Page tree

Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.

BloxOne Threat Defense Cloud uses Swagger to publish and deliver its APIs. For a list of available APIs, first log in to the Cloud Services Portal, and then click the following link:

Open Links in New Window Note that you won’t be able to access the API page if you are not already logged in to the portal.

Below is a list of currently supported calls along with their descriptions.

BloxOne FW API (BloxOne Threat Defense Cloud)



Detailed information for the ATCFW API can be viewed on at 

Open Links in New Window

BloxOne Threat Defense Cloud is an extension of the BloxOne Suite that provides visibility into infected and compromised off-premises devices, roaming users, remote sites, and branch offices. You can subscribe to Infoblox BloxOne Threat Defense Cloud and use its functionality to mitigate and control malware as well as provide unprecedented insight into your network security posture and enable timely action. BloxOne  Cloud also offers unified policy management, reporting, and threat analytics across the entire spectrum. Using automated and high-quality threat intelligence feeds and unique behavioral analytics, it automatically stops device communications with C&Cs/botnets and prevents DNS based data exfiltration.

The mission-critical DNS infrastructure can become a vulnerable component in your network when it is inadequately protected by traditional security solutions and consequently used as an attack surface. Compromised DNS services can result in catastrophic network and system failures. To fully protect your network in today’s cyber security threat environment, Infoblox sets a new DNS security standard by offering scalable, enterprise-grade, and integrated protection for your DNS infrastructure.

Through the Infoblox Cloud Services Portal, you can view the status of your subscription and threat intelligence feeds, manage your network scope and roaming end users, and learn more about threats on your networks through the Infoblox Threat Lookup tool and predefined reports.

Open Links in New Window


BloxOne Cloud EP API (BloxOne Endpoint)



Detailed information for the ATCEP API can be viewed on at 

Open Links in New Window

Infoblox BloxOne Endpoint is a lightweight mobile agent that redirects DNS traffic from your remote devices to BloxOne Threat Defense Cloud. It allows you to apply applicable security policies to your roaming end users in remote sites and branch offices.

In order for end users to connect to Infoblox cloud services, you must download and install BloxOne Endpoint on their devices. The client enforces security policies that are applied to remote networks, regardless of where your end users are located, and to which networks they are connected. BloxOne Endpoint listens on port 53 of the device. If other software listens on the same port, DNS traffic cannot be redirected to BloxOne Threat Defense Cloud, and your device will not be protected by BloxOne Endpoint.

When you use BloxOne Endpoint, DNS queries are sent to BloxOne Threat Defense Cloud directly except for (1) queries that target the bypassed domains and (2) internal domains collected through the DHCP server. If you have internal domains that are served by your local DNS servers and you want to reach them without interruptions, you should consider adding them to the bypassed internal domains list so that DNS queries for these internal domains are sent to the local DNS servers instead of BloxOne Threat Defense Cloud.

BloxOne Endpoint supports dual-stack IPv4 and IPv6 DNS configurations, thereby protecting all devices regardless of their network environments. BloxOne Endpoint in a dual-stack environment is able to proxy IPv6 DNS queries and forward them to BloxOne Threat Defense Cloud over IPv4.

Open Links in New Window


BloxOne Cloud DFP API (DNS Forwarding Policy)



Detailed information for the ATCDFP API can be viewed on at 

Open Links in New Window

BloxOne Threat Defense Cloud is a SaaS offering designed to provide protection to devices on and off-premises, including roaming, remote, and branch offices. It provides visibility into infected and compromised devices, prevents DNS-based data exfiltration, and automatically stops device communications with command-and-control servers (C&Cs) and botnets, in addition to providing recursive DNS services in the cloud. You can access the services by deploying the BloxOne Endpoint agent or the DNS forwarding proxy.

For remote office deployments, or in cases where installing an endpoint agent is not desirable or possible, you can use the DNS forwarding proxy. It is a software application that runs on bare-metal, VM infrastructures, or Infoblox NIOS appliances, and embeds the client IPs in DNS queries before forwarding them to BloxOne Threat Defense Cloud. The communications are encrypted and client visibility is maintained. The proxy also provides DNS resolution to local DNS zones when you configure local resolvers. Once you set up a DNS forwarding proxy, it becomes the main DNS server for your remote site. It will also cache responses to speed resolution of future queries.

By implementing the DNS forwarding proxy, you can rest assured that BloxOne Threat Defense Cloud effectively enforces DNS client-based security policies at your remote sites. On-premises devices that send DNS queries reveal their actual client IP addresses (instead of their NAT IP address), thus allowing BloxOne Threat Defense Cloud to apply the security policies applicable to the respective endpoints and identify infected clients.

Open Links in New Window

BloxOne LAD API (BloxOne Lookalike Domains)



Detailed information for the ATCLAD API can be viewed on at 

Open Links in New Window

BloxOne LAD is an extension of the BloxOne Threat Defense Suite that provides lookalike domains detection. You can subscribe to BloxOne LAD and use its functionality to protect domains from spoofing threats.

Open Links in New Window