Infoblox Repeated Blocked Threats From Single Internal Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects one internal host repeatedly triggering DNS threat blocks. A single block is routine background noise; the same host blocked repeatedly means something on it keeps trying to reach hostile infrastructure, which indicates a persistent infection rather than a passing click. The block itself is not reassuring: it tells you the host is compromised, only that this particular channel failed. Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED' | duration 1h | groupby srcip | select srcip, count(*) as cnt | having cnt > 10