---
title: "Use Cases"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDIntegrationCiscoISE/1544716748/Use%20Cases"
format: markdown
---
1. Event Triggered by DNS Query to a Threat Feed Domain

When an endpoint initiates a DNS query to a domain listed in one of the Infoblox Threat Feeds and the indicator’s threat score and confidence level meets predefined criteria, the endpoint responsible for the query is automatically flagged and added to the quarantine list in Cisco ISE via API integration. This action enforces a restrictive network access policy, effectively isolating the potentially compromised device from the rest of the network.

2. Policy Criteria Evaluation Hierarchy

Policy Conditions are defined by the user to determine which events will trigger the quarantine of endpoints.

When evaluating policy conditions, the solution follows a defined precedence based on the scope of application: 

- Subnet-Level Conditions – Policies applied directly to specific subnets as tags take the highest priority.
- IP Space Object Conditions – If no subnet-specific condition is set, condition defined as tag at the IP Space object level is considered next.
- Data Connector Destination Conditions – Finally, if neither subnet nor IP Space object conditions are set, the value of the policyApplyCriteria variable in the Data Connector Destination object is considered.

This hierarchical approach ensures that the most granular and context-specific policies are enforced first, allowing for precise control over network access and threat response.

3. Excluding IP Addresses from Quarantine

To prevent specific endpoints from being quarantined, users can define an exclusion list by assigning IP addresses to the ipexclusion variable in the Data Connector Destination object. During the quarantine evaluation process, any endpoint with an IP address present in this list is exempt from quarantine actions—even if it generates DNS queries that meet the threat criteria or generates SOC Insights. This allows administrators to safeguard critical systems or trusted devices from being inadvertently isolated due to automated threat responses.

4. Quarantining Endpoints Generating SOC Insights

Endpoints that trigger the generation of SOC Insights within Infoblox Threat Defense<sup>TM</sup>—based on suspicious or malicious DNS activity—are automatically quarantined once the insight is created. The quarantine action is initiated immediately upon insight generation, leveraging Cisco ISE’s API to enforce access restrictions on the affected endpoint.

5. Scheduled Removal of Endpoints from Quarantine

The solution supports time-based quarantine management by allowing users to define a quarantine duration for each endpoint. This duration is specified as a value assigned to a variable within the Data Connector Destination object.

Once an endpoint is quarantined, a timer is initiated based on this value. When the specified time period elapses, the solution automatically removes the endpoint from the quarantine list by invoking Cisco ISE’s API. This feature ensures automated recovery and reduces the need for manual intervention in routine threat response workflows.