---
title: "Acquire Information for a Lambda function"
canonical: "https://docs.infoblox.com/space/DeploymentGuideIntegratingB1TDwithAWSRoute53/664338460/Acquire%20Information%20for%20a%20Lambda%20function"
format: markdown
---
In order to download TIDE feeds a Lambda function is used. This lambda function requires parameters specific to your environment. To acquire these parameters, perform the steps in following subsections:

### **Acquire a TIDE API Call URL**

The lambda function that will be created in this guide requires an API call to acquire feeds from BloxOne. Please note that it is possible to return a large data set via a TIDE API call. By default, AWS Route53 DNS Firewall allows adding up to 100.000 domains per list. If you need to publish more entries, please contact AWS. To create a TIDE API call, perform the following steps:

1. Log into the Infoblox CSP. Once logged in, highlight** ***Research* located in the bottom left of the navigation panel, then click on **Active Indicators** in the list that is revealed.

![image](media://62fb8ecf-44d2-4506-93a5-4b9c630de8e8)

2. Here you can see the list of *Active indicators*. Due to the quantity of data, it is suggested to filter the API call. Click **Clear **for each section, until all sections are unchecked.


![image](media://1ae5e266-fab8-4eab-a5a7-726bfcdbdded)

3. Under the *DATA TYPE* header, click the **checkbox** associated with the **Host** data type.

![A screenshot of a computer

Description automatically generated with medium confidence](media://54aca1ed-aea6-4be3-934d-d498d69e70fa)

4. Under the *THREAT CLASS/PROPERTY* header, click the **checkboxes** associated with the **Threat Class / Properties** you would like to add to your AWS Route 53 Domain Firewall list. *Note that it is suggested to only select one threat class/property per lambda function as duplicates may occur for domains that are associated with one or more threat class/property. Route 53 DNS Domain lists do not allow duplicate entries.*

![A screenshot of a computer screen

Description automatically generated with low confidence](media://3fcc9dc0-a8c3-4615-8506-2750a2562624)

5. Click **Apply Filter** to apply the selected filter.

![A screenshot of a computer

Description automatically generated with low confidence](media://d25f5c8b-3ede-4be0-b8bf-8f7df3dbda4c)


6. At the top of the *Active Indicators* page, click **Generate API request**. *Note this will create a simple API call for the IOC defined, this API call can be modified further with additional parameters.*

![image](media://b733e4f4-e718-43a5-ac34-14475d32ab54)

7. **Copy** the API call in the dialog box that has been revealed.

![A picture containing text, screenshot, font, line

Description automatically generated](media://8fb913dd-a73f-44c4-8859-3679c7d5822f)

8. **Paste** the API call to a text editor of your choice.

![A screen shot of a computer

Description automatically generated with medium confidence](media://d2b65c98-210e-49d4-89cb-a79e4740c65a)

9. Modify the API call by **deleting **all text until* /tide/***. **Additionally,** **keep all following text except for the closing quotation mark.

![A screen shot of a computer

Description automatically generated with medium confidence](media://793be46c-6b5e-43ee-bffd-007b9efa9ede)

10. Append the text **&field=host&data_format=csv** to the end of the string. *Note these parameters tell the API to only retrieve the Host field, and to return it in a CSV format.*

![A screen shot of a computer

Description automatically generated with medium confidence](media://95d7bd63-d660-480e-8381-0ad7504ed5ab)


11. (Optional) **Add** additional parameters to specify which IOCs will be imported. For more information on the parameters accepted by the TIDE API, please see the TIDE documentation located <u>[here](https://docs.infoblox.com/pages/viewpage.action?pageId=67089971)</u>. *Note, If you choose to import a large quantity of IOCs, the transfer of data may take a very long time.*
  - In the example screenshot, the API call has been altered to only acquire IOCs from a 30 day period via the text* &period=30d*. The call has also been altered to only accept 20 domains via the text *&rlimit=20.*

![image](media://fd10cf05-cb5a-4682-b1bd-77e0120820b1)

12. **Save** this API call for use later.

### **Acquire an AWS Route 53 DNS Firewall domain list ID**

To acquire an AWS Route 53 DNS Firewall domain list ID, perform the following steps:

1. Log in to your AWS account. Once logged in, input **Route53** into the *search bar* located at the top of the AWS interface.

![image](media://ba51da3b-48b8-4fae-88ba-88660410ffb9)

2. Click the text** Route 53** in the list that is revealed.

![image](media://83eb43a0-85c5-4333-a40e-613b8ba4b1b0)


3. In the *Route 53 navigation pane*, click **Domain List **located under the *DNS Firewall* header.

![A screenshot of a web page

Description automatically generated with low confidence](media://537aff7c-30b6-4fce-8ba2-6ad9b351498a)

4. On the *Domain Lists* page, in the *Owned domain lists* panel locate the Domain list you intend to add TIDE IOCs to. **Copy **the ID and **Save** it to a text file for use later. *Note, in the example screenshot the Domain list ID is rslvr-fdl-879a58dca13641a3*.

![image](media://3678c773-0ebf-495f-8dd3-3ca0047c82b6)