The following feed policy configuration is recommended after the SURBL feeds deprecation in mid-August.
...
| title | Alert |
|---|
New feed recommendations: It is recommended that you do the following regarding the new feeds:
- Add Suspicious Domains with one of the policy actions to Block.
- Add Suspicious Lookalikes with one of the policy actions to Block.
- Add Suspicious NOED with one of the policy actions to Block.
The following table includes the list of feeds that we will be retiring:
...
Feed
...
RPZ Name
...
Retirement Date
...
Reason
...
Bot-IP
...
bot-ip.rpz.infoblox.local
...
4/1/2023
...
IP addresses are frequently reused for multiple sites, and blocking the ones associated with such systems ran the high risk of inadvertent blocking (I.E. False Positive). Many indicators here could be blocked in other ways, so the source is blocked in other similar feeds, making this redundant.
...
Spambot-IP
...
spambot-ip.rpz.infoblox.local
...
4/1/2023
...
ExploitKit_IP
...
exploitkit-ip.rpz.infoblox.local
...
June 2023
...
Ext_ExploitKit_IP
...
ext-exploitkit-ip.rpz.infoblox.local
...
June 2023
...
Ext_TOR_Exit_Node_IP
...
ext-tor-exit-node-ip.rpz.infoblox.local
...
June 2023
...
NCCIC_Host
...
nccic-host.rpz.infoblox.local
...
June 2023
...
The curation process for these feeds (I.E. removing false positives) frequently left these feeds empty. The ones that remained are present in other feeds, making these feeds redundant.
...
NCCIC_IP
...
nccic-ip.rpz.infoblox.local
...
June 2023
As these feeds are being retired, NIOS platforms will no longer be able to download them. This may present itself as a problem with the Zone transfer. To avoid this issue, these feeds should be removed as soon as possible. As they have been empty for a long time, there will be no negative effect on the organization’s security posture. This only affects NIOS platforms using these RPZ feeds, as cloud-based configurations are updated automatically.
For information on adding and removing feeds from a security policy, see the following:
...
In preparation of the August 2023 feed changes, Infoblox recommends the following rule action changes to your feed policy rules.
| Note | ||
|---|---|---|
| ||
|
| Info |
|---|
The recommended rule actions are for reference only. They represent the results of lab testing in a controlled environment focused on individual protocol services. Enabling additional protocols, services, cache hit ratio for recursive DNS, and customer environment variables will affect performance. To design and size a solution for a production environment, please contact your Infoblox Solution Architect. |
The following table lists the default actions and precedence for the feeds and Threat Insight in the Default Global Policy available May 2024:
| Feed Name | Default Action | Default Precedence |
|---|---|---|
| Default Allow List | Allow - No Log | 1 |
| Default Bloxk List | Block – No Redirect | 2 |
| Infoblox Base | Block – No Redirect | 3 |
| Infoblox Base IP | Block – No Redirect | 4 |
| Infoblox High Risk | Block – No Redirect | 5 |
| Threat Insight - Zero Day DNS | Block – No Redirect | 6 |
| Infoblox Medium Risk | Block – No Redirect | 7 |
| Threat insight - DGA | Allow – With Log | 8 |
| Threat Insight-Data Exfiltration | Allow – With Log | 9 |
| Threat Insight-DNS Messenger | Allow – With Log | 10 |
| Infoblox Low Risk | Allow – With Log | 11 |
| Infoblox Informational | Allow – With Log | 12 |
| Threat insight - Notional Data Exfiltration | Allow – With Log | 13 |
The following table lists the default actions and precedence for the feeds and Threat Insight in the Default Global Policy (to be supported until December 2024 and deprecated after December 2024):
| Feed Name | Default Action | Default Precedence |
|---|---|---|
| Base Hostnames | Block – No Redirect | 1 |
| AntiMalware | Block – No Redirect | 2 |
| Malware_DGA Hostnames | Block – No Redirect | 3 |
| Ransomware | Block – No Redirect | 4 |
| Public_DOH | Block – No Redirect | 5 |
| Public_DOH_IP | Block – No Redirect | 6 |
| Domain | Allow – With Log | 7 |
| Threat Insight-Data Exfiltration | Allow – With Log | 8 |
| Threat Insight - |
| Notional Data Exfiltration | Allow – With Log | 9 |
| Threat Insight-DNS Messenger | Allow – With Log | 10 |
| AntiMalware_IP | Allow – With Log | 11 |
| Ext_Base_AntiMalwar | Allow – With Log | 12 |
| Ext_Ransomware | Allow – With Log | 13 |
| Ext_AntiMalware_IP | Allow – With Log | 14 |
| DHS_AIS_Domain | Allow – With Log | 15 |
| CryptoCurrency | Allow – With Log | 16 |
| TOR_Exit_Node_IP | Allow – With Log | 17 |
For information on adding and removing feeds from a security policy, see the following:
...