There is no out-of-box solution as Infoblox works. However there are other
built-in ways to protect.
FP - Uses SI to drop traffic against malicious URLs
FP can have a DNS policy to block malicious domains
These two are updated by Cisco global databases. Also, what you can do is
to create a snort rule to look at the number of characters in domain name
and block if it crosses specific threshold which same way how infoblox
works. This is the power of snort.
For example, depending on the size of organization, you can create a rule
to drop any DNS packet with domain name more that 20-characters in the
domain name. Its uncommon to have more than 20 and you can change this
number.
An AES 128-bit key can be expressed as a hexadecimal string with 32
characters. It will require 24 characters in base64.
An AES 256-bit key can be expressed as a hexadecimal string with 64
characters. It will require 44 characters in base64.
Therefore 20 should be a good threshold. In the same snort rule you can
append a rate for example 20 times in 5 mins, etc
