BloxOne Threat Defense Cloud uses Swagger to publish and deliver its APIs. For a list of available APIs, first log in to the Cloud Services Portal, and then click the following link:
Below is a list of currently supported calls along with their descriptions.
BloxOne Anycast API
ANYCAST API
...
Should an application instance become unavailable, the local route advertisements stop, resulting in withdrawal of the route (in the upstream router) to the application instance that has gone out of service and ensuring that subsequent application requests thus get routed to the remaining available application instances.
BloxOne FW API (BloxOne Threat Defense
...
)
FW API
| Info | ||
|---|---|---|
| ||
Detailed information for the BloxOne FW API can be viewed on at |
BloxOne Threat Defense Cloud is an extension of the BloxOne Suite that provides visibility into infected and compromised off-premises devices, roaming users, remote sites, and branch offices. You can subscribe to Infoblox BloxOne Threat Defense Cloud and use its functionality to mitigate and control malware as well as provide unprecedented insight into your network security posture and enable timely action. BloxOne BloxOne Cloud also offers unified policy management, reporting, and threat analytics across the entire spectrum. Using automated and high-quality threat intelligence feeds and unique behavioral analytics, it automatically stops device communications with C&Cs/botnets and prevents DNS based data exfiltration.
...
Infoblox BloxOne Endpoint is a lightweight mobile agent that redirects DNS traffic from your remote devices to BloxOne Threat Defense Cloud. It allows you to apply applicable security policies to your roaming end users in remote sites and branch offices.
In order for end users to connect to Infoblox cloud services, you must download and install BloxOne Endpoint on their devices. The client enforces security policies that are applied to remote networks, regardless of where your end users are located, and to which networks they are connected. BloxOne Endpoint listens on port 53 of the device. If other software listens on the same port, DNS traffic cannot be redirected to BloxOne Threat Defense Cloud, and your device will not be protected by BloxOne Endpoint.
When you use BloxOne Endpoint, DNS queries are sent to BloxOne Threat Defense Cloud directly except for (1) queries that target the bypassed domains and (2) internal domains collected through the DHCP server. If you have internal domains that are served by your local DNS servers and you want to reach them without interruptions, you should consider adding them to the bypassed internal domains list so that DNS queries for these internal domains are sent to the local DNS servers instead of BloxOne Threat Defense Cloud.
BloxOne Endpoint supports dual-stack IPv4 and IPv6 DNS configurations, thereby protecting all devices regardless of their network environments. BloxOne Endpoint in a dual-stack environment is able to proxy IPv6 DNS queries and forward them to BloxOne Threat Defense Cloud over IPv4.
BloxOne Cloud DFP API (DNS Forwarding Policy)
...
| Info | ||
|---|---|---|
| ||
Detailed information for the BloxOne Cloud DFP API can be viewed on at |
BloxOne Threat Defense Cloud is a SaaS offering designed to provide protection to devices on and off-premises, including roaming, remote, and branch offices. It provides visibility into infected and compromised devices, prevents DNS-based data exfiltration, and automatically stops device communications with command-and-control servers (C&Cs) and botnets, in addition to providing recursive DNS services in the cloud. You can access the services by deploying the BloxOne Endpoint agent or the DNS forwarding proxy.
For remote office deployments, or in cases where installing an endpoint agent is not desirable or possible, you can use the DNS forwarding proxy. It is a software application that runs on bare-metal, VM infrastructures, or Infoblox NIOS appliances, and embeds the client IPs in DNS queries before forwarding them to BloxOne Threat Defense Cloud. The communications are encrypted and client visibility is maintained. The proxy also provides DNS resolution to local DNS zones when you configure local resolvers. Once you set up a DNS forwarding proxy, it becomes the main DNS server for your remote site. It will also cache responses to speed resolution of future queries.
By implementing the DNS forwarding proxy, you can rest assured that BloxOne Threat Defense Cloud effectively enforces DNS client-based security policies at your remote sites. On-premises devices that send DNS queries reveal their actual client IP addresses (instead of their NAT IP address), thus allowing BloxOne Threat Defense Cloud to apply the security policies applicable to the respective endpoints and identify infected clients.
...
| Info | ||
|---|---|---|
| ||
Detailed information for the Dossier API can be viewed on at |
Dossier, sometimes referred to as Intel Lookup, is a threat research tool that provides contextual information from multiple sources simultaneously for a given indicator. The APIs listed below allow a user to search on specific sources and view the results that they return.
TIDE Data Service API (TIDE Data)
...
| Note | ||
|---|---|---|
| ||
API key expiration notification: The maximum expiration time for an API key is 56 weeks or 13 months. You will receive notification when your API key is about to expire. A new API key will need to be created to replace the expiring key. To create a new API key, select the expiring API key from the list of API keys and remove it by clicking Disable followed by Delete. To create a new API key to replace an expiring api key, see How Do I Create an API Key. |
Additional API Resources
Listed below are additional API resources.
...