Service Point v4 platform change log - BlueCat Edge - Service Point v4.x.x

Edge Resolver introduces a new discovery service that can be configured to discover DNS forward and reverse lookup zones across multiple Address Manager configurations and DNS views. The zones discovered by the service are then stored in the Cloud Instance where they are then distributed to the DNS Resolver Service (starting in version 3.11.0). This is done through Site configurations containing Discovered Namespaces. The Discovered Namespaces can be further configured to provide granular control over different discovered environments. In the Discovered Namespace, you can also configure fallback forwarders for the DNS Resolver Service to use to recursively resolve queries for all other zones not found by the discovery service.

The discovery service uses user-supplied configurations to discover one or more DNS spaces across Address Manager. Each DNS zone that is discovered also contains information about the DNS servers that are authoritative for that zone or forwarder of that zone. With this understanding of per-zone forwarders, BlueCat Edge can now perform resolution across these DNS zones without the need to specify forwarders for the namespace.

Once you have discovered the DNS information, deploy DRS to the service point that provides recursive resolution. DRS evaluates any domains found in the Address Manager list and its internal knowledge of cloud zones to resolve any query needs to follow CNAME chains.

This fix prioritizes DNS resolution and maintains the Anycast service in the event that DNS query logging service becomes unavailable. The Service Point performs a service readiness check of the DNS resolver service every second. If three consecutive checks fail, the Anycast service is temporarily turned off until the DRS service is able to resolve queries.

The BlueCat Edge Identity service allows you to collect User Principal Name (UPN) information by parsing directory event logs stored in an Azure Event Hub. Once the Identity service has been granted credentials and given details for the appropriate Azure Event Hub where the logs are stored, it collects a map of UPN to IP address information. This information is then embedded in EDNS in DNS queries forwarded to Cisco Umbrella for processing. This enables Cisco Umbrella to enforce user or group policies on queries and is intended to be a replacement for Cisco Virtual Appliances (VA).

The advanced threat service introduces enhancements to the existing threat service by augmenting and improving the accuracy of threat detection providing the ability to tune the output of the system. Once the advanced threat service has been configured, the service point evaluates DNS queries and flags any suspicious queries. You can view queries that have been flagged using the advanced threat service by filtering queries in the DNS activity page with the Advanced DGA Threat Indicator.