---
title: "Infoblox Portal Configuration (Event Based)"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDIntegrationCiscoISE/1544716700/Infoblox%20Portal%20Configuration%20(Event%20Based)"
format: markdown
---
The configuration steps outlined in this section are intended to apply the necessary settings on Infoblox Threat Defense<sup>TM</sup> to enable the solution to quarantine endpoints based on DNS events generated by those endpoints. Actual configurations may vary depending on the specific deployment environment and organizational requirements.

## Data Connector Configuration

### Destination

1. Navigate to Configure > Administration > Data Connector
2. Click on the Destination Tab
3. Select the destination entry named `Infoblox Threat Defense integration with Cisco Identity Services Engine (ISE)_TDevents` and click Edit to modify its configuration.
4. Expand Variables section and provide appropriate values for the variables listed in this section

#### Destination Parameters

- **cspInstance**: URL of the Infoblox CSP instance (e.g.: [https://csp.infoblox.com](http://csp.infoblox.com)).
- **cspApiKey**: API key for authenticating requests to the CSP.
- **ciscoISEInstance**: IP or IP:Port for Cisco ISE instance (e.g.: [https://10.111.11.11](https://10.111.11.11)).
- **ciscoISEUsername**: Username for Cisco ISE API authentication.
- **ciscoISEPassword**: Password for Cisco ISE API authentication.
- **ciscoISEPolicyName: **Name of the Cisco ISE Adaptive Network Control (ANC) policy that will be applied to quarantine endpoints.
- **policyApplyCriteria**: Conditions for applying quarantine based on severity (threat score), confidence level and the matched Threat Defense Policy (e.g.: ‘(Severity >= medium and Confidence >= high) and (policy_name = Default Global Policy)’). (For events based on Threat Feeds)
- **threatLevelMax**: events with threat level less than or equal to this value will be considered for applying quarantine (e.g.: 2) (For events based on SOC Insights)
- **ipRangeToExclude (Optional)**: Specifies IP ranges that should not be quarantined (e.g.: ‘12.12.12.0/24, 12.12.13.0-12.12.13.10, 12.12.12.12’).

**Note: **Ensure all the required parameters are configured in Destination parameters

5. Click on Save and Close

![image](media://42b9cd7d-38fb-49e5-b983-7df32241280d)

### Traffic Flow

1. Navigate to Configure > Administration > Data Connector
2. Click on the Traffic Flow Tab
3. Select the Infoblox Threat Defense integration with Cisco Identity Services Engine (ISE)_TDevents Traffic Flow entry and click Edit to modify its configuration.
4. In the Log Source Configuration Section, select the source as Infoblox Cloud Source
5. Expand the Source Configuration section
6. Click on Add Log Type drop-down and select ‘DDI DHCP Lease log’, ‘SOC Insights’ and ‘Threat Defense Threat Feed Hits log’ options
7. Click on Next
8. In the Destination Configuration section, select Destination as Infoblox Threat Defense integration with Cisco Identity Services Engine (ISE)_TDevents Destination option and click on Next
9. In the Service Instance section select the Service Instance that is running the Data Connector Service and installed for this use case and click on Next
10. Click on Save and Close

![image](media://85f57650-b905-41bf-874b-cde250a701df)