---
title: "Infoblox Portal Configuration (Event Based)"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDCrowdstrikeEDR/1564147894/Infoblox%20Portal%20Configuration%20(Event%20Based)"
format: markdown
---
The configuration steps outlined in this section are intended to apply the necessary settings on Infoblox Threat Defense<sup>TM</sup> to enable the solution to quarantine endpoints based on DNS events generated by those endpoints. Actual configurations may vary depending on the specific deployment environment and organizational requirements.

## Data Connector Configuration.

### Destination

1. Navigate to Configure > Administration > Data Connector

2. Click on the Destination Tab

3. Select the destination entry named *CrowdStrike_TDevents (note: CrowdStrike_TDevents will be the suffix of the destination name) and click Edit to modify its configuration.

4. Expand Variables section and provide appropriate values for the variables listed in this section.

5. Click on Save and Close
  

### Destination Parameter

1. **cspInstance**: Instance URL of the Infoblox CSP instance (e.g., [http://csp.infoblox.com](http://csp.infoblox.com)  ).
2. **cspApiKey**: API key for authenticating requests to the CSP.
3. **crowdStrikeClientId**: Client ID used for authentication with CrowdStrike APIs.
4. **crowdStrikeClientSecret**: Secret key associated with the CrowdStrike Client ID for secure authentication.
5. **crowdStrikeInstance**: Base URL of the CrowdStrike API instance.
6. **ipRangeToExclude (Optional)**: Specifies IP ranges that should not be quarantined (e.g., ‘12.12.12.0/24, 12.12.13.0-12.12.13.10, 12.12.12.12’).
7. **quarantineCriteria (Optional)**: Conditions for applying quarantine based on severity/confidence levels (e.g., ‘(Severity >= Medium and Confidence >= High) and (policy_name = Default Global Policy, Block All)’).
8. **threatLevelMax (Optional)**: Maximum threat level threshold (numeric) for applying quarantine (e.g., 2).
9. **browserAllowList (Optional)**: List of browser names which the user wants to allow for querying any domain (e.g., ‘Edge, Chrome, Safari’).

**Note: **Ensure all the required parameters are available in Destination parameters.


## Traffic Flow

1. Navigate to Configure > Administration > Data Connector

2. Click on the Traffic Flow Tab

3. Select the * CrowdStrike_TDevents Traffic Flow entry (note: CrowdStrike_TDevents will be the suffix of the Traffic Flow entry name) and click Edit to modify its configuration.

4. In the Log Source Configuration Section, select the source as Infoblox Cloud Source

5. Expand the Source Configuration section

6. Click on Add Log Type drop-down and select ‘DDI DHCP Lease log’, ‘SOC Insights’ and ‘Threat Defense Threat Feed Hits log’ options

7. Click on Next

8. In the Destination Configuration section, select Destination as * CrowdStrike_TDevents Destination option and click on Next

9. In the Service Instance section select the Service Instance that is running the Data Connector Service and installed for this use case and click on Next

10.    Click on Save and Close  


![image-20250718-105152.png](media://a2105f3b-a1a2-4a9d-9e2e-416a1e33debf)