---
title: "Threat Defense Token-Based Licensing"
canonical: "https://docs.infoblox.com/space/BloxOneThreatDefense/1749025155/Threat%20Defense%20Token-Based%20Licensing"
format: markdown
---
Infoblox Threat Defense Security Portfolio is a hybrid cybersecurity solution that leverages DNS as the first line of defense to detect and block cyber threats. To support greater flexibility and scalability, Infoblox has transitioned to a Token-Based Licensing Mode**l** for Threat Defense, which includes two types of tokens: **Security Tokens** and **Infoblox Reporting Tokens**.
- **Security Tokens** are used to activate and scale key capabilities across **Threat Defense**, **IQ for Threat Defense**, **Dossier**, **Lookalike Domain Monitoring**, and **SOC Insights**.
- **Reporting Tokens** are universal and can be used across **UDDI** and **Threat Defense** to enable **log export** and **event forwarding** from Threat Defense Cloud.
This token-based model simplifies the activation and management of security and reporting features, allowing dynamic allocation of tokens across the Security portfolio based on an organization’s evolving needs.
In addition, organizations gain access to comprehensive usage dashboards that provide detailed visibility into how tokens are allocated across Threat Defense capabilities and features. Token utilization metrics are available at both daily and monthly intervals, enabling administrators to monitor trends, assess overall usage, and adapt as their environment changes. This visibility also supports more effective planning and budgeting through clear usage insights.
Before taking advantage of Threat Defense functionality, ensure that you obtain the necessary tokens from Infoblox. For pricing details and how to calculate token allocations, please contact your Infoblox Representative. If you are using a legacy Threat Defense license, see *[Licensing and Subscriptions](https://docs.infoblox.com/space/BloxOneThreatDefense/35403512/Licensing+and+Subscriptions)*.
## **Security Tokens**
**Security Tokens **are used to leverage and scale capabilities across the following, furthermore offering flexible entitlement aligned to what is protected and deployed:
- **Infoblox Threat Defense™**: Includes all functionalities for Threat Defense for NIOS and Threat Defense Cloud. Threat Defense is a hybrid cybersecurity solution that leverages DNS as the first line of defense to detect and block cyber threats. For information, see *[Infoblox Threat Defense](https://docs.infoblox.com/space/BloxOneThreatDefense/9928706/Infoblox+Threat+Defense)*.
- **Infoblox IQ for Threat Defense**: Infoblox IQ for Threat Defense uses agentic AI to investigate DNS security alerts by collecting evidence, analyzing activity, and determining root causes. It then presents SOC analysts with confirmed threats, affected users and devices, and recommended remediation actions.
For information, see *[Infoblox IQ for Threat Defense](https://docs.infoblox.com/space/BloxOneThreatDefense/2448392230/Infoblox+IQ+for+Threat+Defense)*.
- **Dossier™**: Dossier™ is a threat research tool that provides contextual information from multiple sources simultaneously. Dossier empowers you to make accurate security decisions more quickly and with greater confidence. Programmatic (API) access is provided to enrich your SIEM or security tools. For information, see *[Infoblox Dossier](https://docs.infoblox.com/space/BloxOneThreatDefense/272106087/Infoblox+Dossier)*[.](https://docs.infoblox.com/space/BloxOneThreatDefense/272106087/Infoblox+Dossier)
- **Lookalike Domain Monitoring**: Lookalike domains are domains that appear to be using aspects of other trusted domains for the purpose of associating themselves with those domains. Frequently, this association is used in attacks to make users believe they are interacting with a trusted source. Not all lookalikes are malicious, but once a lookalike is discovered it is investigated to determine if there are any suspicious or malicious behaviors associated with them. For information, see *[Lookalike Domain Monitoring](https://docs.infoblox.com/space/BloxOneThreatDefense/35436069/Lookalike+Domain+Monitoring)*.
- **SOC Insights**: SOC Insights allows organizations to identify, monitor, and analyze threat actors and their activities on their networks thereby reducing the mean-time-to-respond (MTTR) to potential risks with precise, actionable intelligence. For information, see *[SOC Insights](https://docs.infoblox.com/space/BloxOneThreatDefense/501514252/SOC+Insights)*.
## Security Tokens for Threat Defense Cloud
In Threat Defense Cloud, token allocation is determined by the number of protected assets, which are categorized as either verified or unverified. ** **
### Protected Assets
A Protected Asset is any asset that sends DNS queries to the Threat Defense Cloud.
- **Verified Assets: **A verified asset is any device Infoblox can directly associate with a unique identity. For an asset to be considered Verified, it needs to be associated with an IP address plus at least one other piece of unique identifying information (i.e MAC Address or Host Name). Assets are de-duplicated to make sure that information from multiple sources are consolidated and only counted as a single Asset. These assets are licensed and are allowed up to 3,500 DNS queries per day. See token usage information for information on verified assets that exceed the daily quota.
- **Unverified Assets:** Unverified assets are devices that appear on the network without persistent identifiers or agent-based visibility, often seen behind NAT or via passive discovery. Because they offer limited context and security telemetry, they are subject to a lower threshold of 2,000 DNS queries per day. See token usage information for information on unverified assets that exceed the daily quota.
| **Protected Asset Category** | **Definition** | **QPD Limit per asset*** | **Allocated Token per asset** |
| --- | --- | --- | --- |
| Verified | Assets which are uniquely Identifiable | 3500 | 3 |
| Unverified | Assets with no persistent identity | 2000 | 3 |
| **Note**: Assets above the QPD limit will be counted as more than 1 asset, refer to token usage information for more details |
## Security Tokens for Threat Defense for NIOS
Threat Defense (TD) for NIOS is licensed using **Security Tokens** based on the specific NIOS server model deployed. Security tokens are required per logical Grid Member (not per individual node). Only the Primary member needs tokens; HA pairs are covered under that token allocation. Security tokens provide access to Threat Insight and RPZ feed downloads on NIOS servers. For appliance token allocations and sizing guidance, *[Sizing Guidelines for Trinzic Appliances](https://docs.infoblox.com/space/BloxOneThreatDefense/35434905/Sizing+Guidelines+for+Trinzic+Appliances)*
| | | |
| --- | --- | --- |
| **NIOS Server Model** | **Capacity (RPZ Records in M)** | **Tokens** |
| TE-815 | 6 | 485 |
| TE-825 | 6 | 735 |
| TE-926 | 16 | 880 |
| TE-1516 | 40 | 2,270 |
| TE-1526 | 40 | 2,995 |
| TE-2326 | 60 | 6,755 |
| TE-4126 | 60 | 17,010 |
| TE-1415 | 12 | 1,800 |
| TE-1425 | 12 | 2,600 |
| TE-2215 | 40 | 3,860 |
| TE-2225 | 40 | 5,225 |
| TE-4015 | 60 | 11,690 |
| TE-4025 | 60 | 13,610 |
| **Note**: The allocation of tokens for NIOS is determined by the appliance model. For information on sizing Trinzic appliances, see *[Sizing Guidelines for Trinzic Appliances](https://docs.infoblox.com/space/BloxOneThreatDefense/35434905/Sizing+Guidelines+for+Trinzic+Appliances)*. |
## **Security Token Add-ons and Standalone Offers**
**Infoblox IQ for Threat Defense Add-on**: Infoblox IQ for Threat Defense can be enabled using a portion of Threat Defense Cloud Tokens. When enabled, IQ for Threat Defense will need additional tokens. The quantity of tokens allocated will be 35% of the quantity of tokens that an organization buys for Threat Defense Cloud Protected Assets. For example, if an organization purchases 3000 tokens for Threat Defense Cloud, they need an additional 35% of that number of tokens that will be allocated for SOC Insights.
**SOC Insights Add-on**: SOC Insights can be enabled using a portion of Threat Defense Cloud Tokens. When enabled, SOC Insights will need additional tokens. The quantity of tokens allocated will be 35% of the quantity of tokens that an organization buys for Threat Defense Cloud Protected Assets. For example, if an organization purchases 3000 tokens for Threat Defense Cloud, they need an additional 35% of that number of tokens that will be allocated for SOC Insights.
**Dossier and Lookalike Monitoring Standalone**: Dossier and Lookalike monitoring require additional Security tokens to be allocated.
The following table lists the add-ons and standalone solutions available and their respective token requirements:
| **Item** | **Type** | **Allocation Details** | **Allocated Tokens** |
| --- | --- | --- | --- |
| Infoblox IQ for Threat Defense | Add-on | Percentage of Threat Defense Cloud Tokens for protected assets | 35% of Threat Defense Cloud token allocation
[same as SOC Insights] |
| SOC Insights | Add-on | Percentage of Threat Defense Cloud Tokens for protected assets | 35% of Threat Defense Cloud token allocation |
| Dossier | Standalone | 25 Dossier QPD per pack | 450 Tokens |
| Lookalike Monitoring | Standalone | 25 Lookalike domains per pack | 1200 Tokens |
## **Reporting Tokens **
**Reporting Tokens **enable log export and event forwarding from Threat Defense Cloud. They’re required to send logs to external platforms, like SIEM, SOAR or data lakes. Reporting Tokens are allocated based on the volume of logs exported per month, in increments of 10 million logs. The same Reporting Tokens are used across Infoblox Security products and the Infoblox Universal DDI™ Product Su**i**te, providing a consistent and streamlined approach to reporting.
- They are used to forward data to SIEM, SOAR, or other external platforms.
- Support integrations through the Cloud Data Connector.
> 📝 **Note**: 30 day Active search does not require token allocation in Threat Defense
| **Item** | **Type** | **Allocation** | **Tokens** |
| --- | --- | --- | --- |
| Reporting | Add-on | 10 million log events per month | 40 |
## Token Usage
The following sections describe how Infoblox calculates token usage and where and what you can see in the usage reports.
### Threat Defense for NIOS
| **Feature** | **Details** |
| --- | --- |
| Threat Defense for NIOS | Tokens are allocated based on the number of grid members. Only the primary node requires a token license. HA nodes are included without separate token allocation.
**Note**: Automatic model detection is not supported. Customer-provided data is manually validated.
For information on setting up On-Prem Firewall Service for NIOS, see *[Configuring On-Prem Firewall Service](https://docs.infoblox.com/space/BloxOneThreatDefense/356614212/Configuring+On-Prem+DNS+Firewall+Service)**.* |
### Threat Defense Cloud
In Threat Defense Cloud, token allocation is based on the total number of protected assets, which include both verified and unverified assets.
| | | | |
| --- | --- | --- | --- |
| **Asset Type** | **Daily Query Limit** | **Allocation Rule** | **Scaling Example** |
| Verified Asset | 3,500 DNS queries/day | Allowed up to 3500 DNS queries per day under the standard token allocation. If an individual asset exceeds that limit, additional queries are evaluated in 3,500-query increments. | - 0–3,500 queries = 1 asset
- 3,501–7,000 queries = 2 assets
- 7,001–10,500 queries = 3 assets |
| Unverified Asset | 2,000 DNS queries/day | Allowed up to 2,000 DNS queries per day under the standard token allocation. | - 0–2,000 queries = 1 asset
- 2,001–4,000 queries = 2 assets
- 4,001–6,000 queries = 3 assets |
Token allocation across Threat Defense Cloud, Threat Defense for NIOS, and other services is continuously monitored by the Infoblox platform to ensure compliance with licensed entitlements.
### **Threat Defense Cloud, Dossier, and Lookalike Domain Monitoring**
- Daily Usage Snapshots
- Every 24 hours, the system captures a snapshot reflecting actual usage of tokens by protected asset counts, Dossier API calls, monitored lookalike domains.
- Token usage is measured independently for each contributing feature
- **Threat Defense Cloud**: The number of protected verified and unverified assets observed
- **Dossier API**: The number of Dossier queries (QPD)
- **Lookalike Domain Monitoring**: Number of lookalike domains monitored
- **Monthly High-water Mark**: For each feature (e.g., Threat Defense Cloud, Lookalike Domain Monitoring), the system records the monthly high-water mark—the single day of the month with the highest token allocation for that feature.
- Dossier token allocation is based on sustained average usage over time**.**
## Rolling 3-month Average
Token usage compliance is based on a rolling three-month average calculated from monthly high-water marks for Threat Defense Cloud and Lookalike Monitoring. To assess compliance for Dossier, Infoblox uses a rolling 3-month average of the monthly QPD averages.
## The Threat Defense Token-based License Utilization Dashboard
The Infoblox Threat Defense Token-based License Entitlements Dashboard provides a comprehensive overview of security license usage. It is specifically designed to highlight significant trends related to key aspects of Infoblox Threat Defense and consolidates license entitlements and usage in a single view, including queries, Dossier™ utilization, and events occurring within the Infoblox Ecosystem. By presenting this information in a clear and organized format, the dashboard enables users to monitor their token usage.
This clarity facilitates the identification of potential issues and supports the optimization of defense strategies. The insights gained from the dashboard are essential for making informed decisions about security management and resource allocation.
The Threat Defense Token-based Licensing dashboard is divided into the following sections:
### **Threat Defense Token-based License Entitlement Overview**
The Token-based **License Entitlement Overview** (KPI ribbon) is divided into **Security** and **Reporting** sections. Each section displays the total number of tokens linked to your account.
This section provides the following information for Security and Reporting:
### Security
**Security: **The *Security *metric refers to the number of security tokens allocated to an organization account under a token-based entitlement.
- **1K**: Indicates the account has **1,000 security tokens** available for allocation.
- **Start Date (07/02/25)**: The day the entitlement becomes active.
- **Expires on (07/02/27)**: The day the entitlement ends; tokens cannot be allocated if they are not part of an active entitlement. Tokens must be renewed after the contract period ends.
### Reporting
**Reporting: **The *Reporting *metric refers to the reporting tokens allocated to the organization account under a token-based entitlement. Tokens are valid based on the contract. Tokens must be allocated within the active period.
- **40**: Indicates the account has **40 reporting tokens** available, which are allocated when exporting Threat Defense logs(Security, DNS logs, etc.) from Infoblox Threat Defense Cloud to another platform (i.e SIEM.
- **Start Date (07/16/25)**: The day the reporting entitlement becomes active.
- **Expires on (07/16/26)**: The day this reporting entitlement ends. Tokens cannot be allocated if they are not part of an active contract. Tokens must be renewed after contract period ends.
### **Trend Metric Analysis (Graphic Analysis)**
The **Trend Metric Analysis** section displays a graphical representation of token usage in the account. The trend metric analysis section is divided into two sub-sections: **Security** and **Reporting**.
- The **Security** section includes metrics for Threat Protection and Add-ons.
- The ***Reporting ***section includes metrics for Threat Protection and Add-ons. Each sub- section reports metric data for the last three months.
- Both the **Security** and **Reporting** metrics charts include peak token usage for the last three month period, along with the average token usage for the same three-month period.
The graphic analysis charts display the following information:
### Security
- **Threat Protection**: This chart shows token allocation across threat protection modules. The tool tip reports the number of tokens allocated for each threat protection type. The legend indicates the threat protection capabilities that are in use.. Hide or show an active threat protection type in the legend by clicking on it. Hiding a threat protection type will remove its data from the chart. Showing an inactive threat protection type in the legend by clicking on it. Reactivating a threat protection type will add its data to the chart.
- **Add-ons**: This chart highlights specialized services consuming tokens. The legend indicates the active add-ons for the account. Deactivate an active add-on in the legend by clicking on it. Deactivating an add-on will remove its data from the chart. Reactivate an inactive add-on in the legend by clicking on it. Reactivating an add-on will add its data to the chart.
### Reporting
- **Reporting / Average**: This chart tracks analytics/reporting token usage per environment. The metrics including the total number of reporting events and a breakdown of reported events in the environments. The legend indicates what environments are reporting during the last three months, including peak token usage and average token usage. Deactivate an active reporting environment in the legend by clicking on it. Deactivating a reporting environment will remove its data from the chart. Reactivate an inactive reporting environment in the legend by clicking on it. Reactivating a reporting environment will add its data to the chart.
### ** Trend Metric Analysis (Numerical Analysis)**
The **Trend Metric Analysis** panel displays a numerical representation of token usage in the account. The trend metric analysis panel is divided into multiple sub-sections depending on token usage.
### **Time Analysis**
Time analysis for token usage is available on a daily basis or monthly. Monthly usage is displayed by default.
### Monthly
Monthly metrics are displayed by default for the current month.
### **Daily**
Monthly metrics are displayed for the selected time period.
To select a monthly time period for viewing metric data, from the option menu, select a month. Do note that only the most recent three months of metric data is available.
## **Related Resources**
Refer to the following resources for additional information:
- Threat Intelligence Feeds: *[Threat Intelligence Solution Note](https://www.infoblox.com/wp-content/uploads/infoblox-solution-note-threat-intelligence.pdf)* (PDF).
- Available feeds: *[Viewing Active Threat Feeds and Threat Insight](https://infoblox-docs.atlassian.net/wiki/pages/createpage.action?spaceKey=BloxOneThreatDefense&title=Viewing%20Active%20Threat%20Feeds%20and%20Threat%20Insight)*.
- SOC Insights, see *[SOC Insights](https://infoblox-docs.atlassian.net/wiki/pages/createpage.action?spaceKey=bloxonethreatdefense&title=%5BDEPRECATED%5D%20Insights&linkCreation=true&fromPageId=1749025155)*.
- Infoblox IQ for Threat Defense, see *[Infoblox IQ for Threat Defense](https://docs.infoblox.com/space/BloxOneThreatDefense/2448392230/Infoblox+IQ+for+Threat+Defense#What-Infoblox-IQ-for-Threat-Defense-Provides)*.
For additional information on Infoblox Threat Defense subscription licensing packages, see the following:
- Infoblox Threat Defense Business On-Premises, see *[InfobloxThreat Defense Business On-Premises Datasheet](https://insights.infoblox.com/resources-datasheets/infoblox-datasheet-infoblox-threat-defense-business-on-premises)* (PDF).
- Infoblox Threat Defense Business Cloud, see *[Infoblox Threat Defense Business Cloud Datasheet](https://insights.infoblox.com/resources-datasheets/infoblox-datasheet-infoblox-threat-defense-business-cloud)* (PDF).
- Infoblox Threat Defense Advanced, see *[Infoblox Threat Defense Advanced Datasheet](https://insights.infoblox.com/resources-datasheets/infoblox-datasheet-infoblox-threat-defense-advanced)* (PDF).