Page Comparison

Depending on your subscription level, each feed and Threat Insight policy in the Default Global Policy comes with a default action.

...

Feed Name	Default Action	Default Precedence
Default Allow List	Allow - No log	1
Default Block List	Block – No Redirect	2
Base Hostnames	Block – No Redirect	3
AntiMalware	Block – No Redirect	4
Malware_DGA Hostnames	Block – No Redirect	5
Ransomware	Block – No Redirect	6Threat Insight - Rapid Domain Triage
Public_DOH	Block – No Redirect	7
Suspicious	Block – No Redirect	8
Suspicious Lookalikes	Block – No Redirect	9
Suspicious NOED	Block – No Redirect	10
DOH Public Hostnames	Block – No Redirect	11
DOH Public IPsPublic_DOH_IP	Block – No Redirect	12	Newly Observed Emergent Domains8
Threat Insight - DGA	Allow – With Log	139
Threat Insight - DGAData Exfiltration	Allow – With Log	1410
Threat Insight - Notional Data Exfiltration	Allow – With Log	1511
Threat Insight - Fast Flux	Allow – With Log	1612
Threat Insight - DNS Messenger	Allow – With Log	1713
AntiMalware_IP	Allow – With Log	18
Threat Insight - Notional Data Exfiltration	Allow – With Log	19
Extended Base and Anti-malware Hostnames14
Ext_Base_AntiMalware	Allow – With Log	2015
Extended Ext_Ransomware IPs	Allow – With Log	2116
Extended Ext_AntiMalware IPs_IP	Allow – With Log	2217
DHS_AIS_ HostnameDomain	Allow – With Log	2318
Cryptocurrency hostnames and domains	Allow – With Log	2419
TOR_Exit_Node IPs_IP	Allow – With Log	2520
Blocklist	Block – No Redirect	21

Infoblox recommends adhering to the following best practices when configuring feed precedence.

...

Note

title	Note

Given that IP addresses can be reused over a period of time, blocking IP addresses is riskier than blocking domains or hostnames. So, to avoid false positives, for those external or third-party IP-based feeds like DHS_AIS_IP that are added to policy through voluntary addition (other than what’s provided by default), Infoblox recommends only an Allow-With Log policy action and not a Block policy action.

Ensure that the precedence order assigned to the Security Policies are properly configured.
Make sure that Geolocation option is enabled in Security Policy to ensure that the ECS supported domains should get DNS response accordingly from the authoritative nameservers. For more information, see Best Practices for Data Connector.
Ensure that the precedence order assigned to the Security Policies are properly configured.

Note

title	Advisory

For information on the recommended Rule Actions to be applied in preparation of the August 22, 2023 feed changes, see the topic on Recommended Rule Actions in Preparation of the August 2023 Feed Changes.

For information on recommended rule actions to be applied to feeds as replacement to the deprecated SURBL feeds, see Recommended Feed Configuration to Replace the SURBL Feeds.

...

Versions Compared