---
title: "Data Flow (Event Based)"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDIntegrationCiscoISE/1544683786/Data%20Flow%20(Event%20Based)"
format: markdown
---
1. **Log Reception:** Receives logs from Infoblox with specific log types of Threat Defense, SOC Insights, and DHCP Lease.
2. **Asset Information:** Extracts asset details such as MAC address, IP address, and asset ID.
3. **Evaluating Policy Application Condition:** The policy application depends on **Policy Apply Criteria** or **Threat Level Max** threshold values provided by the user, either in Destination Parameters or in tags.
  1. **Policy Apply Criteria:** Retrieves the value of Policy Apply Criteria, prioritizing Subnet first, followed by IP Space (DFP Service) or Endpoint Group (Endpoint Service) from tags with the key **Policy_Apply_Criteria**. Given Least Priority to Destination Parameter **policyApplyCriteria**. (Note: The Data Connector Destination Variable is  ‘**policyApplyCriteria’ and the tag key used in subnet and IP space is Policy_Apply_Criteria’.**
  2. **Threat Level Max:** Determines the Threat Level Max value, prioritizing Subnet first, then IP Space (DFP Service) or Endpoint Group (Endpoint Service) from tags with the key **Threat_Level_Max**. Given Least Priority to Destination Parameter **threatLevelMax**. (Note: The Tag key is** Threat_Level_Max while the Data Connector Destination variable is threatLevelMax)**
4. **Quarantine Policy Application:** Applies a quarantine policy via Cisco ISE based on the result of the condition evaluation.
5. **Infoblox Asset Tag Update:** Updates Infoblox asset tags with quarantine status with the key **Cisco_ISE_Policy_Tag**.
6. **Logging:** Log operations, including successful updates and errors.