Release notes for the Splunk Add-on for Infoblox

Version 2.2.0 of the Splunk Add-on for Infoblox was released on October 6, 2022.

Compatibility

Version 2.2.0 of the Splunk Add-on for Infoblox is compatible with the following software, CIM versions, and platforms.

Splunk platform versions	8.1.x, 8.2.x, 9.0.x
CIM	5.0.1
Platforms	Platform independent
Vendor Products	NIOS 8.4.x, 8.5.2, 8.6.2

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 2.2.0 of the Splunk Add-on for Infoblox contains the following new features:

• Support for Infoblox NIOS v8.6.2
• CIM compatibility with version 5.0.1
• New Infoblox object types for Audit events that are now mapped to Change:Network_Changes DM, such as:
  • ResponsePolicyAaaaRecord
  • ResponsePolicyARecord
  • DelegatedZone
  • AtpRule
  • ResponsePolicyIPAddress
  • SharedARecord
  • SharedRecordGroup
  • SRGZone
  • CnameRecord
  • AaaaRecord
  • DhcpRange
  • PtrRecord
  • NetworkTemplate
  • FixedAddressTemplate
  • DhcpRangeTemplate
  • FixedAddress
  • ReservedRange
  • IPv6OptionFilter
• Added these object types for DNS events that are mapped to Network Resolution (DNS) DM:
  • infoblox_dns_query_denied
  • infoblox_dns_query_failed
  • infoblox_dns_query_error

Field changes

The following sections contain information on fields and data models that have been added, modified, or removed in this release.

Fields added and removed

Sourcetype	object_type	action	Fields added	Fields removed
infoblox:audit	AtpProfile, ARecord, DnsView, ResponsePolicyZone, Network, AuthZone, ResponsePolicyCnameRecord, NsGroup, AdminGroup	created	infoblox_action
infoblox:audit	ARecord, DnsView, ResponsePolicyZone, Network, AuthZone, ResponsePolicyCnameRecord, NsGroup	deleted	infoblox_action
infoblox:audit	ARecord, DnsView, ResponsePolicyZone, Network, MemberAtp, AuthZone, ResponsePolicyCnameRecord, AdminGroupstarted	modified	infoblox_action
infoblox:audit	AaaaRecord	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	AccessRight	created	infoblox_action, user_name
infoblox:audit	AccessRight	deleted	infoblox_action, user_name
infoblox:audit	AccessRight	modified	infoblox_action, user_name
infoblox:audit	AdminMember	created	src_user_type, infoblox_action, src_user_name
infoblox:audit	AdminMember	deleted	src_user_type, infoblox_action, src_user_name
infoblox:audit	AtpRule	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	CnameRecord	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	DashboardConfiguration	created	infoblox_action, user_name
infoblox:audit	DelegatedZone	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	DelegatedZone	deleted	infoblox_action, user_name, status, command, change_type
infoblox:audit	DhcpRange	created	infoblox_action, user_name
infoblox:audit	DhcpRange	modified	infoblox_action, user_name
infoblox:audit	DhcpRangeTemplate	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	ReservedRange, FixedAddress, ResponsePolicyIPAddress	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	IPv6OptionFilter, FixedAddressTemplate	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	Grid	modified	infoblox_action, user_name
infoblox:audit	GridAtp	modified	infoblox_action, user_name
infoblox:audit	GridDhcp	modified	infoblox_action, user_name
infoblox:audit	GridDns	modified	infoblox_action, user_name
infoblox:audit	Member	modified	infoblox_action, user_name
infoblox:audit	MemberDns	modified	infoblox_action, user_name
infoblox:audit	MyPersonalSmartFolder	created	infoblox_action, user_name
infoblox:audit	NetworkTemplate	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	NetworkView	modified	infoblox_action, user_name
infoblox:audit	system	restarted	infoblox_action
infoblox:audit	PtrRecord	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	PtrRecord	modified	infoblox_action, user_name, status, command, change_type
infoblox:audit	ReservedRange	modified	infoblox_action, user_name, status, command, change_type
infoblox:audit	ResponsePolicyARecord	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	SharedRecordGroup, SRGZone	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	SharedARecord	created	infoblox_action, user_name, status, command, change_type
infoblox:audit	WebuiGroupByConfig	created	infoblox_action, user_name
infoblox:audit	account	unlocked	src_user_type, infoblox_action
infoblox:audit	admingroup	logoff	infoblox_action, user_name, src_user
infoblox:audit	MemberDhcp	modified	infoblox_action, user_name
infoblox:audit	MemberDhcp	started	infoblox_action, user_name
infoblox:audit	testgroup	logoff	infoblox_action, user_name, src_user

Fields modified

Sourcetype	object_type	action	CIM Field	Sample value before	Sample value after
infoblox:audit	DhcpRangeTemplate	created	object_category	DhcpRangeTemplate	dhcp
infoblox:audit	ResponsePolicyARecord	created	object_category	ResponsePolicyARecord	dns

Sourcetype	CIM Field	Sample value before	Sample value after
infoblox:dns	message_type	query, response	Query, Response

CIM changes

Sourcetype	object_type	action	Previous CIM model	New CIM model
infoblox:audit	ResponsePolicyAaaaRecord	Created		Change:Network_Changes
infoblox:audit	ResponsePolicyARecord	Created		Change:Network_Changes
infoblox:audit	DelegatedZone	Created		Change:Network_Changes
infoblox:audit	DelegatedZone	Deleted		Change:Network_Changes
infoblox:audit	AtpRule	Created		Change:Network_Changes
infoblox:audit	DhcpRange	Modified		Change:Network_Changes
infoblox:audit	ResponsePolicyIPAddress	Created		Change:Network_Changes
infoblox:audit	SharedARecord	Created		Change:Network_Changes
infoblox:audit	SharedRecordGroup	Created		Change:Network_Changes
infoblox:audit	SRGZone	Created		Change:Network_Changes
infoblox:audit	CnameRecord	Created		Change:Network_Changes
infoblox:audit	AaaaRecord	Created		Change:Network_Changes
infoblox:audit	PtrRecord	Created		Change:Network_Changes
infoblox:audit	PtrRecord	Modified		Change:Network_Changes
infoblox:audit	NetworkTemplate	Created		Change:Network_Changes
infoblox:audit	FixedAddressTemplate	Created		Change:Network_Changes
infoblox:audit	DhcpRangeTemplate	Created		Change:Network_Changes
infoblox:audit	FixedAddress	Created		Change:Network_Changes
infoblox:audit	ReservedRange	Created		Change:Network_Changes
infoblox:audit	IPv6OptionFilter	Created		Change:Network_Changes

Fixed issues

Version 2.2.0 of the Splunk Add-on for Infoblox fixes the following issues:

Known issues

Version 2.2.0 of the Splunk Add-on for Infoblox fixes the following issues. If no issues appear below, no issues have yet been reported:

Third-party software attributions

Version 2.2.0 of the Splunk Add-on for Infoblox does not incorporate any third-party software or libraries.