DEMO VIDEO & TEMPLATES: Creating ADP Rules for Active Malicious Threats [ Edited ]

[#1]

Hello,

Infoblox now has a new way to combine RPZ feeds with local RPZ and ADP. This takes an RPZ feed that gets queries and creates a local RPZ entry that, when hit a custom number of times, will create a custom ADP rule to block any new bad queries. The video shows how to set everything up and how it works so that you can start using it.

VIDEO:

 
All the templates that you need are attached in a links below. You may want to rework the templates however the templates below are the ones that are demoed in the video. 

The templates require two Extensible Attributes, explained in the video and you will need to generate them in order for the templates to work.

Extensible Attribute	Description
hits	The number of times an entry was hit within an established amount of time, designated by the instance variable “TimeForHits” which is explained in the video. This Extensible Attribute must be a type integer.
time	This is the last time a variable was hit within a given period of time. This Extensible Attribute must be a type string.

Template	Link	Description
addSecurityRuleBasedOnHits.json	https://drive.google.com/file/d/0BxAsYqIgR8lbUnJjejNCYW5TS2c/view?usp=sharing	Will add a ADP rule when the local RPZ feed gets a designed number of queries.
addRPZRuleByOutbound.json	https://drive.google.com/file/d/0BxAsYqIgR8lbM3FTVnVFYjRsOTA/view?usp=sharing	Will add a local RPZ rule when the RPZ feed rule is queried.

Document	Link
Deployment Guide	https://drive.google.com/file/d/0BxAsYqIgR8lbREIxWG9FU1kxeVE/view?usp=sharing
addRPZRuleByOutbound template walkthrough	https://docs.google.com/document/d/1hgVzOfG39qRrEED0E05Vm7MCWlghckepop69OMXWlTk/edit?usp=sharing
addSecurityRuleBasedOnHits template walkthrough	https://docs.google.com/document/d/1bhFweHk0fKy8cdIaAuMELZJZwmSimRUqIrV4k_K0lak/edit?usp=sharing

If you have any questions or suggestions please let me know!

Thank you,

Kevin Zettel