Works with what you already have
Open a category to see what each integration adds.
Ask Sensei next to any category for a short summary, or click a logo to ask about that product.
XDR and EDR
Process and inventory data from your XDR.
XDR and EDR
Process and inventory data from your XDR.
- Machine name, user name and operating system come from every supported XDR.
- Process details come wherever your XDR records them; how much it records depends on the vendor.
- Shows which machines have no XDR installed.
DNS servers
Reads the logs of the DNS servers you already run.
*
DNS servers
Reads the logs of the DNS servers you already run.
- Microsoft DNS connects directly: open access and the logs are read.
- Other DNS servers send their logs over syslog.
- Any DNS server not on the list is added with a custom parser. Request it from the product and our R&D team writes it; there is nothing for you to build.
DHCP
Ties every IP address to a device.
*
DHCP
Ties every IP address to a device.
- Adds MAC address and hostname to every DNS log line.
- Microsoft DHCP is recognised directly; other DHCP servers connect over syslog with a parser.
Active Directory
Puts a user name on every query.
Active Directory
Puts a user name on every query.
- User name, IP, MAC address and hostname appear together on one log line.
- Also used to sign in to the on-prem console.
Microsoft Entra ID
Your cloud users and groups, in every policy and report.
Microsoft Entra ID
Your cloud users and groups, in every policy and report.
- Write rules for Entra ID users and groups.
- Assign a policy to an Entra ID group; its members update automatically, so you manage policies from your own groups.
- Devices signed in with Entra ID report the user behind their DNS traffic, and reports use these users and groups.
SIEM
Sends enriched, filtered DNS data to your SIEM.
*
SIEM
Sends enriched, filtered DNS data to your SIEM.
- Each event arrives already correlated: user, device, process, category and risk score.
- You choose which logs to send, so your SIEM receives what matters instead of raw DNS volume.
- Works with any SIEM that accepts syslog.
SOAR
Turns detections into action.
*
SOAR
Turns detections into action.
- A SOAR playbook can block a domain for every device at once with a single blocklist entry.
- Infected machines are sent to your SOAR with process and traffic details and a score, so the action runs there.
- A SOAR API is available for other platforms.
Operating systems
The DNSEndpoint agent runs on Windows and macOS.
Operating systems
The DNSEndpoint agent runs on Windows and macOS.
- Install the agent on office and roaming devices.
- Run it in Monitor mode or Active Protection mode, per device or per group.
Not on the list? Other products can be integrated flexibly.