I am working with Infoblox Secure DNS, which is called Threat Defense, or BloxOne Threat Defense, even though they change the name frequently. I am not only working with BloxOne Threat Defense but also with the DDI part. Typically, Threat Defense is just an extension. Even if it could be provided as its own solution, it is typically part of a DDI migration project, and then the security is just an add-on. The anomaly, I would say, is malware or an attack. They can find out if there is an ongoing attack. For example, if you have malware that has not been detected, this malware typically will call home. When it calls home, it makes a DNS request because it needs to resolve a name to an IP. Infoblox BloxOne DDI could anticipate other security tools because this means that the malware has not been detected but is going to make requests to call home. Since the threat intelligence is dynamic, they collect this data worldwide. Their approach is to have a policy where you can decide if certain categories or requests have to be blocked, passed, or just monitored. In this case, the anomaly means that, for example, there could be an increase in requests for some category or domain, and you can highlight this using the tool. DNS is also sometimes used to feed malware with data because it is open on the firewall as it is the basic part. This tool could provide functionality to find out if some data, some malware data, is piggybacked on the DNS protocol.
