Page Comparison

TIDE data can be uploaded to a profile associated with an account. Policies Data policies are used to control access to your organization's data and can be specified when the data is submitted. Data Policies allow organizations Data policies allow your organization to control how their its submitted data is shared with other organizations or groups.

Data profiles are used to identify data in the Cloud Services Portal from one or many data submissions and control who can access the data. A data profile must be specified when data is submitted and is associated with a policy, which controls who can access the data.

Infoblox can enable accessing and data sharing between organizations upon request. Policies can be used for multiple data submissions and are visible only visible within your organization. Data profiles are used to identify data in the platform from one or many data submissions. A data profile must be specified when data is submitted. Data profiles are associated with policies, which control who can access the data. When a data profile is created it must be associated with a policy.

...

.

Users can submit threat indicators by using the Cloud Services Portal or the TIDE Data API. To submit data, the following is required:

1. A data profile: Data profiles are associated with policies, which control who has access to your organization’s data, and they must be specified when data is submitted. When a data profile is created, it must be associated with a policy. Subscribers of BloxOne Threat Defense Advanced can create custom profiles that allow the use of custom-generated TIDE RPZ feeds that are based on an organization's requirements. When creating your own TIDE BYOF RPZ feeds for use with NIOS, keep in mind the practical limits of your NIOS system and its ability to ingest large amounts of data contained within only one RPZ feed. For details, see Creating Data Profiles.
2. Choose a file: Supported file formats include XML, JSON and comma/tab/pipe-separated values. Data files must follow the BloxOne Threat Defense API Guidelines for file and record-level fields. Records must contain a recognized threat class or property. For information, see Submitting TIDE Data.

Users can submit data as JSON, CSV, XML, and TSV (tab-separated values). For all data formats, the submitted data must identify the data/record type in addition to the list of data records. For CSV and TSV, the record type must be provided as one of the columns. For JSON and XML, the record type is defined in a separate top-level field. The record type field can have one of the following values: “host”, “ip”, or “url”. It is not possible to upload data using different profiles or different record types in the same file. Threat data consists of file-level fields and record-level fields. The following table contains descriptions of all available fields:

Data Submission Formats

Note

title	Note

Any unknown fields in a record will automatically go under an “extended” field for that record. This will occur after the submission is done.

Threat Data Fields
File-level fields
profile	The data profile idID.
record_type	This is either host, ip, url, email, or hash.
external_id	This is a A string indicating an external ID to assign to the batch (optional).
record	This surrounds Surrounds the individual record(s) in the XML and JSON formats.
Record-level fields
Field Name	Description
host	The threat threat’s hostname.
ip	The threat threat’s IP address.
url	The threat threat’s URL.
hash	The hash threat.
email	The email threat.
detected	The date/time the threat was detected, in the ISO 8601 format. For For example, '20231114T124742Z' and '2024 “20231114T124742Z” and “2024-01-12T00:00:00. 000Z' 000Z” are valid ISO 8601 formats.
class	The threat's class. For exampleExample: Sinkhole. Note: Either "class" or "property" is required, but not both.
property	The threat's property, For example, . Example: Sinkhole_SinkholedHost. Note: Either Either "class" or "property" is required, but not both.
confidence	Tthe The threat's confidence score ranging , from 0 - to 100 (optional).
domain	The domain string (optional).
duration	The duration of the threat, in the Xd format or XyXmXwXdXh - the or XyXmXwXdXh format. The expiration date will be set to the detected date + this duration (optional).
expiration	The expiration is the datetime the threat will be expired. The expiration datetime of the threat is in the same format as that of the detected detected field.
threat_level	The threat's level ranging . This is an integer from 0 - to 100 as an integer (optional).
target	The threat’s target of threat (optional). For For example: “fakeamazon.com” is a threat targeting “amazon.com”.
tld	The top-level domain, ; a string (optional).

The

...

following is an example of data submitted in the XML format:

Code Block

language	text
theme	Confluence

<feed>
   <profile>SampleProfile</profile>
   <record_type>ip</record_type>
   <record>
     <ip>127.1.0.1</ip>
    <property>Phishing_Phish</property>
    <detected>20170602T154742Z</detected>
   </record>
   <record>
  <ip>8.8.8.8</ip>
   <property>Scanner_Generic</property>
   <detected>19980927T154242Z</detected>
   <duration>42y0m0w0d42h</duration>
   </record>
  </feed>

sample_xml_file.xml (XML format)

The following listing contains a sample data submission in is an example of data submitted in the CSV format:

Code Block

language	text
theme	Confluence

record_type,url,profile,detected,property
url,"https://example.com/page1.html","SampleProfile","20170602T154742Z",
"UnwantedContent_Parasite"
url,"http://example.com/gift.html","SampleProfile","20170602T154742Z", "Scam_FakeGiftCard"

sample_csv_file.csv (CSV format)

The following listing contains a sample data submission in is an example of data submitted in the JSON format:

Code Block

language	text
theme	Confluence

  {
    "feed": {
      "profile": "SampleProfile",
      "record_type": "host",
      "record": [
        {"host": "www.google.com", "property": "Scanner_Generic",
          "detected": "19980927T154242Z", "duration":"42y0m0w0d42h"},                  
        {"host": "www.example.com", "property": "Phishing_Phish",
          "detected": "20170602T154742Z"}
        ]
      }
  }

samp le_json_file.json (JSON format)

The recommended limit for the number of records in a given data submission is 50,000. The maximum number of records should be no more than not exceed 60,000 at this point in time.

The following listing contains a sample data submission in JSON format (is an example of data submitted in the JSON format and with additional parameter fields):

Code Block

language	text
theme	Confluence

{ "feed": {
    "profile": "SampleProfile", 
    "record_type": "host",
    "record": [ 
        { 
            "host": "test-domain.org", 
                        "domain": "test-domain.org", 
                        "class": "CompromisedHost", 
                         "property" : "CompromisedHost_Generic", 
                         "detected": "2024-01-12T00:00:00.000Z",
                         "duration": "90d", 
                         "confidence": 70, 
                         "threat_level": 80 
                }, 
                { 
                         "host": "test-domain.net", 
                         "class": "Sinkhole", 
                         "property" : "Sinkhole_SinkholedHost", 
                         "detected": "2024-01-12T00:00:00.000Z", 
                         "expiration": "2024-03-01T00:00:00.000Z", 
                         "confidence": 30, 
                         "threat_level": 50 
                 }] 
     } 
}

Tide-Data.json (JSON format)

For additional information, see the following:

...

Versions Compared

Old Version 65

New Version 66

Key

Data Submission Formats