---
title: "Licensing and Subscriptions"
canonical: "https://docs.infoblox.com/space/BloxOneThreatDefense/35403512/Licensing%20and%20Subscriptions"
format: markdown
---
InfobloxTM Threat Defense offers the following license packages:
- Infoblox Threat Defense Essentials
- Infoblox Threat Defense Business On-Premises
- Infoblox Threat Defense Business Cloud
- Infoblox Threat Defense Advanced
Each package provides a different level of threat intelligence feeds, features, and protection.
Depending on your subscription, you might or might not have access to all functionality through the Infoblox Portal. For detailed information about Infoblox Threat Defense subscriptions, contact your Infoblox representative. For information on viewing your licensing entitlements from within the Infoblox Portal, see *[Viewing License Entitlements](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35438836)*.
For information on Threat Defense token-based licensing, see *[Threat Defense Token-Based Licensing](https://docs.infoblox.com/space/BloxOneThreatDefense/1749025155/Threat+Defense+Token-Based+Licensing)*.
> ⚠️ The **Configure** and **Monitor** lifecycle navigation of the Infoblox Portal displays features that are accessible through product upgrades. The Infoblox Portal greys out these features, allowing you to decide whether upgrading to a higher-level license package is suitable for your organizational needs and requirements. For information, see *[Managing the Monitoring Lifecycle](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/827555975)* and *[Managing the Configuring Lifecycle](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/827556029)*.
The following table lists the available features for each license package:
| **Feature** | **Essentials** | **Business On-Premises** | **Business Cloud** | **Advanced** |
| --- | --- | --- | --- | --- |
| Access Authentication | | | ### **✔** | ### **✔** |
| Active indicators tool (for TIDE) | | | | ### **✔** |
| Application Discovery tool | | | | ### **✔** |
| Block DNS Data Exfiltration, DNS Tunneling | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| Block Malicious Domains (malware, C2, phishing, etc.) | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| Infoblox Endpoint (Mac, Windows, Linux, ChromeOS, iOS, Android) | | | ### **✔** | ### **✔** |
| DNS Activity Report | | | ### **✔** | ### **✔** |
| DNS Firewall | Per Member | Grid Wide | | Grid Wide |
| DNS Security Report | | | ### **✔** | ### **✔** |
| Cloud-based DNS Firewall | | | ### **✔** | ### **✔** |
| Lookalike Domain Tool (detection for phishing, malware, other threats) | | | | ### **✔** |
| DGA Detections (feed-based) DGA | | ### **✔** | ### **✔** | ### **✔** |
| DNS Forwarding Proxy (DFP) | | | ### **✔** | ### **✔** |
| DNS Resolver (in the cloud) | | | ### **✔** | ### **✔** |
| DNS Anycast for DFP | | | ### **✔** | ### **✔** |
| DNS over HTTPS risk management (feed) | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| Dossier for contextual & detailed threat intelligence (queries per year) | | 32,000 | 32,000 | 64,000 |
| Local DNS Break-Out with Infoblox DDI | | | ### **✔** | ### **✔** |
| Scheduled Reports | | | ### **✔** | ### **✔** |
| Security ecosystem (data sharing and response automation) | Available via a SKU or standalone | Grid Wide | Data Connector Only | Grid Wide |
| Summary Reports (Executive Summary and Comprehensive Security reports) | | | ### **✔** | ### **✔** |
| Threat feeds in DNS RPZ format | ### **✔** | ### **✔** | | ### **✔** |
| Threat Insight based DGA and DDGA | | | ### **✔** | ### **✔** |
| Threat Lookup to research attacker data | ### **✔** | | | |
| TIDE (Ingest & Distribute custom feeds) | | | | ### **✔** |
| Web Content Filtering | | | ### **✔** | ### **✔** |
| Predefined Reports: Predefined reports are available based on your license package. For information on the reports available in the Infoblox Portal, see *[Viewing Reports](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35471742)*. |
## **Threat Intelligence Feeds**
The following table details the threat intelligence feeds and features available with each license package:
| **Feed** | **Indicator Type ** | **Essentials** | **Business On-Premises** | **Business Cloud** | **Advanced** |
| --- | --- | --- | --- | --- | --- |
| Infoblox Base | FQDN | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| Infoblox Base IP | IP Addresses | | ### **✔** | ### **✔** | ### **✔** |
| Infoblox High Risk | FQDN | | | | ### **✔** |
| Infoblox Medium Risk | FQDN | | | | ### **✔** |
| Infoblox Low Risk | FQDN | | | | ### **✔** |
| Infoblox Informational | FQDN | | ### **✔** | ### **✔** | ### **✔** |
| Bogon | IP addresses | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| Cryptocurrency | FQDN | | ### **✔** | ### **✔** | ### **✔** |
| DHS AIS Domains | FQDN | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| DHS AIS IP | IP addresses | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| DOH Public Hostnames | FQDN | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| DOH Public IPs | IP addresses | ### **✔** | ### **✔** | ### **✔** | ### **✔** |
| EECN IPs | IP addresses | | ### **✔** | ### **✔** | ### **✔** |
| TOR Exit Node IPs | IP Addresses | | ### **✔** | ### **✔** | ### **✔** |
| US OFAC Sanctions IP Embargoed IPs | IP Addresses | | ### **✔** | ### **✔** | ### **✔** |
| US OFAC Sanctions High IPs | IP Addresses | | ### **✔** | ### **✔** | ### **✔** |
| US OFAC Sanctions Med IPs | IP Addresses | | ### **✔** | ### **✔** | ### **✔** |
## **Threat Insight Detection**
| **Threat Insight** | **Indicator Type** | **Essentials** | **Business On-Premises** | **Business Cloud** | **Advanced** |
| --- | --- | --- | --- | --- | --- |
| Threat Insight - Zero Day DNS | FQDN | | | | ### **✔** |
| Threat Insight - Data Exfiltration | FQDN | | ### **✔** | ### **✔** | ### **✔** |
| Threat Insight - Notional Data Exfiltration | FQDN | | ### **✔** | ### **✔** | ### **✔** |
| Threat Insight - DGA | FQDN | | | ### **✔** | ### **✔** |
| Threat Insight - Messenger | FQDN | | ### **✔** | ### **✔** | ### **✔** |
## **Add-ons and Third-party Threat Indicator Feeds**
The following add-ons and third-party threat indicator feeds are not included in any subscription package but can be purchased via a SKU or standalone:
| **Item** | **Type** | **Description** | **Subscription** |
| --- | --- | --- | --- |
| SOC Insights ASEC | Add-on | SOC Reporting add-on | - Infoblox Threat Defense Business Cloud
- Infoblox Threat Defense Advanced |
| Farsight Security Newly Observed Domains | Third-party Feed | NOD and RPZ data | - Not subscription based but can be purchased via a SKU or as a standalone. |
| Stand-Alone Mode for Custom Domain Monitoring | Option | **Stand-alone mode** offers Lookalike Domain monitoring without requiring an Infoblox Threat Defense subscription. Each subscription includes monitoring for up to 100 custom watched domains. This option is designed for organizations not yet ready to purchase a Threat Defense subscription. | - Not subscription based but can be purchased via a SKU.
- This subscription is taylored for those organizations who have not yet purchased a Threat Defense subscription. |
See the following topics, for additional information.
- For information about Threat Intelligence Feeds, see *[Threat Intelligence Solution Note](https://www.infoblox.com/wp-content/uploads/infoblox-solution-note-threat-intelligence.pdf)* (PDF).
- For descriptions of all available feeds, see *[Viewing Active Threat Feeds and Threat Insight](https://infoblox-docs.atlassian.net/wiki/pages/createpage.action?spaceKey=BloxOneThreatDefense&title=Viewing%20Active%20Threat%20Feeds%20and%20Threat%20Insight)*.
- For information on RPZ feeds and what RPZ feeds are included based on subscription level, see *[RPZ Feeds](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/228360243)*.
- For information on SOC Insights, see *[SOC Insights](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/501514252)*.
- For information on licensing entitlements, see *[Viewing License Entitlements](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35397411)*.
- For information on Threat Defense token-based licensing, see *[Threat Defense Token-Based Licensing](https://docs.infoblox.com/space/BloxOneThreatDefense/1749025155/Threat+Defense+Token-Based+Licensing)*.