Infoblox Cloud-Managed Data Connector

The Infoblox Data Connector is a utility designed to collect DNS query and response data and security logs from specified sources. It transfers the collected data to defined destinations such as the BloxOne Threat Defense Cloud, Infoblox NIOS reporting server, and supported SIEM (Security Information and Event Manager), such as Splunk, QRadar, McAfee EMS, and ArcSight.

The Data Connector filters source data is based on user criteria (thus reducing data quantity) and converts the data to a format that can be securely transferred to and easily consumed by supported destinations. It acts as a central point for data collection across your network devices, which reduces the impact of data exchange and improves your Grid performance.

The following illustration describes the basic concept of the data collection process, which includes collecting supported data from NIOS or BloxOne Threat Defense Cloud, filtering and storing the data, and sending the data to the supported destinations.

Note the following:

• The Data Connector collects DNS query and response data from the BloxOne cloud services and forwards this data to the NIOS reporting server through the SCP protocol, to the Infoblox cloud destination via HTTP requests, and to SIEM tools using TCP protocol.
• To ensure confidentiality, all protocol exchanges to and from the Data Connector are encrypted.