If You Can See It, You Can Manage It

When it comes to the network, visibility is everything.  Without a comprehensive, real-time network view at any time from any place, how do you know who is accessing your data, from which devices and to what effect?  How do you stop bad actors from stealing your data or infecting your systems?  If you’re relying on manual processes and disparate solutions to run and analyze your network, how can you make fast, accurate decisions to ensure application security, availability, and performance?  And why use your precious time and dev resources to spin-up a project, research and build reports, when powerful, engineered, pre-built reports and predictive analytics are available at your fingertips?

The good news is that there are some great tools available to support network visibility and access.  One of those tools is the Infoblox Reporting & Analytics with Query Logging solution integrated within the Infoblox DNS, DHCP and IPAM (DDI) Grid.  It can deliver the visibility you need, and real-time knowledge and network intelligence to make you an effective manager.

The Top 5 Reports

Over the years, Infoblox gained a lot of reporting and analytics insights from customers, architects, administrators, engineers, SMEs, sales, and others.  This resulted in a significant library of pre-built, customizable reports documented in the Sample Report Guide.  These reports can be accessed through the dashboards tab, exported as a .pdf, scheduled to run and be distributed in advance to minimize effort.  We’d like to show you the top 5 reports, and how they can deliver powerful, real-time network intel, save you time and money and improve the way you manage.  Let the countdown begin.

Top Report #5: DHCP Lease History

Top report #5 is a favorite among Network and Security Admins because it shows the DHCP history for a given timeframe.  From a Network Admin perspective, it reveals where clients roam around on the network.  From a Security perspective, it’s very powerful to see which IP addresses a malware-infected client has had over time and then perform a log correlation to discover malicious activities done on the network.  In fact, this report is really a must-have for Audit and Compliance teams engaged with historical IP malware investigations simply due to the time-savings.  Rather than digging through hundreds of thousands of syslog data lines, an Admin can just enter an IP address, timeframe, corresponding MAC address, device or user information and get right to the data, saving hours-on-hours of manual, mind-numbing tedium.

Top Report #5: DHCP Lease History
Service Area	Audit/Compliance
Purpose	Shows DHCP history for a given timeframe
Primary User	Network/Security Admins
Importance	Quickly pinpoints who was where & correlates systems to IPs
Use Case	A device was compromised last month. Lease times are 24 hours. Which IPs has it had in the last month?

Top Report #4: DNS Domains Queried by Client

This report provides a granular query log search and is key to both Network and Security staff.  For Network teams, it enables the troubleshooting of an impaired network device.  For Security teams, it reveals all of the client/domain queries and all of the domains queried by a given client.  This is very helpful during a security investigation, where we can focus on a particular domain name associated with malicious activity and find every client that was querying it at a given time.  Or, we can see what else a client was querying, which makes it simple, fast and easy to find what you’re looking for. This report requires the Data Connector to improve performance and minimize bandwidth impact.

Top Report #4: DNS Domains Queried by Client
Service Area	Network/Security
Purpose	Displays a granular query log search
Primary User	Network & Security Admins
Importance	Identify which clients are querying for specific domains or all the activity of a given clients
Use Case	View historical queries for malware domains before threat intel detects a problem to better determine infestation date

Top Report #3: DNS Query Rate by Member

The DNS Query Rate by Member Report specifically addresses application performance by showing query volume over time on a member-by-member basis.  It is most frequently used by DDI and Applications teams because it identifies DNS utilization trends and anomalies within the infrastructure.  Because it is a trend report, spikes or dips typically indicate that something might be wrong or that something has changed.  This is a great report to see what is going on from a DNS perspective to highlight query rates, anomalies, top talkers and NX domains, giving you quick insights that might otherwise take hours to obtain from manual tools and a multi-system environment.

Top Report #3: DNS Query Rate by Member
Service Area	Applications Performance
Purpose	Shows query volume per member
Primary User	DDI/Applications Admins
Importance	Identifies DNS utilization trends and anomalies
Use Case	Correlates historical application performance issues to DNS query volumes

Top Report #2: DHCP Message Rate Trend

The #2 report shows DHCP activity by message type over time.  It displays the entire discover, offer, request and acknowledgment status, so it provides a broad view of how your DHCP infrastructure is changing across a specified timeframe.  This report is the DHCP equivalent of the DNS Query Rate Report #3 that we just looked at, so it contains similar metrics to help you easily spot anomalies.  It’s most often used by DDI and Applications teams but can also be used by Audit teams.  It enables you to keep a pulse on the DHCP environment and provide triage and troubleshooting when things go awry.  For example, if a printer starts making a bunch DHCP requests so that other network clients can’t get an IP address, this report would show the red requests line spiking to quickly alert you about a problem.  It can also be configured to send alerts, so if you know your normal traffic pattern, any activity outside the range can trigger a notification pinpointing the exception so you don’t scan this report every day.  This delivers the intel you need and saves you time, so you can focus on higher business value initiatives.

Top Report #2: DHCP Message Rate Trend
Service Area	DDI/Applications/Audit
Purpose	Identifies DHCP utilization trends and anomalies
Primary User	DDI/Applications Admins
Importance	Identifies DNS utilization trends and anomalies
Use Case	Correlates historical application performance issues to DHCP

Top Report #1: IPAMv4 Network Usage Statistics

The #1 report focuses on network utilization and is critical for Network Admins. It’s important because it helps prevent resource conflicts, running out of IP addresses and clients not getting on the network. By leveraging the dataset to understand and predict utilization proactively, the drama can be prevented. Plus, it simplifies manual operations, as you don’t have to look for metrics in various places, manage spreadsheets or work-built tools. Instead, you can see it all in one place with all of the powerful filtering options available, saving you grief and hassle, and giving you peace-of-mind.

Top Report #1:  IPAMv4 Network Usage Statistics
Service Area	Capacity Planning
Purpose	Displays network utilization
Primary User	Network Admins
Importance	Prevents resource conflicts
Use Case	Proactively identify networks that are approaching full utilization

These are just a sampling of the over 120 customizable reports available to increase your visibility across the network, give you instant access to current data, save you time and money, streamline and automate operations, and enable you to be a better manager of the network and resources in your care.

Learn more:

• Join the Infoblox Reporting & Analytics Technical Demo Series to continue the discussion in the free webinar on 5/22, 2018, 10A PDT, 1P EDT, 6P BST. Register
• As an existing Infoblox DDI customer, you can deploy a virtual Infoblox Reporting & Analytics appliance free of charge — no strings attached. Download and try the Reporting & Analytics Free Tier today.