# Explore and Analyze Infoblox Events

After Logpoint ingests *Infoblox* logs:

* Use Search to access and examine events.
* View events in real time through Dashboards.
* Configure Alerts to get notified of critical or suspicious activity.

### Dashboards

#### LP\_InfoBlox - Operational

The LP\_InfoBlox – Operational dashboard displays time-based trends of DHCP-related events, highlights the top sources and users involved in successful and failed login attempts, and lists detailed login and logoff activities. The dashboard also tracks user-driven changes, such as DNS or IPAM records created, modified, or deleted, and shows the number of fixed IP addresses added, updated, or removed. Additionally, it monitors peer device statuses, service health, frequently executed processes, and denied DNS zone transfers, helping you assess operational performance, user activity, and potential security issues within your *Infoblox* environment.

#### LP\_Infoblox - DHCP

The LP\_InfoBlox – DHCP dashboard visualizes DHCP-related events over time and highlights the most frequent event types, including lease assignments, renewals, and releases. The dashboard identifies the top sources generating DHCP requests, the IPs or subnets with the most active leases, and displays metrics for declined or expired requests, helping detect address conflicts or configuration issues. It also tracks failed DNS bind updates linked to DHCP lease events, enabling effective monitoring and troubleshooting of DHCP performance and reliability.

#### LP\_Infoblox - DNS

The LP\_InfoBlox – DNS dashboard visualizes the volume of DNS queries over time and highlights the most frequently queried internal and external domains. The dashboard identifies sources and systems generating the most errors or failed requests, helping detect misconfigurations or potential threats. It also tracks the busiest Infoblox DNS servers, failed dynamic DNS updates, and records associated with recurring errors, enabling administrators to monitor query trends, troubleshoot DNS issues, and ensure the reliability and security of DNS operations.

<details>

<summary>Adding Infoblox Dashboards </summary>

1. **Add vendor dashboards**
   1. Go to **Settings >> Knowledge Base** from the navigation bar and click **Dashboards**.
2. **Select dashboards source**
   1. Select **VENDOR DASHBOARD** from the drop-down.
3. **Create dashboard**
   1. Click the **plus** icon from Actions.
4. **Choose repository**
   1. Click **Choose Repos**.
5. **Select repo**
   1. Select the repo configured to store the Infoblox logs and click **Done**.
6. **Finalize**
   1. Select the dashboard in **Ask Repos** and click **Ok**.
   2. You can find the selected dashboards under Dashboards.

</details>

### Infoblox Alerts

#### LP\_Infoblox Key Authentication Fail

Trigger Condition: This alert is triggered whenever an authentication fails.

ATT\&CK Category: Persistence, Initial Access, Credential Access, Defense Evasion, Privilege Escalation

ATT\&CK Tag: Brute Force, Valid Accounts

ATT\&CK ID: T1110, T1078

Minimum Log Source Requirement: InfoBlox

Query:

```
 "device_name" = "InfoBlox"
```

#### LP\_Infoblox Scheduled Backup Fail

Trigger Condition: This alert is triggered whenever a backup fails.

ATT\&CK Category: Impact

ATT\&CK Tag: Inhibit System Recovery

ATT\&CK ID: T1490

Minimum Log Source Requirement: InfoBlox

Query:

```
 "device_name" = "InfoBlox"
```

#### LP\_Infoblox User Login Fail

Trigger Condition: This alert is triggered whenever a user login fails.

ATT\&CK Category: Persistence, Initial Access, Credential Access, Defense Evasion, Privilege Escalation

ATT\&CK Tag: Brute Force, Valid Accounts

ATT\&CK ID: T1110, T1078

Minimum Log Source Requirement: InfoBlox

Query:

```
 "device_name" = "InfoBlox"
```

#### LP\_Infoblox Zone Update Fail

Trigger Condition: This alert is triggered whenever a zone update fails.

ATT\&CK Category: Impact

ATT\&CK Tag: Network Denial of Service

ATT\&CK ID: T1498

Minimum Log Source Requirement: InfoBlox

Query:

```
 norm_id=InfoBlox label=Zone label=Update label=Fail
```

<details>

<summary>Adding Infoblox Alerts</summary>

1. **Open alert rules**
   1. Go to **Settings >> Knowledge Base** from the navigation bar and click **Alert Rules.**
2. **Select vendor rules**
   1. Select **Vendor Rule** s from the drop-down.
3. **Add rule**
   1. Click the **Add** icon from **Actions**.
4. **After adding**
   1. After adding the alert rules, Infoblox redirects you to the **Used Alert Rules** page.

Once the used alert rules are triggered, Infoblox generates the corresponding incidents in the **Incidents** page.

</details>
