---
title: "Data Flow (Events based)"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDCrowdstrikeEDR/1564246060/Data%20Flow%20(Events%20based)"
format: markdown
---
# **Solution Workflow and Functional Overview**

## **1. Log Ingestion**

The solution receives and processes logs from the following Infoblox sources:

- **Threat Defense logs**
- **SOC Insights logs**
- **DHCP Lease logs**

These logs serve as the primary data source for identifying threats and associated assets.

## **2. Asset Information Extraction**

From the ingested logs, the system extracts critical asset details, including:

- MAC address
- IP address
- Asset ID

This information is used to accurately map threats to specific devices within the network.

## **3. Quarantine Decision Logic**

### **Threshold-Based Evaluation**

Quarantine enforcement is based on user-defined criteria(Quarantine Criteria), which may include:

- **Policy Name**
- **Threat Level Max values**
- Severity Level
- Confidence level
- IP Address/Subnet

## **4. Browser-Based Filtering (Second Layer Validation)**

After the initial Quarantine Criteria is met, the system performs a **second-layer validation** using **CrowdStrike Falcon LogScale (FQL query)**.

This check verifies whether the source of the queried domain originates from a browser included in the user-defined:

```
browserAllowList (Edge,Chrome,Safari)
```

Only domain hits generated from the specified browsers are considered valid for quarantine processing.

## **5. Device Quarantine Enforcement**

If all criteria and validation checks are satisfied:

- The device is quarantined using the **CrowdStrike Falcon Sensor**.
- The action is applied based on Quarantine Criteria which is defined in:
  - Destination parameters or
  - Ipam Resource level like
    - Subnet
    - IP Space

## **6. Infoblox Asset Tag Update**

Upon successful quarantine:

- The system updates the Infoblox asset with a quarantine status tag.
- The tag key used:

```
CrowdStrike_Quarantine_Tag
```

This ensures synchronization between Infoblox and CrowdStrike.

## **7. DHCP Lease Monitoring & Automatic Release**

The system continuously monitors **DHCP Lease logs** for:

- Lease expiration
- Lease release events

When such an event is detected:

- The corresponding device is automatically removed from quarantine in CrowdStrike Falcon Sensor.