---
title: "Playbook Inputs – Infoblox Threat Defense with DDI"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDwDDICortexXSOAR/1814528014/Playbook%20Inputs%20%E2%80%93%20Infoblox%20Threat%20Defense%20with%20DDI"
format: markdown
---
The following section lists all input parameters required for each playbook included in the **Infoblox Threat Defense with DDI** integration on Cortex.  
These inputs define how each playbook operates—whether for enrichment, blocking, or incident response.  
Most enrichment playbooks automatically consume indicators from incidents, while manual ones (like *Block* or *Unblock*) accept user-defined inputs.

# Incident Response – Infoblox Cloud

This playbook runs automatically for **SOC Insight incidents**.  
It activates the incident, retrieves indicators, assets, and comments from Infoblox, and creates a ServiceNow ticket if the severity is *Medium* or higher.

> ℹ️ Refer [https://infoblox-docs.atlassian.net/wiki/x/gYD6Zw](https://infoblox-docs.atlassian.net/wiki/x/gYD6Zw)  for ServiceNow Integration steps in Cortex

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| soc_insight_id | Collect incident severity from incident. | `incident.infobloxcloudinsightid` | Optional |
| incident_severity | Collect incident severity from incident. | `incident.severity` | Optional |
| limit | Number of indicators, events, assets, and comments to fetch for the provided SOC Insight. | `50` | Optional |
| onCall | Set to true to assign only the user that is currently on shift. Default is False. | `false` | Optional |

#  Indicator Enrichment – Infoblox Cloud

This playbook enriches IPs, MACs, domains, and URLs with Infoblox **Dossier**, **DHCP lease**, **TIDE**, and **asset data**.  
It runs automatically when indicators are present in an incident.

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| ip_addresses | Optional comma-separated list of IP addresses to enrich. |  | Optional |
| domains | Optional comma-separated list of domains or hosts to enrich. |  | Optional |
| urls | Optional comma-separated list of URLs to enrich. |  | Optional |
| mac_addresses | Optional comma-separated list of MAC addresses to enrich. |  | Optional |

# Domain Enrichment – Infoblox Cloud

Enriches domain and host indicators using Infoblox **Dossier**, **TIDE**, and **asset data**.  
Automatically runs when domain indicators are detected within an incident.

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| domains | Optional comma-separated list of domains or hosts to enrich. |  | Optional |

# IP Enrichment – Infoblox Cloud

Retrieves detailed information about IPs using Infoblox **Dossier**, **TIDE**, and **asset data**.  
Runs automatically when IP indicators are identified.

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| ip_addresses | Optional comma-separated list of IP addresses to enrich. |  | Optional |

# MAC Enrichment – Infoblox Cloud

Provides **DHCP lease** and device information for MAC addresses.  
This playbook can be triggered manually or through another parent workflow.

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| mac_addresses | Comma-separated list of MAC addresses to enrich. |  | Optional |

# URL Enrichment – Infoblox Cloud

Adds intelligence to URLs, including **threat category**, **risk score**, and associated DNS/IP data.  
Automatically triggered when URLs are found in incidents.

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| urls | Optional comma-separated list of URLs to enrich. |  | Optional |

# Block Indicator – Infoblox Cloud

Blocks specified IPs or domains by adding them to a configured **custom block list** in Infoblox Cloud.  
Optionally removes indicators from allow lists if prompted.

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| ip_addresses | IP addresses to block. |  | Optional |
| domains | Domains to block. |  | Optional |
| custom_list_name | Name of the custom list to add the given IPs or domains to. Default is “Default Block.” | `Default Block` | Optional |
| custom_list_type | Type of custom list (default_block, custom_list, threat_insight, dga, dnsm, zero_day_dns, threat_insight_nde). | `default_block` | Optional |

# Unblock Indicator – Infoblox Cloud

Removes IPs or domains from block lists by adding them to the **allow list** in Infoblox Cloud.  
Typically used to restore access or handle false positives.

**Playbook Inputs**

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| ip_addresses | IP addresses to unblock. |  | Optional |
| domains | Domains to unblock. |  | Optional |
| custom_list_name | Name of the custom list to add the given IPs or domains to. Default is “Default Allow.” | `Default Allow` | Optional |
| custom_list_type | Type of custom list (default_allow, custom_list, threat_insight, threat_insight_nde). |  |  |