---
title: "DNS Security Events Connector"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDDDI4GoogleSecOpsSOAR/1582989544/DNS%20Security%20Events%20Connector"
format: markdown
---
This connector can be set up for data polling at configured time intervals to create SOAR alerts for Infoblox DNS Security Events. These SOAR cases/alerts enable SOC analysts to investigate and respond to risky events by executing playbooks. For each new DNS Security Event, SecOps will generate an alert/case. 

 

## Configuration:  

1. To configure the instance, select SOAR Settings > Ingestion > Connectors.

![image-20250731-154956.png](media://17e86a93-a530-4ad0-a9db-3aef08356f67)

![image-20250731-155458.png](media://f1d9e68a-3034-4f50-b64a-0ed3706467e3)

2. Select the + icon to add a new connector and then select Infoblox - DNS Security Events Connector from the dropdown and then Create.

![image-20250731-155530.png](media://6f27b9c5-921d-4994-b994-357d00343255)

3. Complete the parameters configuration, enable and save the connector.

![image-20250731-160126.png](media://395ecd12-021b-4874-871b-38dfaf85eca1)

|  |  |  |  |  |
| --- | --- | --- | --- | --- |
| Argument Name | Type | Required<br>(Yes / No) | Default Value | Description |
| API Root | String | Yes | N/A | API root of the Infoblox instance |
| API Key | Password | Yes | N/A | API Token |
| Max Hours Backwards | Integer (Positive) | No | 24 | Number of hours before the first connector iteration to retrieve alerts from for the first time. |
| Queried name | String (List) | No | N/A | Filter by comma-separated queried domain names |
| Policy Name | String (List) | No | N/A | Filter by comma-separated security policy names |
| Threat Level | String | No | N/A | Filter by threat severity level (LOW, MEDIUM, HIGH) |
| Threat Class | String (List) | No | N/A | Filter by comma-separated threat category (e.g.,”Malware”, “MalwareDownload”) |
| Threat Family | String | No | N/A | Filter by comma-separated threat family (e.g., Log4Shell, OPENRESOLVER) |
| Threat Indicator | String (List) | No | N/A | Filter by comma-separated threat indicators (domains, IPs) |
| Policy Action | String (List) | No | N/A | Filter by comma-separated action performed (Log, Block, Default, Redirect) |
| Feed Name | String (List) | No | N/A | Filter by comma-separated threat feed or custom list name |
| Network | String (List) | No | N/A | Filter by comma-separated network name, on-premises host, endpoint, or DFP name |
| Limit | Int | No | 100 | Specify the maximum number of alert to create (default: 100) |

- Limitations

If the limit is set lower than the total available records for a given connector interval, data loss may occur. 

*Note: The connector supports many filtering parameters offered by the Infoblox API. To optimize ingestion and reduce the volume of unnecessary alerts, it is strongly recommended to apply the maximum number of relevant filters. This ensures efficient processing and minimizes noise in the SecOps environment. *