Threat Insight - Zero Day DNS Configuration
- Gary Leicht
- Alex Mandel
What is Zero Day DNS?
Zero Day DNS is a detection feature designed to identify domains implicated in threat campaigns immediately after their registration, eliminating the aging period. It effectively blocks threat indicators in the initial stage of the threat lifecycle, specifically within 1 to 2 minutes following their registration.
Infoblox blocks these domains using short duration TTL of 48 hours by which time other security system in place will have enough information to protect per the existing policy. The default action for Zero Day DNS is Block-No Redirect.
Zero Day DNS is only available to Infoblox Threat Defense Advanced subscribers. The Zero Day DNS feed cannot be enabled on (and thereby does not apply to) On-Prem NIOS.
Adding the Zero Day DNS feed to a Security Policy
To add the Zero Day DNS feed to an existing security policy, do the following:
- Log in to the Infoblox Portal.
- To navigate to the Security Policies tab, in the Infoblox Portal, go to Configure > Security > Policies.
- Locate the security policy you wish to add to your feed. Click the expandable menu icon associated with the security policy. Then, click Edit.
Image: Click Edit next to the security policy to be added to the feed. - Click Policy Rules in the left navigation.
Image: Click Policy Rules in the Edit Policy wizard. - Click Add Rule > Feeds and Threat Insight to display the list of threat feeds.
Image: Click Add Rule > Feeds and Threat Insight to display the list of threat feeds. - Locate the Zero Day DNS feed in the Security Note panel. The new Feed and Threat insight entry will be located at or near the bottom of the Policy Rules list.
Image: Locating the entry in the Security Note panel. - Click Choose a Feeds and Threat Insight. Select the Zero Day DNS feed from among the list of feeds to be added to the security policy. Once the new feed is selected, click Select to confirm the selection of the feed.
Image: Selecting the Threat insight - Zero Day DNS feed for adding to the security policy. - Use the Up and Down arrows on the far right of the newly added policy rule to change the order of precedence for the newly added Zero Day DNS feed. Note: The Zero Day DNS feed should be placed in the seventh slot, just below the Ransomware feed.
Image: Click the Up and Down arrows to change the newly added Zero Day DNS feed's precedence order. - The Zero Day DNS feed should be placed in the fourth slot, just below the Infoblox Base feed.
Image: The available feeds, and their order, in the default global policy. - Change the Action that is associated with the newly added policy rule.
Image: Selecting the action to be associated with the newly added policy rule. For the Zero Day DNS feed, Infoblox recommends setting the assigned action to Block - No Redirect. - Click Finish to add the feed to your security policy configuration.
- Click Save & Close to save the newly updated security policy configuration.