Skip to main content
Skip table of contents

Infoblox NIOS

LAST UPDATED: OCTOBER 20, 2025

Overview

Infoblox NIOS is a cybersecurity platform that provides Threat Intelligence (TI) and threat detection and response services. It is designed to proactively identify and analyze malicious infrastructure, phishing campaigns, malware distribution, and suspicious domains.

D3 SOAR is providing REST operations to function with Infoblox NIOS.

Infoblox NIOS is available for use in:

D3 SOAR

V17.5+

Category

Network Security

Deployment Options

Option I, Option III

Connection

To connect to Infoblox NIOS from D3 SOAR, follow this part to collect the required information below:

Parameter

Description

Example

Server URL

The API server URL in the https://<infoblox-ip-address> format.

https://***.***.***.***

Username

The username used for authentication.

jdoe

Password

The password used for authentication.

*****

API Version

The version of the API used for the connection.

v2.13.6

Permission Requirements

Each endpoint in the Infoblox NIOS API requires a certain permission scope. The following are required global permissions for the commands in this integration:

Command

Required Permissions

Add Mac Addresses to Filter

DHCP permissions > All IPv4 DHCP MAC Filters > Read/Write

Get IPv4 Address Details

IPAM permissions > All IPv4 Networks > Read-Only

Get IPv6 Address Details

  • IPAM permissions > All Hosts > Read-Only

  • IPAM permissions > All IPv6 Networks > Read-Only

Get Mac Addresses by IPs

IPAM permissions > All IPv4 Networks > Read-Only

Get Supported API Versions

N/A

List IPv4 Networks

IPAM permissions > All IPv4 Networks > Read-Only

List IPv6 Networks

IPAM permissions > All IPv6 Networks > Read-Only

List MAC Address Filter

DHCP permissions > All IPv4 DHCP MAC Filters > Read-only

Restart Services

  • DHCP permissions > Grid DHCP Properties > Read-only

  • DNS permissions > Grid DNS Properties > Read-only

Test Connection

N/A

READER NOTE

  • For information on object-level permissions, refer to Defining Object Permissions.

  • In this integration, lacking permissions to run a command does not always return a failure message. The command can appear to execute successfully while only producing an empty array in the raw data. If this occurs, verify that the authenticated user has the required permissions.

    Frame 10.png

Configuring Infoblox NIOS to Work with D3 SOAR

To enable role-based access control in Infoblox NIOS, a Superuser must create an admin group, assign the required permissions to that group, and then add admins as members of the group.

  1. Log into the Infoblox NIOS GUI.

  2. Navigate to Administration > Administrators > Groups, then click the + button.

  3. Enter a name for the group, then click the Next button until reaching the roles and API access page.

  4. Ensure that API access is enabled, then click the Save & Close button.

  5. Select the group, then click the (Permissions) button.

  6. Click the + button and add the necessary permissions, then click the Save & Close button.

  7. Add a new admin and assign them to the previously configured group.

    1. Select the Admins tab.

    2. Click the + button.

    3. Configure the admin's login method and credentials. Refer to sub-steps 2 and 3 under step 3i in Configuring D3 SOAR to Work with Infoblox NIOS.

    4. Click the Select button.

    5. Select the previously configured admin group.

    6. Click the OK button.

  8. Click the Save & Close button.

Configuring D3 SOAR to Work with Infoblox NIOS

  1. Log in to D3 SOAR.

  2. Find the Infoblox NIOS integration.

    1. Navigate to Configuration on the top header menu.

    2. Click on the Integration icon on the left sidebar.

    3. Type Infoblox NIOS in the search box to find the integration, then click it to select it.

    4. Click on the + Connection button on the right side of the Connections section. A new connection window will appear.

  3. Configure the following fields to create a connection to Infoblox NIOS.

    1. Connection Name: The desired name for the connection.

    2. Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

    3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.

    4. Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

    5. Description (Optional): The description for the connection.

    6. Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.

    7. Active: The checkbox that enables the connection to be used when selected.

    8. Configure User Permissions: Defines which users have access to the connection.

    9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.

      1. Input the Server URL.

      2. Input the Username from the Infoblox NIOS GUI. Refer to step 7c of Configuring Infoblox NIOS to Work with D3 SOAR.

      3. Input the Password from the Infoblox NIOS GUI. Refer to step 7c of Configuring Infoblox NIOS to Work with D3 SOAR.

      4. Input the API Version. The default value is v2.12.

    10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.

    11. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.

  4. Test the connection.

    1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

    2. Click OK to close the alert window.

    3. Click + Add to create and add the configured connection.

Commands

Infoblox NIOS includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Infoblox NIOS API, refer to the following resources:

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Infoblox NIOS to Work with D3 SOAR sections for details.

Add Mac Addresses to Filter

Adds the specified MAC addresses to the designated MAC address filter.

READER NOTE

MAC Address Filter Name is a required parameter to run this command.

  • Run the List MAC Address Filter command to obtain the MAC Address Filter Name. MAC Address Filter Names can be found in the raw data at $.result[*].name.

Input

Input Parameter

Required/Optional

Description

Example

MAC Addresses

Required

The MAC addresses to add to the specified MAC address filter.

JSON 
[
  "**:**:**:**:**:**"
]

MAC Address Filter Name

Required

The name of the MAC address filter to which the MAC addresses are added. MAC Address Filter Name can be obtained using the List MAC Address Filter command.

Allowed_Laptops

Comment

Optional

The comment for the MAC filter address. The comment can contain up to 256 characters.

Suspicious Mac Address

Username

Optional

The username used for DHCP authentication.

USER-1

Additional Fields

Optional

The additional fields that are added to the MAC address filter. The base MAC Filter Address object includes the following fields:

  • authentication_time

  • expiration_time

  • extattrs

  • guest_custom_field1

  • guest_custom_field2

  • guest_custom_field3

  • guest_custom_field4

  • guest_email

  • guest_first_name

  • guest_last_name

  • guest_middle_name

  • guest_phone

  • never_expires

  • reserved_for_infoblox

JSON 
{
  "guest_first_name": "Adam",
  "guest_last_name": "Cook"
}

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Add Mac Addresses to Filter failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: AdmConProtoError: Allowed_Laptops1 does not match any MAC filter.

Error Sample Data

Add Mac Addresses to Filter failed.

Status Code: 400.

Message: AdmConProtoError: Allowed_Laptops1 does not match any MAC filter.

Get IPv4 Address Details

Retrieves detailed information for a specified IPv4 address or for all IPv4 addresses within a specified network.

READER NOTE

Network is an optional parameter to run this command.

  • Run the List IPv4 Network command to obtain the Network. Networks can be found in the raw data at $.result[*].network.

Input

Input Parameter

Required/Optional

Description

Example

IP Address

Optional

The IPv4 address for which details are retrieved. To retrieve details for an IP address within a specified network, run the command with the Network parameter set, and then use the value returned at $.result[*].ip_address for this parameter.

Either IP Address or Network must be provided. If both parameters are provided, only IP Address is used.

***.***.***.***

Network

Optional

The network from which details are retrieved for all associated IPv4 addresses. Network can be obtained using the List IPv4 Network command.

Either IP Address or Network must be provided. If both parameters are provided, only IP Address is used.

***.***.***.***/***

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get IPv4 Address Details failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: AdmConProtoError: ***.***.***.***/*** does not match any network.

Error Sample Data

Get IPv4 Address Details failed.

Status Code: 400.

Message: AdmConProtoError: ***.***.***.***/*** does not match any network.

Get IPv6 Address Details

Retrieves detailed information for a specified IPv6 address or for all IPv6 addresses within a specified network.

READER NOTE

Network is an optional parameter to run this command.

  • Run the List IPv6 Network command to obtain the Network. Networks can be found in the raw data at $.result[*].network.

Input

Input Parameter

Required/Optional

Description

Example

IP Address

Optional

The IPv6 address for which details are retrieved. To retrieve details for an IP address within a specified network, run the command with the Network parameter set, and then use the value returned at $.result[*].ip_address for this parameter.

Either IP Address or Network must be provided. If both parameters are provided, only IP Address is used.

***:***:***::***

Network

Optional

The network from which details are retrieved for all associated IPv6 addresses. Network can be obtained using the List IPv6 Network command.

Either IP Address or Network must be provided. If both parameters are provided, only IP Address is used.

***:***:***::/***

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get IPv6 Address Details failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 500.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: AdmConError: None (illegal IP address string passed to inet_pton).

Error Sample Data

Get IPv6 Address Details failed.

Status Code: 500.

Message: AdmConError: None (illegal IP address string passed to inet_pton).

Get Mac Addresses by IPs

Returns the MAC addresses for the specified IP addresses. The command also returns the discovered MAC address of the host, which uniquely identifies the network device. The discovery process obtains MAC addresses for hosts on the same network as the Grid member performing the discovery.

READER NOTE

IPv4 Addresses is a required parameter to run this command.

  • Run the List IPv4 Networks command to obtain the IPv4 Addresses. IPv4 Addresses can be found in the raw data at $.result[*].ipv4addr.

Input

Input Parameter

Required/Optional

Description

Example

IPv4 Addresses

Required

The IPv4 addresses for which the MAC addresses are retrieved. IPv4 Addresses can be obtained using the List IPv4 Networks command.

JSON 
[
  "***.***.***.***"
]

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Mac Addresses by IPs failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: AdmConDataError: None (IBDataError: IB.Data:A network was not found for this address.).

Error Sample Data

Get Mac Addresses by IPs failed.

Status Code: 400.

Message: AdmConDataError: None (IBDataError: IB.Data:A network was not found for this address.).

Get Supported API Versions

Retrieves the list of all API versions supported by the system.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Get Supported API Versions failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Unauthorized.

Error Sample Data

Get Supported API Versions failed.

Status Code: 401.

Message: Unauthorized.

List IPv4 Networks

Retrieves the available IPv4 networks and their details.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List IPv4 Networks failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Unauthorized.

Error Sample Data

List IPv4 Networks failed.

Status Code: 401.

Message: Unauthorized.

List IPv6 Networks

Retrieves the available IPv6 networks and their details.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List IPv6 Networks failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Unauthorized.

Error Sample Data

List IPv6 Networks failed.

Status Code: 401.

Message: Unauthorized.

List MAC Address Filter

Retrieves all configured MAC address filters, including their types, MAC addresses, and other details.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List MAC Address Filter failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Unauthorized.

Error Sample Data

List MAC Address Filter failed.

Status Code: 401.

Message: Unauthorized.

Restart Services

Restarts the specified services on the Infoblox Grid server.

Input

Input Parameter

Required/Optional

Description

Example

Service Option

Optional

The service to restart. Available options are:

  • DHCP

  • DNS

  • All

By default, the value is set to All, meaning that both DHCP and DNS are restarted.

DHCP

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Restart Services failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Unauthorized.

Error Sample Data

Restart Services failed.

Status Code: 401.

Message: Unauthorized.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Test Connection failed. Failed to check the connector.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Infoblox NIOS portal. Refer to the HTTP Status Code Registry for details.

Status Code: 401.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Unauthorized.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 401.

Message: Unauthorized.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close