The Infoblox BloxOne Threat Defense Cloud Client on NIOS allows the interaction between BloxOne Threat Defense Cloud and outbound endpoints so you can collect blocked/logged request via feeds or domains detected by Threat Insight in BloxOne Threat Defense Cloud and send the outbound events to external endpoints. When you enable and configure BloxOne Threat Defense Cloud Client on an on-prem NIOS member, the client uses threat API calls to request RPZ events from BloxOne Threat Defense Cloud, and then convert the data into outbound events. These events are periodically synchronized (between BloxOne Threat Defense Cloud and NIOS) and sent to the configured outbound endpoints. Note that the client requests only subsequent data since the last data timestamp, and each synchronization happens based on the schedule and retrieves only the current data.
...
The following figure shows how Threat Insight in the BloxOne Threat Defense Cloud client and BloxOne Threat Defense Cloud Client use a common API interface to interact with BloxOne Threat Defense Cloud. For more information about enabling BloxOne threat defense cloud client for outbound, see below.
| Drawio | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...