Infoblox BloxOne Threat Defense Reviews

Our primary use case is for all security-type query activities. So, if somebody is trying to hack or infiltrate us, that is why we use Threat Defense in the cloud. We use it to monitor queries coming in and out of our company.

It is a great solution. Infoblox provides all the needed algorithms. When queries come in and out of this solution, which come in and out of our company, they are able to look at every query and determine whether it is a good or bad actor. So, it can determine if we are being DDoS attacked or somebody is trying to infiltrate us by utilizing all kinds of different tunneling methods. Then, it gives you an idea of all the different threats around the country. The platform is aware of all those threats, so I don't have to try to manage every one of those threats as they come in. The system will automatically determine what to do with those threats when they come.

Infoblox has helped us improve in the way that we look at data as it comes in and out. We monitor and manage queries from every device that sits inside our company, e.g., every user, every laptop, and every query. When you type something into the web, Infoblox will scan or manage that. If it is going somewhere bad, then it will block them. From a metrics perspective, it gives us data, letting us go back and find those impacted or infected clients to either clean their devices or remove them from the network.

BloxOne is for DNS protection. We point our local domain name servers to it and it has a feed for "bad character" domain names. We protect our end-users that way. The way we're using it, that's all it does. It fits in somewhere in the middle of our security stack. DNS is the most important part of networking. Not so many people see it that way, but if you can't resolve, say, "cnn.com", nothing works. If your DNS doesn't work correctly, nothing is going to work correctly on your network. It is one of the first layers that comes into play when going to a website or using email.

It's a SaaS solution, a service that InfoBlox provides. All the systems are run by them and they maintain it.

It puts us at ease. We don't have to worry about so many DNS infiltrations. It has integrated and helped us make sure that our end-users don't visit websites that are not clean. Overall, it has helped with that side of our security.

BloxOne has also reduced the amount of effort for our SecOps team when investigating events. They have been using it and they're happy with it.

Overall, it's much easier to log, detect, and troubleshoot those aspects of the network.

We use this product as our intermediate between our internal DNS servers and the split-brain model and the internet so that queries don't appear to come directly from inside our network. They're filtered through BloxOne.

BloxOne has been excellent at helping to detect DNS threats, such as data exfiltration attempts. We're surprised at some of the things that it catches.

This product integrates with other security solutions, such as vulnerability scanners, and we're working to leverage those more fully. The integration gives us a single pane of glass, where it brings together all of the information into a single platform where we can view and evaluate it. This is important because it gives our InfoSec team a better handle of what's going on and where problems might be, and how to address them.

It seems to have reduced the effort required by our SecOps team because it gives them additional information that they didn't have access to before.

BloxOne has positively affected our monitoring and detection response processes because it gives us a clearer picture of what's happening in our environment and it simplifies forensics.

In general, we have benefitted from this product because it's allowed us to more rapidly identify and respond to potential issues that our other security tools haven't discovered, or discovered later. It has given us a better security posture than we would have, using only the other tools that we have.

We use it for DNS, DHCP, IPAM in general, and DNS Threat Defense.

I administrate the DDI feature set.

We use Azure and AWS as our cloud providers.

We are currently in the phase of planning and integration with Azure Sentinel. We are also using a BloxOne Threat Defense client on each of our computers to actively block malicious websites.

BloxOne provides automatic sharing of network context data, which affects our speed of threat response and provides real-time threat intelligence. Our security operation team needs this to do their work. It makes us feel safer.

We have more visibility, granularity, and contextual information about threats.

It looks at all our DNS queries and activity going out of the company. Anytime that someone is looking up CNN or something like that, this cloud solution looks at it and decides if it's a known spam, malware, virus, or phishing site. If it is any of those things, it will just simply not allow the DNS query. So, it is a great addition to our firewall and network security. It is just another layer. 

Why let the PC go to the bad website or access the bad IP address when it can just block it right there in the DNS? That is basically what it is doing. What makes it fancy is its updates and live algorithm. It can continually stop all our DNS queries that we don't want.

We do everything in the cloud. We send all our information to their cloud solution, then it does all our filtering and protection.

We had an employee get a phone call on her cell phone that said, "Your computer has been hacked. You need to go to this website, log in, put in your credentials and your credit card information." Unfortunately, the employee did that, thus breaching our environment by going to this website and putting in her credentials. We immediately powered off her machine, but before we could get a stop to it, it had reached out and emailed several hundred users. 

We sent out a mass communication, saying, "Do not click on this email. Don't do it."  Unfortunately, due to the timeline, people will click on it and make another decision. Approximately 37 people clicked on it and put in their credentials. Finally, the security team was able to diagnose and block it in the firewall. It didn't matter then who clicked on it, the firewall had finally shut the site down. 

If we had been able to do this on the DNS side, it would have been a lot more instantaneous, because it flags, "All these people are going to the site that they don't normally go to," which is a lot more of an AI type of deal. It would have figured it out. Plus we could have blocked it a lot faster. So, if we had it in there, we would have been able to plug the hole a little faster, if it even allowed it. If that site was a known site, it would have just blocked the DNS immediately. 

The solution is not the be all end all. It would never replace a firewall. It would never replace your network security. It is just another layer that is very good and current. DNS filtering is how it has helped us. When we log into our console, we can see how many thousands of addresses, entries, and requests have been blocked as well as that there is a lower level of spam, phishing, etc.

We use the solution for DNS security.

The solution provides insights into what’s happening on the network. It enriches the information internally.

We were already an Infoblox customer for IP address management, DNS, and DHCP and we decided to beef up our security in another avenue as far as the company and its network. So this is one area we got into with Infoblox because of their DNS security. I previously worked for another company in Boston that was an Infoblox customer, and on DNS security originally you had to set up a connection with Infoblox. The threat feeds that analyze the traffic, the customer had to receive those feeds. This is some years back when they first got into this.

So now, with Pegasystems we're doing the same thing, however, Infoblox is doing this in the cloud, which is infinitely better for a customer like us, meaning that they take in all the threat information and analyze our traffic. All we have to do is set up normal connections to the internet. It's like talking to another website. There's firewall security involved, but that's the most important thing for analyzing Infoblox, the fact that they provide this service out on the internet, in the cloud, is huge for us because they have the ability to synthesize a number of different sources for DNS security, put it in their secret sauce in their portal, and all we have to do is communicate with it and then they inspect our traffic. That is the most important thing for us as a customer. 

I realize that other companies do that as well, but because Infoblox is an important part of our network infrastructure it makes a lot of sense to do our DNS security with Infoblox. We're also a Palo Alto Firewall customer, and we have traffic that goes out to the internet. All of our traffic going out to the internet gets inspected by Palo Alto firewalls. They have a similar service, but we chose to partner with Infoblox because they're already in the DNS arena and have been for a number of years.

Our ability to detect data exfiltration was minimal before Infoblox and the cloud portal was instituted for us. In terms of DNS security as a whole, we had some capability with our firewalls, but this is a lot more specialized because we're sending all of our DNS requests to Infoblox. I'd say we improved 100%.

The actual communications that go on between our DNS appliances and the threat engines in the cloud, that traffic get logged by Infoblox, so that information is available in the cloud, and we also export logs to, we have a Splunk system. So in terms of data exfiltration, Infoblox does a good job of identifying any threats in that arena. Now, if something like that comes up and gets logged, it gets flagged by our Splunk system. I work in the network operations team, we have a security knock. If some kind of alert in that realm was logged, they would be alerted, meaning our security folks. Then if we need to take action on someone's machine or a server then it gets triggered from our security, security operations. I would rate the identification of data exfiltration with a high mark.

Our primary interoperability is with Splunk. The log feed into Splunk got set up right after we signed up for the portal. They go hand in hand. It's because our security team uses Splunk to analyze data. This means they get information from the portal, and they also get information from our individual appliances in the various offices as well.

BloxOne Threat Defense reduced the amount of effort involved in our SecOps teams when investigating events.

Our security staff has been added to significantly in the last few years. I started with Pega in 2017 when there were only a handful of security people, but we were a 5,000 employee company. I think we're probably around 6,000 now.  It wasn't just tools, they didn't have enough people to manage the security posture the way they are now. They basically created a whole new department. This platform is just one of many things that they receive data from.

Our monitoring and detection capability was minimal before we got into BloxOne. Now it's an improvement.