigger on query response IP 3: NSDNAME Trigger on NS name during delegation 4: NS-IP Trigger on NS IP during delegation |
| tname | STRING | FQDN for RPZ trigger (feedname.rpz_entry or rpz_entry.feedname) |
| acode | INT32 | RPZ Action code (adapted from ZyTrax) 0: Local-Data Response data defined by RR and target name 1: NODATA Return name exists but with no answer data 2: PASSTHRU Do nothing – normally defines an exception in a range 3: NXDOMAIN Return name does not exist 4: TCP-Only Force use of TCP (REDIRECT for policy engine) 5: REFUSED Support for JANUS 6: DROP Causes client timeout |
| arrtype | INT32 | RPZ Action RR type |
| arrdata | STRING | RPZ Action RR data |
| qname | STRING | DNS query name in FQDN |
| qtype | INT32 | DNS query type |
| qclass | INT32 | DNS query class |
| source | STRING | data source or DNS server ID |
| qip | STRING | requester IP |
| qport | INT32 | Requester Port |
| rip | STRING | Responder IP |
| rport | INT32 | Responder Port |
| view | STRING | DNS view (Infoblox feed or others. Optionally prefix with network view qualifier) |
| pvendor | STRING | Product vendor |
| pname | STRING | Product name |
| pversion | STRING | Product version |
| loglevel | INT32 | Syslog severity level indicator |
| disabled | BOOL | Is RPZ rule disabled |
| tid | STRING | Transaction Identifier of DNS response |
| pid | STRING | Policy Identifier (optional) |
| cid | STRING | Client Identifier (optional) |
| anonymized | BOOL | Anonymized flag |
| cmac | STRING | Client MAC address (optional) |
| csite | STRING | Client Site ID (optional) |
| qcat | STRING | Content category (optional) |
| tinfo | STRING | Trigger information: threat property, threat level, threat confidence (optional) |
| username | STRING | Username for authenticated users |
| region | STRING | ATC's region |
| extra | NULL | [('user_name', 'somename'), ('threat_class', 'CAT'), ('sld', 'exampledomain.com'), ('pname', 'remote_client'), ('domain_applications', 'Uncategorized'), ('feed_name', 'SampleFeed'), ('client_region', 'exampleregion'), ('endpointgroups', 'Examplecountry_SEZ_STPI'), ('client_country', 'example_country'), ('qname_norm', 'peers.exampledomain.com'), ('property', 'Business Software'), ('private_ip', '192.0.2.1'), ('category', 'SampleSoftware'), ('client_continent', 'Asia'), ('event_date', '2024-07-28 10:00:00.799'), ('threat_indicator', 'peers.exampledomain.com'), ('mac_address', 'sampleMACaddess'), ('response_region', 'example_response_region'), ('record_type', '3'), ('device_name', 'EXAMPLE.sub.exampledomain.com'), ('policy_name', 'Policy_Name'), ('egress_ip', '192.0.2.2'), ('domain_categories', 'Business Software,Technology - Other'), ('all_tags', 'APP_Uncategorized,CAT_Business Software,CAT_Technology - Other,LIST_658691,LIST_672857'), ('response_country', 'ExampleCountry'), ('storage_id', '302391'), ('pdisplay_name', 'Remote Client (ATeP)'), ('network', 'BloxOne Endpoint'), ('feed_type', 'FQDN'), ('policy_action', 'Redirect'), ('os_version', 'Windows 11 Pro'), ('device_ip', '192.0.2.3'), ('response_continent', 'Asia'), ('response', '192.0.2.4'), ('query_type', 'A')] |
| version | STRING | Schema version |
| key | STRING | example: com.123xyz@123abc |
| sld | STRING | Second level domain (example: googl.com) |
...
{“opcode”:-1,”timestamp”:1521522768,”nanosec”:0,”tcode”:0,”tname”:”exampledomain.co.base.rpz.infoblox.local”,”acode”:3,”arrtype”:-1,”arrdata”:””,”qname”:”exampledomain.com”,”qtype”:1,”qclass”:-1,”source”:””,”qip”:”192.0.2.1″,”qport”:39826,”rip”:”192.0.2.2″,”rport”:-1,”view”:”_default”,”pvendor”:”Infoblox”,”pname”:”NIOS”,”pversion”:”8.2.0-357775″,”loglevel”:7,”disabled”:false,”tid”:””,”pid”:””,”cid”:””,”anonymized”:false,”cmac”:””,”csite”:””,”qcat”:””,”tinfo”:””}
...
java -jar parquet-tools-1.10.1-SNAPSHOT.jar cat -j ipmeta_Update_1521240816_0000000000_01965.parquet
{“opcode”:2,”source”:”192.0.2.1″,”timestamp”:1521535044,”nanosec”:0,”cip”:”192.0.2.2″,”hostnames”:{},”usernames”:{“array”:[{“name”:”frtest”,”actfrom”:1521238758,”actto”:1521534479}]},”mac”:””,”view”:”default”,”fingerprint”:””,”os”:””,”firstts”:-1,”lastts”:-1,”extattrs”:{},”anonymized”:false}
...