---
title: "Event-Based Scanning & Asset Enrichment"
canonical: "https://docs.infoblox.com/space/DeploymentGuideIPAMTDwithRapid7/1632567463/Event-Based%20Scanning%20%26%20Asset%20Enrichment"
format: markdown
---
This workflow enables **real-time vulnerability scanning** and asset enrichment based on incoming event logs from Infoblox, such as **Threat Defense**, **DHCP**, **SOC Insight**, and **IPAM Audit**. Each log type triggers different logic to ensure timely and targeted scanning in Rapid7 InsightVM.

### General Data Flow

1. **Event Log Reception**
  - The integration listens for and processes the following logs from Infoblox:
    - **Threat Defense** (Threat Feed Hits)
    - **DHCP Lease** events
    - **SOC Insight** alerts
    - **IPAM Audit** changes
2. **Fetch Asset Information**
  - Based on the event, asset details such as IP, MAC address, and tags are retrieved from Infoblox.
3. **Update Asset Records**
  - After scanning, assets are enriched with scan results via tags or InsightVM comments:
    - `Rapid7_scan_id` – Scan identifier
    - `Rapid7_scan_time` – Timestamp of scan completion
4. **Scan Restriction Logic**
  - To avoid duplicate scans, a time window (`scanRestrictionTime`) is enforced. If the asset was scanned recently, the new scan is skipped.
5. **Exclude Public or Unwanted IPs**
  - Use `ipRangeToExclude` to define which IP ranges should be skipped from scanning or sync (e.g., public IPs or sensitive internal ranges).

### Event Log Processing by Type

#### **1. Threat Defense Logs (DNS Threat Feed Hits)**

- **Trigger Logic:**
  - Scanning is initiated only if the asset (or its parent) is tagged with `VM_Scan_on_Policy_Hit = true`.
  - Tag evaluation priority:
    - IP Address
    - IP Range
    - Subnet
    - IP Space (DFP service)
    - Endpoint Group (Endpoint service)
- **Scan Criteria:**
  - Defined using `Rapid7_Scan_Criteria` tag (e.g., severity, confidence, policy name).
  - Criteria evaluation follows the same hierarchy as the tag logic above.
- **Outcome:**
  - If criteria match and tagging is valid, the asset is scanned using Rapid7.

#### **2. DHCP Lease Logs**

- **New Leases:**
  - Assets receiving a new DHCP lease are automatically synced and scanned.
- **Updated Leases:**
  - If a lease update occurs, scanning only happens if the asset hasn’t been scanned recently (based on `scanRestrictionTime`).

#### **3. SOC Insight Logs**

- **New Alerts:**
  - All impacted assets are identified, synced, and scanned.
- **Updated Alerts:**
  - Only assets affected within the **last 70 minutes** are considered for sync and scan.

#### **4. IPAM Audit Logs**

- **Triggered On:**
  - Any changes to IPAM object types such as:
    - Address Blocks
    - Subnets
    - Ranges
    - Fixed IPs
    - Reservations
    - Hosts
    - IP Space
- **Initial Sync:**
  - When tags are updated, assets are re-synced with Rapid7.
- **Used IP Filtering:**
  - If `restrictToUsedIps = true`, only objects with MAC addresses are processed.
- **Tag-Based Actions:**
  - `Rapid7_sync`: Triggers asset sync
  - `Rapid7_group`: Adds the asset to a group
  - `Rapid7_scan`: Initiates scanning
- **Tag Evaluation Order:**
  - Object-level
  - IP Space-level (fallback)

### Configuration – Destination Parameters (Auto-filled Keys, User-provided Values)

| Parameter | Description |
| --- | --- |
| `cspInstance` | Infoblox portal URL (e.g., `csp.infoblox.com`) |
| `cspApiKey` | Infoblox API key for authentication |
| `rapid7Username` | Rapid7 API username |
| `rapid7Password` | Rapid7 API password |
| `rapid7Instance` | Rapid7 API URL (e.g., `<IP>:<Port>`) |
| `scanRestrictionTime` | Time window (in hours) to prevent repeat scans |
| `restrictToUsedIps` | Set to `true` to scan only used IPs (with MACs) |
| `scanCriteria` | Logical conditions for scanning assets |
| `ipRangeToExclude` | IP ranges to exclude from sync/scan |
| `rapid7AssetSite` | Target site name in Rapid7 for grouping |

> ℹ️ The destination parameter keys will be **auto-filled**. User only need to provide the correct values for your environment.