Active Protection
+ DeepInspect
DNSEndpoint enforces DNS on the device and sends it encrypted to ThreatOrigin Public DNS. DeepInspect shows which process made each query.
Protection and process context travel with the device.Your network, connected.
Your workflow, continued.
Follow one network through five steps. Each connection stays in view as the next part comes alive.
Your DNS already has a route.
Clients use local DNS. Queries leave through the firewall and reach your ISP’s public DNS.
Your company network
Branches · headquarters · datacenter
Local clients and DNS servers stay in place.Internet
Public DNS resolvers
Identity, device & process →
Enriched incident ↓
DNS forwardingPassive log collection ↓DNS queries+ company public IPNetwork boundary
Clients query existing DNS servers. Branch and internal DNS forward through the firewall to ISP public DNS. The on-prem module is not deployed.
Existing DNS pathLog / context collectionPublic DNS / SIEM output
Existing network
DNS works as it does today.
Your branch and internal DNS servers already resolve requests through your upstream provider.
How this step works
Keep the local network in place. Follow the installation steps to add public DNS protection, local visibility, correlation and SIEM delivery. Select a node to inspect its role.
DNS signalUser + deviceProcess contextOne enriched incident → SIEM
Keep the topology. Connect the context.
Existing DNS, DHCP, identity, XDR and SIEM work together through ThreatOrigin.
Protect the office.
Follow users beyond it.
One cloud DNS service for offices, home users and roaming devices. No on-prem appliance.
Point your office DNS to ThreatOrigin.
Forward queries from the existing branch and headquarters DNS servers to ThreatOrigin Public DNS.
Company networkHeadquarters & branches
Beyond the officeHome & roaming users
FirewallCompany
public IP
public IP
ISP public DNSCurrent destination
Forward office DNS →Process context only →Identity-based policies ↑
Existing branch, headquarters and datacenter DNS servers forward through the firewall to ThreatOrigin Public DNS. Microsoft Entra ID supplies user and group context for policies. Roaming protection and office process visibility are added in the following steps.
Protected DNS queriesProcess contextIdentity & policies
STEP 01 · OFFICE PROTECTION
Protect headquarters and branches.
Your local DNS servers stay in place. Their upstream destination changes from the ISP resolver to ThreatOrigin Public DNS.
How this step works
Office queries arrive under the company public IP. Microsoft Entra ID connects users and groups to the policies applied by ThreatOrigin.
Two endpoint modes. Different jobs.
Protection away.
Visibility at the office.
DNSEndpoint provides the process context in this installation. You do not need an XDR integration or an on-prem appliance.
Active Protection
Monitor Only
DeepInspect only. It identifies the process behind DNS requests; it does not filter queries or replace your existing local DNS path.
DNS filtering stays with the cloud DNS service.Microsoft Entra ID integration
Write policies for the users and groups you already manage.
Connect Microsoft Entra ID, formerly Azure Active Directory, to apply user and group policies across office and roaming activity.
UserGroupSecurity policy
ThreatOrigin plugs into your central DNS and DHCP servers and, through smart integrations, discovers the users, hosts, and processes behind every query across your estate. You gain full DNS‑layer security and visibility for large, distributed networks in a fraction of the time of traditional DDI solutions, without deploying appliances or agents at every site.
Up to 95% reduction in
DNS EPS sent to SIEM
Send only the alerts that matter, not every DNS query.
Ready SOAR playbooks
that cut false positivesand noise
instead of adding alerts
Automate responses on new threats without thinning out cases at the source.
SOC investigations
up to 90% faster thanks to
correlated, scored events
Get the full incident story in one view, without switching tools.
ThreatOrigin automatically correlates raw DNS signals with XDR process data and user identity before they reach your SIEM. SOC teams get a single, fully resolved incident timeline, allowing them to close cases in minutes without switching consoles.
ADAPTABILITY → KEY FEATURES
Security that molds to your infrastructure
Stop re-engineering your network to fit a security tool. ThreatOrigin is built to adapt to your existing layers, identity providers, and operational workflows—delivering complete protection without the friction.
Simplified administration.
Manage your entire security posture from just three intuitive menus: Public IP Policy, Security Profile, and User and Group Policy. This streamlined approach eliminates the complexity of fragmented configurations found in traditional tools, significantly reducing the learning curve and operational load on your team.
Identity-centric control.
Shift from static IP-based rules to dynamic, identity-aware security. By integrating seamlessly with Active Directory and Entra ID—without requiring endpoint agents—ThreatOrigin lets you apply granular policies based on user groups and departments, ensuring security adapts instantly as your organization evolves.
Deep process visibility.
Go beyond standard DNS logging to see the full context of every query. ThreatOrigin identifies not just the device, but the exact process and application generating traffic, exposing hidden malware and unauthorized software that traditional DNS security tools miss completely.
Layer-agnostic architecture.
Maintain full visibility even in complex, multi-layered DNS environments where other tools go blind. ThreatOrigin identifies the true source of every query—user, machine, and process—even behind forwarding servers and proxies, ensuring you never lose sight of your endpoints, no matter how your network is structured.
There's more to discover !
Hey, I'm Sensei
I can walk you through everything about ThreatOrigin's adaptability feature. What's on your mind?