Integrity

I’m attempting to do a POST to /api/v2/networks/{collection-id}/addresses to grab an IP address and put a DNS name on it. This is working find except when I attempt to add a wildcard DNS entry like the following:{    "name": "*.example.net",                             ← This puts a name on the IPv4 address object    "type": "IPv4Address",    "state": "STATIC",    "userDefinedFields": {        "mnemonic": "OCP"    },    "resourceRecords": [        {            "type": "HostRecord",            "absoluteName": "*.example.net",               ← This should put a host record into the example.net zone            "views": [                {                    "id": "93864"                }            ],            "userDefinedFields": {                "mnemonic": "OCP"            }        }    ]}  {    "status": 400,    "reason": "Bad Request",    "code": "InvalidFullyQualifiedDomainName",    "message": "The value for resource field 'resourceRecords[0].absoluteName' is not a valid fully quali

Since ISC has announced the deprecation of the tkey-gssapi-credential and tkey-domain configuration statements in BIND, both of which are used by Integrity’s current GSSTSIG implementation, can we PLEASE use the refactoring opportunity to get better support for multi-realm GSSTSIG and keytab management?  We currently have to use postDeploy.sh scripting to get the resulting configuration that we want (jettisoning the BAM-generated single-realm keytab and substituting our own, commenting out the BAM-generated tkey-gssapi-credential and tkey-domain statements, and substituting a tkey-gssapi-keytab statement). Ideally BAM should either A) natively support generating a keytab that contains the needed principals and referencing it via the tkey-gssapi-keytab configuration statement (which is ISC’s go-forward requirement) or B) allow the user to import their own keytab and reference that (as other competing products do).I’m sure I have a feature-request for multi-realm support floating around

Greetings,I’m looking for recommendations and best practices regarding DHCP-scoped DNS domain assignment across different segments of our environment.Specifically, I’d appreciate guidance on configuring the following DHCP options: Domain Name DDNS Domain Name Domain Search For those of you managing medium to large environments: are you using the same values across internal LAN, Wi-Fi, Guest, and IoT networks? Or do you define zone-specific values like wifi.contoso.com, internal.contoso.com, guest.contoso.com, iot.contoso.com, etc.?Currently, our global DHCP configuration looks like this: Domain Name: contoso.com DDNS Domain Name: mydomain.contoso.com Domain Search: undefined My assumption is that the Domain Name and DDNS Domain Name should ideally match—or at the very least, both should be included in the Domain Search (Option 119) if they differ.I’m also assuming that BYOD and guest networks should ideally have their own distinct DDNS zones, separate from the Active Directory

I set a list of ‘allow MAC Pool’ for a block, but for one specific network I want an open DHCP range.  I cannot figure out how to block the inherited ‘allow MAC Pool’s, or set an ‘allow any’.  I really don’t want to have to copy and maintain a list of ‘allow MAC Pool’s on every network individually. 

Since I just became aware that Bluecat is shipping the subscriber version of BIND, which supports EDNS Client Subnet (ECS) for resolver - is adding ECS options supported?  BAM doesn’t natively support any of them, but you could add them using raw options.  We have some use cases that would benefit from ECS but I don’t want to add something in if it’s not officially supported and/or might unexpectedly disappear in future versions.

HOTFIX-590 released to fix CVE-2025-40776, but that CVE only affects the subscriber-edition of BIND which provides ECS support - and as far as I was aware Integrity doesn’t ship with the subscriber version?  

I have selected an UNASSIGNED ip address, and I want to assign it. I think this means basically two steps: Creating an A record and creating a PTR record (it seems there might be a 3rd step to do first, create the IP address object). Since creating an A record is something we’ll want to do sometimes even when we’re not assigning a new IP, I figured I would start by trying to accomplish the task: Simply write a method to create an A record.def record_a_create(self, views, fqdn, ipaddresses, change_control_comment = None):views is a list of strings, e.g. `[‘internal’,’external’]`fqdn is a str, e.g. “foobar.example.com”I have a method that takes a fqdn and searches to find which zone(s) that fqdn should be in, so I can POST to zone(s).ipaddresses is a list of either str, e.g. [‘192.168.1.1’, ‘192.168.1.2’]I think I need to, for each view, look up its ID. (No problem). And then to create the A record via:POST /api/v2/views/{view_id}/resourceRecords{  "type": "HostRecord",  "name": "fqdn", 

We often have users delete A records, but neglect the “Delete linked IP address if orphaned” checkbox. This results in IP addresses that are unused, but in the web UI they still appear with a blue icon (state = “STATIC”) instead of gray icon (state = “UNASSIGNED”). I am trying to search a subnet for unused IP addresses, that are statically assigned but with no records pointing to them. I’m able to get the network easily enough.url = f"{self.url_base}/networks&filter=range:eq('{target_cidr}')"And then I’m able to get a list of all the IP addresses in the network easily enoughurl = f"{self.url_base}/networks/{network['id']}/addresses(I was also able to use a filter to get “UNASSIGNED” addresses in one go. Worked great, if only that was all I needed to get).I’m able to loop over all the IP addresses. This works perfectly fine, but performance is terrible, because I’m hitting the API for every IP address, 100ms per call * 300 calls = 30 sec to complete. By comparison when I browse the

Hi, if it makes any difference, I do have a support contract with Bluecat, so I can open official support requests if that’s a good approach for me. I haven’t done that yet. I figured I’d reach out to the community first.My first question is to ensure the direction I’m going is the most recommended direction. I have BlueCat Address Manager. I’m not sure which of these version strings is useful when asking a question here in the forum.  ;-) When I browse to the BAM and click on Help, there is no “About” to simply tell me the version of BAM we have. There is Help > API Documentation, it says version “9.5 RESTful v2 API.” I couldn’t figure out how to query system-info using API v2, but when I query the version from “/system-info” via API v1, I get version string “'9.5.1-049.GA.bcn'”.I want to automate creation/deletion of CNAME records to support cert automation. I can use any language or tool, including python, terraform, or anything else. My first question is what’s recommended? So f

I am using API v2 to retrieve all RR in a zone.I use the call “/api/v2/zones/<id>/resourceRecords”In parsing the output, in the case of TXT, SRV, Generic Records I get directly the rdata in the json() .But in case of a HostRecord I need to use the json()[‘data’]['_links']['addresses']['href'] to make an additional API call to get the actual IPv4 addresses of the RR.Problem: I am dealing with a huge zone ( > 300’000 entries), and this takes a long time…..Is there a way to retrieve directly with a single API call the RR of a zone with all the data, kind of a dump of a zone?  

The migration doc says v1 “POST /Services/REST/v1/addExternalHostRecord” becomes “POST /api/v2/zones/{collectionId}/resourceRecords”, but there is no ‘zone’ for an ExternalHost record.  So what collectionId should I use? 

Can anyone from Bluecat comment on the factors that went into the implementation choices for local RPZ zones? Rather than managing actions record-by-record in an RPZ, Integrity writes out a default policy for each zone in the named.conf (and then writes all the records’s (“response policy items” in BAM parlance) rdata as “CNAME .” in the zone file.)This means ALL response policy items in a given response policy (zone) have the same action.  If you want a different action, you have to create a different response policy - and BIND has an upper limit of 64 RPZs.  So essentially I can only have 64 unique responses via local RPZ under Integrity.RPZ itself (natively, in BIND) is much more flexible.  For any given RPZ I can have thousands of records in them each with their own unique action.  So if I have a one-off DNS zone or particular FQDN I want to override resolution for, I don’t have a burn one of my 64 available zones to do so, as Integrity is forcing us to do - I just place the record

Would be great if we can use BAM to view all cloud DHCP logs, monitor leases and MAC addresses. much easier than trying to run tools or create query statements just to find a DHCP lease for particular MAC. Does BlueCat have a roadmap and/or plans monitoring cloud DHCP lease data? May in the future pull this data into BAM from CDV?

I am wondering is the Integrity release replacing/upgrade to BlueCat Address Manager or is it a completely different product?

LiveAction is now part of the BlueCat family, bringing market-leading network performance monitoring (NPM) to Integrity users. Get a full picture of your network- from DNS-level insights to comprehensive traffic flows and performance monitoring across all protocols.[Learn more]