---
title: "DNS Security Policy Hit and RPZ Hit Log Message Mapping"
canonical: "https://docs.infoblox.com/space/BloxOneCloud/35366601/DNS%20Security%20Policy%20Hit%20and%20RPZ%20Hit%20Log%20Message%20Mapping"
format: markdown
---
<span style="color: #000000">This topic contains information about supported fields in DNS security policy hit and RPZ hit log messages for Infoblox Threat Defense and Universal DDI. It also contains corresponding field elements in CEF and LEEF formats via the syslog protocol and Splunk CIM via Splunk forwarder.</span>

<span style="color: #000000">CEF and LEEF messages use standard headers, as described below. </span>

## <span style="color: #000000">CEF Message header</span>

|  |
| --- |
| <span style="color: #000000">CEF:0|Infoblox|Data Connector|1.0.0|RPZ-QNAME-PASSTHRU|</span> |

## <span style="color: #000000">LEEF Message header</span>

|  |
| --- |
| <span style="color: #000000">LEEF:1.0|Infoblox|Data Connector|</span> |

## <span style="color: #000000">Severity Mapping</span>

<span style="color: #000000">The following table contains information about severity levels used in DNS security policy hit and RPZ hit logs and their corresponding severity mappings to other supported formats.</span>


| <span style="color: #000000">**Threat level**</span> | <span style="color: #000000">**Event Severity (as displayed in the reports)**</span> | <span style="color: #000000">**CEF/LEEF severity**</span> | <span style="color: #000000">**Syslog header severity**</span> |
| --- | --- | --- | --- |
| <span style="color: #000000">  - (not defined)</span> | <span style="color: #000000">Low</span> | <span style="color: #000000">0</span> | <span style="color: #000000">6</span> |
| <span style="color: #000000">0 - 29</span> | <span style="color: #000000">Low</span> | <span style="color: #000000">1</span> | <span style="color: #000000">6</span> |
| <span style="color: #000000">30 - 79</span> | <span style="color: #000000">Medium</span> | <span style="color: #000000">5</span> | <span style="color: #000000">4</span> |
| <span style="color: #000000">80 - 100</span> | <span style="color: #000000">High</span> | <span style="color: #000000">8</span> | <span style="color: #000000">2</span> |

> ⚠️ **Note**
> ⚠️ 
> ⚠️ <span style="color: #000000">Severity based on threat level and confidence is not supported by Data Connector at the current time. </span>

## <span style="color: #000000">DNS Security Policy Hit and RPZ Hit Logs</span>

<span style="color: #000000">The following table contains supported fields in DNS security policy hit and RPZ hit logs and their corresponding field elements for other supported message formats.</span>


| **Infoblox Portal Fields** | **Internal field** | **Product** | **CEF** | **LEEF** | **Splunk CIM** | **Description** |
| --- | --- | --- | --- | --- | --- | --- |
|  | dst  
rip | NIOS, B1TD | dst | dst | dest | DNS server |
|  | src  
qip  
device_ip | NIOS, B1TD | src | src | src | Source IP |
|  | spt  
qport | NIOS, B1TD | spt | spt | src_port | Source port |
| DNS View | view | NIOS | InfobloxDNSView | InfobloxDNSView | dns_view | DNS View |
| Query Type | qtype | NIOS, B1TD | InfobloxDNSQType | InfobloxDNSQType | query_type | Query type |
|  | qclass | B1TD | <span style="color: #111111">InfobloxDNSQClass</span> | <span style="color: #111111">InfobloxDNSQClass</span> | query_class | Query class |
| Action | msg.action<br>acode | NIOS, B1TD | act | act | action | Policy action |
| Query | msg.domain  
qname | NIOS, B1TD | destinationDnsDomain | url | query | Requested fqdn |
|  | msg.rpz | NIOS, B1TD | InfobloxRPZ | InfobloxRPZ | = | RPZ feed/zone |
|  | msg.rpz_rule<br>tname | NIOS, B1TD | InfobloxRPZRule | InfobloxRPZRule | signature | RPZ rule |
|  | msg.rpz_rule_type  
tcode | NIOS, B1TD | <span style="color: #111111">InfobloxRPZRuleType</span> | <span style="color: #111111">InfobloxRPZRuleType</span> | rpz_trigger_code | RPZ rule type. E.g.: QNAME, IP, NSIP, NSDNAME, CLIENT-IP. |
| MAC Address | cmac<br>mac_address | B1TD | smac | srcMAC | src_mac | MAC address of a client |
|  | csite | B1TD | InfobloxCSiteId | InfobloxCSiteId | client_site_id | Customer Site ID |
|  | pid | B1TD | InfobloxPolicyID | InfobloxPolicyID | policy_id | Policy ID |
|  | qcat | B1TD | InfobloxDomainCat | InfobloxDomainCat | dns_domain_category | Domain category |
| Property | tinfo | B1TD | InfobloxThreatProperty | InfobloxThreatProperty | threat_property | Threat property |
| Threat Confidence | B1TD | InfobloxThreatConfidence | InfobloxThreatConfidence | threat_confidence | Threat confidence |
| Threat Level | B1TD | InfobloxThreatLevel | InfobloxThreatLevel | threat_level | Threat level |
|  | rport | B1TD | <span style="color: #172B4D">-</span> | - | dest_port | DNS Server's port |
|  | severity<br>tinfo.threatlevel | NIOS, B1TD | - | - | severity | Severity |
|  | protocol | NIOS, B1TD | <span style="color: #172B4D">proto</span> | <span style="color: #172B4D">proto</span> | transport | TCP or UDP |
|  | username  
user_name | B1TD | - | - | user | Username |
|  | opcode | B1TD | - | - | opcode | Operational code |
| Source | source | B1TD | - | - | source_id | Source ID |
|  | disabled | B1TD | - | - | rule_disabled | Disabled |
|  | tid | B1TD | - | - | transaction_id | Transaction id |
|  | pid | B1TD | <span style="color: #111111">InfobloxPolicyID</span> | - | policy_id | Policy ID |
|  | cid | B1TD | - | - | client_id | Client ID |
|  | anonymized | B1TD | - | - | anonymized | Anonymized |
|  | csite | B1TD | <span style="color: #111111">InfobloxCSiteId</span> | - | client_site_id | Site ID |
|  | threat-property | B1TD | <span style="color: #111111">InfobloxThreatProperty</span> | - | threat_property | Threat property |
|  | threat-confidence | B1TD | <span style="color: #111111">InfobloxThreatConfidence</span> | - | threat_confidence | Threat confidence |
|  | threat-level | B1TD | <span style="color: #111111">InfobloxThreatLevel</span> | - | threat_level | Threat Level |
|  | qcat | B1TD | - | - | dns_domain_category | Domain category |
|  | arrtype | B1TD | - | - | arrtype |  |
|  | arrdata | B1TD | - | - | arrdata |  |
|  | - | NIOS, B1TD | - | - | ids_type | For CIM contains "network" |
|  | - | NIOS, B1TD | - | - | category | For CIM contains "RPZ" |
|  | - | NIOS, B1TD | - | - | vendor_product | For CIM:  
Infoblox NIOS  
Infoblox TD |
| ## <span style="color: #000000">Security Policy Hits: Additional Metadata</span> |
|  | region | B1TD | InfobloxB1Region | InfobloxB1Region | ib_b1_region | B1 PoP Region |
|  | pname | B1TD | InfobloxB1ConnectionType | InfobloxB1ConnectionType | ib_b1_connection_type | Connection type: remote_client, DFP, direct (NAT/Network) |
|  | display_name | B1TD | InfobloxB1OPHName | InfobloxB1OPHName | oph_name | Host name |
|  | ip_address | B1TD | InfobloxB1OPHIPAddress | InfobloxB1OPHIPAddress | oph_ip_address | Host IP |
|  | network | B1TD | InfobloxB1Network | InfobloxB1Network | src_network | Network name (Network, DFP, Client) |
| User | user_name | B1TD | suser | usrName | user_name | User name |
| Device Name | device_name | B1TD | dvchost | identHostName | src_device_name | User's device name |
|  | mac_address or cmac | B1TD | smac | srcMAC | src_mac | User's device MAC |
| Device IP | device_ip | B1TD | dvc | <span style="color: #111111">-</span> | src_ip | User's device IP |
| OS Version | os_version | B1TD | InfobloxB1SrcOSVersion | InfobloxB1SrcOSVersion | src_os_version | User's device OS |
| DHCP Fingerprint | dhcp_fingerprint | B1TD | InfobloxB1DHCPFingerprint | InfobloxB1DHCPFingerprint | src_dhcp_fingerprint | User's device DHCP Fingerprint |
|  | all_tags | B1TD | InfobloxB1DNSTags | InfobloxB1DNSTags | ib_dns_tags | DNS request categorization tags |
| Indicator | threat_indicator | B1TD | InfobloxB1ThreatIndicator | InfobloxB1ThreatIndicator | ib_b1_threat_indicator | Threat indicator |
| Feed | feed_name | B1TD | InfobloxB1FeedName | InfobloxB1FeedName | ib_b1_feed_name | Feed name |
|  | feed_type | B1TD | InfobloxB1FeedType | InfobloxB1FeedType | ib_b1_feed_type | Feed type |
| Policy | policy_name | B1TD | InfobloxB1PolicyName | InfobloxB1PolicyName | ib_b1_policy_name | B1TD policy name |
|  | policy_action | B1TD | InfobloxB1PolicyAction | InfobloxB1PolicyAction | ib_b1_policy_action | B1TD policy action |