Infoblox Exchange Cybersecurity Roadshow 2020 – Join us!
North America | Europe | Middle East/Africa | Asia-Pacific

Reporting

Reply

TOP DNS Clients Exclude Infoblox Members Themselves

[ Edited ]
ADecroix
Techie
Posts: 10
1002     0

Because Infoblox DNS servers can also have the client rôle, you could want a report with only the real final DNS top clients (and so exclude Infoblox members from your stats)

 

This dashboard report can do that.

Just create a new dashboard and copy / paste the XML code below:

 

<form>
  <label>TOP DNS Clients - Exclude Infoblox Members</label>
  <fieldset submitButton="false">
    <input type="time" token="time">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
<input type="multiselect" token="members">
      <label>Members</label>
      <choice value="*">All</choice>
      <search>
        <query>index=ib_dns_summary report=si_dns_top_clients
               | stats count by orig_host</query>
        <earliest>$time.earliest$</earliest>
        <latest>$time.latest$</latest>
      </search>
      <fieldForLabel>orig_host</fieldForLabel>
      <fieldForValue>orig_host</fieldForValue>
      <default>*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>orig_host="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=ib_dns_summary report=si_dns_top_clients earliest=-1month $members$  NOT CLIENT=127.* AND NOT [| inputlookup nios_member_ip_lookup | fields MEMBER_IP | rename MEMBER_IP as CLIENT | table CLIENT | format] 
            | stats sum(COUNT) as total by CLIENT 
            | sort -total 
            | rename CLIENT as client</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form> 

 

Showing results for 
Search instead for 
Do you mean 

Recommended for You