Infoblox’s global team of threat hunters uncovers a DNS operation with the ability to bypass traditional security measures and control the Great Firewall of China. Read about “Muddling Meerkat” and the many other threat actors discovered by Infoblox Threat Intel here.

Azure

Reply

Azure vDiscovery automatic record creation hostname attributes?

New Member
Posts: 4
2230     0

I am looking at running vDicovery for the first time for Azure.  However, I am looking for some more context on the parameters that can be used for the automatic hostname creation. 

 

I would like to know the corresponding Azure attribute the parameter vm_name is pulled from on Azure for example?  I'm basically looking for a map of the parameter names below and the Azure names that match to the parameter so I can understand what will be pulled for the hostname.  Example I don't know what discovered_name parameter will pull from on the Azure side exactly and don't want to guess??

 

vm_id, vm_name, discovered_name, tenant_id, tenant_name, subnet_id, subnet_name, network_id, network_name, vport_name, ip_address, ip_address_octet1 or 1, ip_address_octet2 or 2, ip_address_octet3 or 3, ip_address_octet4 or 4

 

==============

The DNS name will be computed from the formula: Enter the formula that NIOS uses to create the DNS records for each discovered VM address. For example, if there are two IP addresses associated with a VM, NIOS creates two DNS records, or a host record with two IP addresses, depending on your configuration. You must use the syntax of ${parameter name} for the formula.

      For AWS, Azure, GCP, OpenStack, and VMware cloud platforms, this field supports the following parameters: vm_id, vm_name, discovered_name, tenant_id, tenant_name, subnet_id, subnet_name, network_id, network_name, vport_name, ip_address, ip_address_octet1 or 1, ip_address_octet2 or 2, ip_address_octet3 or 3, ip_address_octet4 or 4. Note that it does not support IPv6 addresses.

       For example, when you enter ${vm_name}.corp100.com and the discovered vm_name = XYZ, the DNS name for this IP becomes XYZ.corp100.com. When you enter ${discover_name} here and the discovered name for the IP is ip-172-31-1-64.us-west-1.compute.internal, the DNS name for this IP is ip-172-31-1-64.us-west-1.compute.internal.

=================

Showing results for 
Search instead for 
Did you mean: 

Recommended for You