What is Zero Day DNS?
Infoblox is introducing a new, real-time streaming detection feature called "Zero Day DNS." Zero Day DNS is designed to identify domains implicated in threat campaigns immediately after their registration, eliminating the aging period. It effectively blocks threat indicators in the initial stage of the threat lifecycle, specifically within 1 to 2 minutes following their registration. This proactive approach ensures the protection of our users against threats even before the commencement of the threat campaign.
Infoblox blocks these domains using short duration TTL of 48 hours by which time other security system in place will have enough information to protect per the exisitng policy. The default action for Zero Day DNS is Block-No Redirect.
Zero Day DNS is only available to BloxOne Threat Defense Advanced subscribers. The Zero Day DNS feed cannot be enabled (and thereby does not apply) to On-Prem NIOS.
Adding the Zero Day DNS feed to a Security Policy
To add the Zero Day DNS feed to an existing security policy, do the following:
- Log in to the Cloud Services Portal.
- In the Cloud Services Portal, navigate to the Security Policies tab (Policies > Security Policies).
- Locate the security policy you wish to add to your feed. Click the expandable menu icon associated with the security policy. Then, click Edit.
Image: Click Edit next to the security policy to be added to the feed. - Click Policy Rules in the left navigation.
Image: Click Policy Rules in the Edit Policy wizard. - Click Add Rule.Then, click Feeds and Threat Insight to display the list of threat feeds.
Image: Click Add rule followed by clicking Feeds and Threat Insight to display the threat feeds list. - Locate the Zero Day DNS feed in the Security Note panel. The new Feed and Threat insight entry will be located at or near the bottom of the Policy Rules list.
Image: Locating the entry in the Security Note panel. - Click Choose a Feeds and Threat Insight. Select the Zero Day DNS feed from among the list of feeds to be added to the security policy. Once the new feed is selected, click Select to confirm the selection of the feed.
Image: Selecting the Threat insight - Zero Day DNS feed for adding to the security policy. - Use the Up and Down arrows on the far right of the newly added policy rule to change the order of precedence for the newly added Zero Day DNS feed. Note: The Zero Day DNS feed should be placed in the seventh slot, just below the Ransomware feed.
Image: Click the Up and Down arrows to change the newly added Zero Day DNS feed's precedence order. - The Zero Day DNS feed should be placed in the eighth slot, just below the Ransomware feed.
Image: The available feeds, and their order, in the default global policy. - Change the Action that is associated with the newly added policy rule.
Image: Selecting the Action to be associated with the newly added policy rule. For the Zero Day DNS feed, Infoblox recommends setting the assigned action to Block - No Redirect. - Click Finish to add the feed to your security policy configuration
- Click Save & Close to save the newly updated security policy configuration.