...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
NIOS RPZ feed recommendations to use after the feed revamp release occurring in
...
early 2025.
This document provides NIOS RPZ feed recommendations, the release of new threat feeds in April 2024, and best practices for transitioning to the new threat feeds.
Infoblox offers a set of new RPZ feeds designed to replace the deprecated ones, including — Infoblox Base, High Risk, Medium Risk, Low Risk, and Informational — designed to replace the deprecated ones.
The old RPZ feeds will be deprecated on January 31, in early 2025, while the new replacements will be released in April 2024.
Infoblox recommends switching to the new threat feeds in April 2024, for continued comprehensive threat protection.
Best practices involve removing to-be-deprecated feeds before their end-of-service (EOS) date (January 31, early 2025) and replacing them with recommended feeds from Infoblox. This overlapping period of time between the release of the new feeds and the deprecation of the old feeds should allow sufficient time to transition to the new threat feeds.
...
We are also upgrading our security feed structure to simplify the policy action on those feeds, to enable the right security posture. Beyond high-quality feeds, it's equally important to have the right policy action in place for those detection detections to block and protect users. With the new structure, feed feeds’ names reflect the severity of the indicators it carries, per threat and confidence score of the indicator. So it's ; therefore, it is easy and intuitive to apply the right action for those feeds. General Availability: End of April, 2024. Earlier, when a malicious domain’s TTL expires, the domain was added to the corresponding Extended feeds, extending their lifetime. We updated that logic to verify the validity of the domain, on expiry.
This guide aims to facilitate the transition from the soon-to-be deprecated Infoblox Threat Defense feeds approaching end of service EOS to their updated versions, which are to be integrated into NIOS Response Policy Zones (RPZRPZs). Infoblox recommends that NIOS users currently relying on the soon-to-be-deprecated feeds switch to the new feeds as they become available in April 2024, to ensure continued comprehensive threat protection.
...
Infoblox recommends the following as best practices for customers currently using the feeds to be deprecated.:
Remove all to-be-deprecated feeds from NIOS RPZ prior to their EOS date on January 31, in early 2025. Replace the deprecated feeds with the recommendations as provided by Infoblox. When the to-be-deprecated feeds reach EOS, NIOS will no longer be able to sync them from the Infoblox Portal, leading and this will lead to an error state.
When replacing feeds with the recommendations below, consider policy settings, eg., such as logging vs. blocking, of currently used feeds and replicate them for the replacements.
RPZ Feeds Scheduled for Deprecation
...
in early 2025
The following feeds are approaching end of service EOS and are being deprecated. In their place, Infoblox offers a set of new RPZ feeds designed to replace the deprecated feeds.
Deprecated RPZ Feeds | Deprecated RPZ Feed Name | Description |
|---|---|---|
Base Hostnames | base.rpz.infoblox.local | Enables protection against known hostnames that are dangerous as destinations, such as APT, Bot, Compromised Host/Domains, Exploit Kits, Malicious Name Servers, and Sinkholes. |
AntiMalware | antimalware.rpz.infoblox.local | Enables protection against known malicious hostname threats that can take action on or control of your system, such as Malware Command & Control, Malware Download, and active Phishing phishing sites. |
Ransomware | ransomware.rpz.infoblox.local | Enables protection against ransomware taking over your system. Ransomware will encrypt files on your system and require you to pay in order to get them decrypted. This feed prevents ransomware to contact from contacting the servers, which it needs must do to encrypt your files. |
Malware DGA Hostnames | malware-dga.rpz.infoblox.local | Domain generation algorithm algorithms (DGADGAs) are algorithms seen in various families of malware that are used to periodically generate a large number of domain names that can be used as rendezvous points with their command and control servers. Examples include are Ramnit, Conficker, and Banjori. |
Antimalware IP | antimalware-ip.rpz.infoblox.local | Enables protection against known malicious or compromised IP addresses. These are known to host threats that can take action on or control of your system, such as Malware Command & Control, Malware Download, and active Phishing sites. |
Suspicious | suspicious.rpz.infoblox.local | The Suspicious Domains feed enables protection against hostnames that have not been directly linked to malicious behavior but behave in a manner that suggests malicious behavior may be imminent. |
Suspicious Lookalike | suspicious-lookalikes.rpz.infoblox.local | The Suspicious Lookalikes feed includes domains that appear to impersonate other trusted domains , but have demonstrated enough abnormal behavior to warrant concern. |
Suspicious NOED | suspicious-noed.rpz.infoblox.local | The Suspicious Emergent Domains feed include includes high-risk, new domains. These domains have only recently become active , and warrant concern because they share one or more characteristics with other known malicious domains to warrant concern. |
Newly Observed Emergent Domains | noed.rpz.infoblox.local | The NOED feed includes recently created and newly active domain names. These are not necessarily suspicious, but some organizations may wish to log traffic going to these domains as there is a low likelihood that these domains would be visited normally. |
...
With the deprecation of the old RPZ feeds and the release of the new RPZ feeds, infoblox Infoblox will also be deprecating the extended feeds listed below. In the case of these feeds, they These feeds have lately been carrying zero indicators. Earlier when a malicious domain’s TTL expiresexpired, the domain was added to the corresponding Extended feeds, extending their lifetime. We updated that logic to verify the validity of the domain, on expiry. The domain is added to the same feed if it 's is still valid (as opposed to separate Extended feeds). As a result, the extended feeds were have been carrying zero indicators lately. At this point, we can effectively deprecate the below following extended feeds.:
Deprecated Extended RPZ Feed | Deprecated Extended RPZ Feed Feed’s Name |
|---|---|
Extended Base & anti-malware Hostnames | ext-base-antimalware.rpz.infoblox.local |
Extended Ransomware | ext-ransomware.rpz.infoblox.local |
Extended AntiMalware IPs | ext-antimalware-ip.rpz.infoblox.local |
We also do not see much value having a separate feed for Spam IPs. IPs can be reassigned and result in false positives. Those confirmed IPs that are part of malicious infrastructure are already part of Critical IP feeds that we monitor and update. This spambot IP feed has had 0 indicators for a while now; therefore, therefore we can effectively deprecate this feed.
...
Given that we have consolidated and simplified the core feed structure, there is no need for the Combination feeds. Combination feed was feeds were introduced to provide the ability to abstract the details of individual feed feeds and create a wrapper for extreme, high, medium, and low risk. The consolidated and simplified new core feeds provide that in the feed itself, and the name of the core feeds reflect reflects the risk level. For those reasons, we deprecated the below following Combination feeds will be deprecated.:
Deprecated Combination RPZ Feed | Deprecated Combination RPZ Feed Feed’s Name |
|---|---|
Extreme Block | ib-extreme-block.rpz.infoblox.local |
Extreme Log | ib-extreme-log.rpz.infoblox.local |
High Block | ib-high-block.rpz.infoblox.local |
High Log | ib-high-log.rpz.infoblox.local |
Med Block | ib-med-block.rpz.infoblox.local |
Med Log | ib-med-log.rpz.infoblox.local |
Low Block | ib-low-block.rpz.infoblox.local |
Low Log | ib-low-log.rpz.infoblox.local |
Availability of New NIOS RPZ Feeds
...
(April 2024)
The following NIOS RPZ feeds are available based on your subscription level. :
Feed Availability | |||
|---|---|---|---|
Feed Name | Essentials | Business On-Prem | Advanced |
Infoblox Base | ✔ | ✔ | ✔ |
Infoblox Base IP | NA | ✔ | ✔ |
Infoblox High Risk | NA | NA | ✔ |
Infoblox Medium Risk | NA | NA | ✔ |
Infoblox Low Risk | NA | NA | ✔ |
Infoblox Informational | NA | ✔ | ✔ |
Feed Feed’s Name | RPZ Feed Feed’s Name | Description |
Infoblox Base | infoblox-base.rpz.infoblox.local | Infoblox Base feed enables protection against known malicious or compromised domains. This includes known Malware, Ransomware, such as known malware, ransomware, APTs, exploit kits, malicious Name Serversname servers, and sinkholes etc. We recommend blocking them for all users. |
Infoblox Base IP | infoblox-base-ip.rpz.infoblox.local | Infoblox Base IP feed enables protection against known malicious or compromised IP addresses. These IPs are known infrastructure to host threats that can act on or control a system by way of C&C malware downloads and active phishing sites. We recommend blocking them for all users. |
Infoblox High Risk | infoblox-high-risk.rpz.infoblox.local | Infoblox High Risk feed includes domains that are not confirmed yet but are highly suspicious. It 's is very likely to be used in a malicious act at some point. These domains, though unconfirmed, carry high threat and high confidence, so we recommend blocking them for most users. It includes Suspicious domains, Suspicious Lookalikes and Suspicous They include suspicious domains, suspicious lookalikes, and suspicious NOED (Newly Observed Emergent Domains) with a high combined score of threat and confidence levels. |
Infoblox Medium Risk | infoblox-med-risk.rpz.infoblox.local | Infoblox Medium Risk feed includes domains that are not confirmed yet but still pose medium risk. They are suspicious domains with lower a combined score of Threat and Confidence level than threat and confidence levels lower than those of domains in the High Risk feed but higher than those of domains in the Low Risk feed. It's still could likely They could still be used in a malicious act, so we recommend blocking them for most users. It The feed includes Suspicious domains, Suspicious Lookalikes, and Suspicious NOED (Newly Observed Emergent Domains) with medium combined score of threat and confidence levels. |
Infoblox Low Risk | infoblox-low-risk.rpz.infoblox.local | Infoblox Low Risk feed includes domains that are not confirmed yet but are still suspicious. It 's is possible it the domains can be used in a malicious act. These domains carry a lower combined score of threat and confidence levels. Its recommended to monitor with We recommend monitoring of this feed with the Allow-WithLog option, for most users, and have having it in block mode for sensitive environments. It The feed includes Suspicious domains, Suspicious Lookalikes, and Suspicious NOED (Newly Observed Emergent Domains) with a lower combined score of threat and low confidence levels. |
Infoblox Informational | infoblox-informational.rpz.infoblox.local | Infoblox Informational: Infoblox Informational feed includes domains with low threat and confidence levels. These are for informational use per policy and sensitivity of the environment. This The feed carries Newly Observed Emergent Domains (NOED). It's recommended to monitor with We recommend monitoring it with the Allow-WithLog option, for most users, and have having it in block mode for sensitive environments (as new : New domains are not mission critical, for the most part, and it is best to that you enable them when they are established for a longer time). |
Recommended Replacement Feed Mapping for NIOS (based on the subscription level)
The following are the recommended NIOS feed replacements based on the subscription level. For Infoblox For Infoblox Threat Defense Advanced, please pay special attention must be placed on your appliance to your appliance’s capacity when selecting replacement feeds.
Infoblox Threat Defense Essentials
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
Warning: Old The conversions of the old feed to New feeds conversion new feed are shown for parity reasons. You need to configure per your appliance and what is allowed per the appliance sizing. If you need the feed , but your appliance cannot handle that volume, please work with sales to upgrade the appliance. For information on feed recommendation recommendations per appliance sizing, please see see Sizing Guidelines for Trinzic Appliances. |
...
Infoblox Business On-Prem and Business Cloud subscriptions contain all feeds included with the Infoblox Essentials subscription plus the InfobloxEssentials subscription in addition to the following RPZ feeds:
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
Warning: Old The conversions of the old feed to New feeds conversion new feed are shown for parity reasons. You need to configure per your appliance and what is allowed per the appliance sizing. If you need the feed , but your appliance cannot handle that volume, please work with sales to upgrade the appliance. For information on feed recommendation recommendations per appliance sizing, please see see Sizing Guidelines for Trinzic Appliances. |
Infoblox Threat Infoblox Threat Defense Business On-Prem and Business Cloud RPZ Cloud RPZ Feed Mapping(old to new feeds) | ||
|---|---|---|
Old Feeds | to | New Feeds |
Infoblox Antimalware IP | => | Infoblox Base IP |
Newly Observed Emergent Domains (NOED) | => | Infoblox Informational |
Infoblox Business On-Prem contains all feeds included with with an Infoblox Essentials subscription in addition to the feeds listed above. | ||
Infoblox Threat Defense Advanced
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
Warning: Old The conversions of the old feed to New feeds conversion new feed are shown for parity reasons. You need to configure per your appliance and what is allowed per the appliance sizing. If you need the feed , but your appliance cannot handle that volume, please work with sales to upgrade the appliance. For information on feed recommendation recommendations per appliance sizing, please see Sizing Guidelines for Trinzic Appliances. |
For NIOS customers possessing a If you are a NIOS subscriber with an Infoblox Threat Defense Advanced subscription, attention must be placed on your appliance please pay special attention to your appliance’s capacity when selecting your RPZ feeds.
The Infoblox Threat Defense Advanced subscription contains all feeds included with Infoblox Essentials and Infoblox Business tier subscriptions plus the in addition to the following RPZ feeds:
Infoblox Threat Defense Advanced RPZ Feed Mapping(old to new feeds) | ||
|---|---|---|
Old Feeds | to | New Feeds |
Suspicious | => | Infoblox High Risk |
The Infoblox Threat Defense Advanced subscription contains all feeds included with Infoblox Essentials and Infoblox Business tier subscriptions in addtion to addition to the feeds listed above. Do note that for NIOS subscribers of a If you are a NIOS subscriber with an Infoblox Threat Defense Advanced subscription, attention must be placed on your appliance please pay special attention to your appliance’s capacity when selecting your RPZ feeds. | ||
Removal of NIOS RPZ Feeds to be Deprecated
...
in early 2025
Note: The old feeds are being deprecated on January 31, in early 2025; however, the new feeds that are intended to be their replacements are being were released in April 2024.
Before adding the new NIOS RPZ feeds, you must first identify and remove the existing feeds approaching EOS. To do this, follow these steps:
In NIOS Grid Manager, navigate to Data Management > DNS > Response Policy Zones.
Identify the current NIOS feeds for removal. These can be identified by their names:
base.rpz.infoblox.local
antimalware.rpz.infoblox.local
ransomware.rpz.infoblox.local
malware-dga.rpz.infoblox.local
antimalware-ip.rpz.infoblox.local
suspicious.rpz.infoblox.local
suspicious-lookalikes.rpz.infoblox.local
suspicious-noed.rpz.infoblox.local
noed.rpz.infoblox.local
ext-base-antimalware.rpz.infoblox.local
ext-ransomware.rpz.infoblox.local
ext-antimalware-ip.rpz.infoblox.local
spambot-dnsbl-ip.rpz.infoblox.local
ib-extreme-block.rpz.infoblox.local
ib-extreme-log.rpz.infoblox.local
ib-high-block.rpz.infoblox.local\
ib-high-log.rpz.infoblox.local
ib-med-block.rpz.infoblox.local
ib-med-log.rpz.infoblox.local
ib-low-block.rpz.infoblox.local
ib-low-log.rpz.infoblox.local
Note: The availability of the new RPZ feeds is dependent on the subscription level.
Note: If you have a large number of RPZs, use the search function to locate the feeds to be removed.
...
Select the checkbox associated with one of the feeds to be removed.
Click the trash can icon or the Delete button in the toolbar.
Click Yes in the Delete Confirmation dialogue dialog.
If you are removing multiple feeds, repeat steps 3-5 for each.
Deletion of RPZs requires a service restart. Click Restart located in the top , yellow banner to perform a system restart.
In the Restart Grid Services dialog, adjust the Restart Method if desired, and then click Restart.
Adding the New NIOS RPZ Feeds
...
Released
...
in April 2024
Feed and Distribution Server Configuration Values
To get the configuration information for the new, replacement NIOS RPZ feeds, you need to find out the feed feeds’ names and the configuration details for the distribution server.
In the Infoblox Portal, navigate to Configure > Security > On-Prem DNS Firewall.
Click on Feed Configuration Values.
In the Threat Feed Details list, locate the first feed you will configure. Refer to the table in the Replacement Feed Mapping section for recommended feeds.
Click the Copy button for the desired feed. Note: Paste this and other configuration data copied in this section into a text file, for easy retrieval when configuring the feeds in NIOS.
Repeat steps 3 and 4 for each feed. Refer to the table in the Replacement Feed Mapping section for recommended feeds.
Click Close.
Click on Distribution Server Configuration Values.
Scroll down to locate the Distribution Server you will use, and click the Copy button for the IPv4 or IPv6 server. Note: Paste this and other configuration data copied in this section into a text file, for easy retrieval when configuring the feeds in NIOS.
Scroll down to the TSIG section.
Note the Key Algorithm that is configured.
Copy the Key. Note: Paste this and other configuration data copied in this section into a text file, for easy retrieval when configuring the feeds in NIOS.
Copy the TSIG. Note: Paste this and other configuration data copied in this section into a text file, for easy retrieval when configuring the feeds in NIOS.
Click Cancel to exit the Distribution Server.
...
Adding RPZ Feeds in NIOS
To add the new, replacement RPZ feeds in NIOS, perform , the following. :
In NIOS Grid Manager, navigate to Data Management > DNS > Response Policy Zones.
Click the add icon or the Add button in the toolbar.
On Step 1 In the first step of the Add Response Policy Zone Wizardwizard, select Add Response Policy Zone Feed.
Click Next.
On Step 2In the second step, paste the Name of the feed, as copied from the Infoblox Portal.
Optionally, adjust Policy Override and Severity.
Click Next.
...
On Step 3, use the Add button dropdown to select External Primary. Note: To save time, you can instead use a nameserver group configured with the external primary and any Grid secondaries to be used for all RPZs. Refer to NIOS Documentation for additional information on creating nameserver groups.
...
Enter a Name. Note: This field is for reference
...
only
...
; use any name you choose.
Enter the Address of the distribution server
...
, copied from the Infoblox Portal.
Select the box for Use TSIG.
Enter the Key Name as it is copied from the Infoblox Portal.
Select the Key Algorithm as
...
it is copied from the Infoblox Portal.
Enter the Key Data as it is copied from the Infoblox Portal.
Click Add.
Use the Add button
...
, and then select Grid Secondary from among the menu
...
choices.
Click Select
...
, and then choose the NIOS member to update. Note: You can configure a single secondary to be “Lead Secondary”. If you select this, then that member will be the only one to reach out to the external primary. The feed is then redistributed between members by using zone transfers.
Click Add.
(Optional) Repeat Steps 17 and 18 to add
...
more NIOS appliances as secondaries.
...
Click Save & Close.
Repeat steps 2-20 for each feed you are adding.
...
Adding an RPZ requires a service restart
...
. In the banner at the top of the Grid Manager window, click
...
Restart.
In the Restart Grid Services dialog, adjust the Restart Method if desired and click Restart.
(Optional) Once you have added all feeds, use the Order Response Policy Zones button
...
under the Toolbar to change the order in which feeds are applied.
In the Order Response Policy Zones dialog, use the arrows to change the
Click OK when
...
done.
...
Changing the order of RPZs requires a service restart to take effect. In the banner at the top of the Grid Manager window, click
...
Restart.
In the Restart Grid Services dialog, adjust Restart Method if desired and click Restart.