A step-by-step guide to using Infoblox logs and the Automation Framework to build custom Python scripts, parse DNS/DHCP/security events, and integrate with tools like SIEMs, CMDBs, and ticketing platforms for advance visibility and automated response.
INTRODUCTION
Infoblox provides powerful logging capabilities and an automation framework that enable users to build custom scripts and integrations. This guide outlines how stakeholders can harness Infoblox logs through the Automation tab to develop meaningful scripts, analyze data, and build ecosystems by forwarding parsed log data to third-party platforms.
Refer to the official guide here: Creating and Using Python Automation Scripts.
Key Benefits of Infoblox Log-Based Automation
Infoblox logs are structured, comprehensive, and designed to provide deep visibility into DNS, DHCP, IP address management (IPAM), and security-related events. With the right parsing logic, users can automate tasks, enhance security workflows, and feed actionable insights into SIEMs, asset platforms, and compliance tools.
Why Automate with Infoblox Logs
Empower yourself with greater control and flexibility to:
- Streamline data extraction and accelerate troubleshooting workflows.
- Enable integrations with custom or unsupported third-party platforms.
- Trigger real-time responses to DHCP/DNS anomalies where native integrations may not be available.
Use Cases for Custom Log Parsing
Custom log parsing enables customers to extend Infoblox visibility and integrations in scenarios not fully covered by current ecosystem-supported solutions. It is ideal for custom platforms, unsupported third-party tools, or tailored workflows requiring complete control over data handling.
Below are several practical use cases for stakeholders aiming to leverage Infoblox logs:
Asset Visibility and Tracking
Goal: Extend asset tracking in environments where standard integrations are unavailable.
- Parse DHCP and IPAM logs to extract MAC address, hostname, and IP.
- Compare against inventory systems to detect unmanaged or rogue devices.
- Trigger alerts or reports on anomalies.
Threat Intelligence and Security Response
Goal: Enable threat detection workflows beyond supported integrations.
- Parse DNS logs to detect indicators of compromise (IOCs) (e.g., known malicious domains).
- Use DFP logs for event classification.
- Forward critical threat events to custom SIEMs, SOARs, or ticketing platforms not supported by default ecosystem integrations.
Integration with Configuration Management Database (CMDB)
Goal: Update CMDBs in custom IT service management (ITSM) environments or when deeper control is required.
- Use parsed DHCP logs to map IP, MAC, and hostnames.
- Trigger updates for device records on lease changes.
- Ideal for CMDBs not directly supported via built-in connectors.
Compliance and Audit Reporting
Goal: Generate tailored reports for internal or external audits.
- Parse logs to document DHCP lease activity, DNS usage, or IP reservations.
- Customize output to meet organization-specific compliance requirements.
Script Automation Support Scope
- Custom automation scripts are supported only with on-premises data connectors.
- Not applicable to NIOS logs: This automation framework is built exclusively for Infoblox Cloud-based logs and does not support logs generated from NIOS deployments.
VISUALIZING TRAFFIC FLOW
As the next step in this guide, we will include a Walnut demo that illustrates how traffic flows within the Infoblox ecosystem. This demo will showcase how logs are generated and how specific events trigger automation workflows based on destination data.
SUPPORTED LOGS AND FORMATS
The Infoblox Automation framework supports a wide range of logs that can be parsed and used for custom automation workflows, security responses, and third-party integrations. Below is the list of supported log types available for Automation.
Service Log
Service logs provide diagnostic information about the services running on specific servers in your Infoblox platform infrastructure. Information in service logs allows you to analyze, optimize, and troubleshoot Infoblox services.
Service Log for Reference:
{'@log_name': '5d56619c3f837e052bbff9daa183b1ff/cdc', '@timestamp': '1752059208000039004', 'log': '" {\\"level\\": \\"info\\"\\, \\"name\\": \\"infoblox_driver\\"\\, \\"msg\\": \\"Connection to cdc-grpc-in.infoblox.svc.cluster.local:9195 is successful.\\"\\, \\"service_id\\": \\"infra/service/6yk74nrumqiomtcbfy7idtqyyhqtuaid\\"\\, \\"time\\": \\"2025/07/09 11:06:48.712669\\"}"', 'pool_id': 'infra/pool/i7ofgqz7vjgsrc4pwrfe3y7wwujk6rso', 'service_id': 'infra/service/6yk74nrumqiomtcbfy7idtqyyhqtuaid'}
For a detailed explanation of service log keys, please refer to the official Infoblox documentation: Viewing Service Logs.
DDI DHCP Lease Log
The DDI DHCP lease log captures DHCP lease lifecycle events such as lease assignment, renewal, and release. This includes metadata like IP address, MAC address, client hostname, and lease duration.
DDI DHCP Lease Log for Reference:
{'application_id': 'ddi_dhcp', 'event_subtype': '', 'log_type': 'ddi_dhcp_lease_log', 'client_id': '01:00:50:56:0a:10:44', 'action': 'Delete', 'timestamp': '1723532716', 'user': '', 'dest': {'nt_host': '', 'duid': '', 'ip': '192.168.1.150', 'mac': '00:50:56:0a:10:44'}, 'infoblox': {'host_id': 'dhcp/host/721388', 'host': '', 'ip': ''}, 'lease_scope': '[]', 'event': {'name': 'DHCP Lease Delete'}, 'event_type': 'ddi', 'dhcp': {'subnet': '', 'fingerprint': 'VMware:Virtual Machine:windows:', 'lease_uuid': 'b9079492-5940-11ef-b6d2-2af6c6d3a0df', 'options': '', 'fingerprinted': 'true', 'range_end': '', 'range_start': '', 'ip_space': 'ipam/ip_space/b79eb2ac-5659-11ef-8a7d-62a043103341'}, 'lease_duration': '', 'signature': 'DHCP lease', 'vendor_product': 'Infoblox BloxOne DDI'}
For a detailed explanation of DHCP lease log keys, please refer to the official Infoblox documentation: DHCP Message Mapping.
Infoblox Threat Defense™ Threat Feed Log
The Threat Defense threat feed log records when DNS queries match domains listed in known threat intelligence feeds. This is critical for identifying and responding to malicious activity.
Threat Defense Threat Feed Log for Reference:
{'Opcode': 0, 'Timestamp': 1723219367, 'Nanosec': 633046180, 'Tcode': 0, 'Tname': 'malware-dga.malwarec2dga.eicar.network.', 'Acode': 3, 'Arrtype': 28, 'Arrdata': 'NXDOMAIN', 'Qname': 'malwarec2dga.eicar.network.', 'Qtype': 28, 'Qclass': 1, 'Source': 'f597411abc5049b2b55549ba7b4f1bc1', 'Qip': '192.168.1.150', 'Qport': 61885, 'Rip': '', 'Rport': -1, 'View': '_default', 'Pvendor': 'infoblox', 'Pname': '', 'Pversion': '', 'Loglevel': -1, 'Disabled': False, 'Tid': '383', 'Pid': '201498', 'Cid': ':424d498437a01f4875b2cb2b92ef6074', 'Anonymized': False, 'Cmac': '00:50:56:0a:10:44', 'Csite': 'f597411abc5049b2b55549ba7b4f1bc1', 'Qcat': '', 'Tinfo': 'malwarec2dga.eicar.network;MalwareC2DGA;MalwareC2DGA_Generic;100;100;', 'Username': '', 'Region': 'us-west-1', 'Extra': {'risk_score_rating': 'high', 'mac_address': '00:50:56:0a:10:44', 'egress_ip': '208.50.179.13', 'storage_id': '2307115', 'network': 'ZTP_sanithpss_2894450417531863322 (DFP)', 'qname_norm': 'malwarec2dga.eicar.network', 'domain_applications': 'Uncategorized', 'client_country': 'United States','host_id': '07d6c8edaa8f201da0d0bcace1652046','domain_categories': 'Uncategorized', 'device_ip': '192.168.1.150', 'policy_action': 'Block', 'pname': 'dfp', 'query_type': 'AAAA', 'risk_score': '81', 'threat_indicator': 'malwarec2dga.eicar.network', 'threat_class': 'MalwareC2DGA', 'ip_address': '192.168.1.242', 'confidence_score_rating': 'high', 'confidence_score': '80', 'severity': 'High', 'display_name': 'ZTP_sanithpss_2894450417531863322', 'feed_type': 'FQDN', 'record_type': '2', 'all_tags': 'APP_Uncategorized,CAT_Uncategorized,infoblox-base,malware-dga', 'device_name': '192.168.1.150', 'client_region': 'California', 'pdisplay_name': 'DFP', 'event_date': '2024-08-09 16:02:47.633', 'feed_name': 'Malware_DGA', 'policy_name': 'Default Global Policy', 'confidence_numeric': '100', 'view': 'default', 'site_id': 'f597411abc5049b2b55549ba7b4f1bc1', 'sld': 'eicar.network', 'severity_numeric': '100', 'response': 'NXDOMAIN', 'property': 'Generic', 'confidence': 'High', 'client_continent': 'North America'}, 'Version': '', 'log_type': 'td_rpz_log', 'event_type': 'MalwareC2DGA', 'event_subtype': 'Generic', 'application_id': 'dfp'}
For a detailed explanation of Threat Defense threat feed log keys, please refer to the official Infoblox documentation: DNS Security Policy Hit and RPZ Hit Log Message Mapping.
SOC Insights
SOC Insights are high-level security insights based on threat activity and DNS behavior anomalies observed within the environment.
SOC Insights Log for Reference:
{'id': '095e15df-9bf6-41b9-b65a-abedf1965da5', 'account_id': '1908', 'application_id': 'event_publisher', 'type': 'SYSTEM', 'subtype': 'insight_generated', 'severity': 'medium', 'metadata': {'body': 'A newinsighthas been detected.<br> - Threat Type: Zero Day DNS,<br> - Threat Class(s): TI-ZERODAYDNS,<br> - Threat Family: EMERGENT,<br> - Threat Level: medium,<br> - Most recent event: 2024-05-11 18:58:56 +0000 UTC.<br><br> Go to <a style="color:#0173E0" href="https://csp.infoblox.com/#/insights-console/insight/31bca6ef-eef5-4b7d-8872-d2656e02586e/summary">SOCInsights dashboard</a> for details.<br>', 'insight': '{\n "storage_id": 301908,\n "tclass": "TI-ZERODAYDNS",\n "tfamily": "EMERGENT",\n "insight_id": "31bca6ef-eef5-4b7d-8872-d2656e02586e",\n "feed_source": "InsightDetection Framework",\n "started_at": "2024-05-11T00:00:00Z",\n "threat_type": "Zero Day DNS",\n "status": "Active",\n "persistent_date": "1970-01-01T00:00:00Z",\n "spreading_date": "1970-01-01T00:00:00Z",\n "confidence_level": 3,\n "num_events": 442,\n "most_recent_at": "2024-05-11T18:58:56Z",\n "threat_level": 2,\n "not_blocked_count": 442,\n "priority": 4,\n "priority_text": "MEDIUM"\n}', 'insight_id': '31bca6ef-eef5-4b7d-8872-d2656e02586e', 'message': 'A newinsighthas been detected.<br> - Threat Type: Zero Day DNS,<br> - Threat Class(s): TI-ZERODAYDNS,<br> - Threat Family: EMERGENT,<br> - Threat Level: medium,<br> - Most recent event: 2024-05-11 18:58:56 +0000 UTC.<br>', 'short_subject': 'Short Subject: TI-ZERODAYDNS-EMERGENT-Zero Day DNS', 'subject': 'Infoblox Threat Defense - NewInsightAlert'}, 'occurred_time': '2024-05-11T19:03:58.433612417Z', 'generated_time': '2024-05-11T19:03:58.444147613Z', 'status': 'RAISED', 'product_name': 'insightful_reporting', 'log_type': 'internal_notifications', 'event_type': 'SYSTEM', 'event_subtype': 'insight_generated'}
For a detailed explanation of SOC Insights log keys, please refer to the official Infoblox documentation: SOC Insights — Event Field Logs.
Audit Log
Audit log tracks user actions, configuration changes, and policy updates. It is essential for compliance and change management auditing.
Audit Log for Reference:
{'message': '{"request":{"id":"dns/view/f72e6d10-166b-4b3a-b718-4a207be0ba45"}}', 'subject_groups': '[act_admin,user,ib-soc-insight-user,ib-interactive-user,ib-ddi-user,ib-td-admin,ib-td-user,ib-soc-insight-admin,ib-ddi-admin,ib-trusted-partner,ib-bloxone-nios-user,ib-access-control-admin]', 'log_type': 'audit_log', 'account_id': '2009259', 'client_ip': '103.155.222.31', 'event_subtype': '', 'http_method': 'DELETE', 'updated_at': '2025-07-10T08:24:07.940356708Z', 'event_version': '', 'resource_id': 'f72e6d10-166b-4b3a-b718-4a207be0ba45', 'user_name': 'svasanthakumar@infoblox.com', 'http_code': '200', 'id': '902447183', 'application_id': 'ddi', 'session_type': 'bearer', 'app_id': 'ddi', 'created_at': '2025-07-10T08:24:07.940356708Z', 'http_resp_body': '{}', 'resource_desc': '', 'result': 'Success', 'subject_type': 'User', 'event_type': '', 'session_id': 'e02f8586-8bf1-4fb5-ab28-0dba5aa0b902', 'resource_type': 'view', 'event_metadata': '', 'http_url': '/ddi-dns-config/v1/dns/view/f72e6d10-166b-4b3a-b718-4a207be0ba45', 'request_id': 'd23b506df5a2d949f978f5d8044ff202', 'action': 'MoveToRecyclebin', 'http_req_body': ''}
For a detailed explanation of Audit log keys, please refer to the official Infoblox documentation: Audit Logs — Event Field Logs.
Internal Notifications
Internal notifications are system-generated alerts and platform updates that provide operational context for services and modules.
Internal Notification Log for Reference:
{'account_id': '522', 'id': '8a6df231-1448-4cb8-bcd6-013c707aea46', 'occurred_time': '2024-10-17T12:36:08.897115607Z', 'severity': 'medium', 'event_subtype': 'host_status_infra', 'event_type': 'SYSTEM', 'application_id': 'default', 'product_name': 'host_status', 'status': 'RAISED', 'subtype': 'host_status_infra', 'log_type': 'internal_notifications', 'generated_time': '2024-10-17T12:36:15.847030742Z', 'metadata': {'message': 'Host "ZTP_IB-B1-TO-DC_7569219267590712251" has been in "Degraded/Error State" since 2024-10-17 12:32:24 +0000 UTC', 'short_subject': 'Host Unhealthy'}, 'type': 'SYSTEM'}
For a detailed explanation of Internal Notification log keys, please refer to the official Infoblox documentation: Atlas Notifications — Event Field Logs.
