Every DNS query on your network is logged, analyzed, and visualized in real-time dashboards. Understand browsing patterns, identify security incidents, generate compliance reports, and export data to your SIEM platform with full query-level detail.
See the DashboardOur analytics platform transforms raw DNS query data into actionable intelligence, giving network administrators and security teams the visibility they need.
Watch DNS queries resolve in real-time with a live feed showing domain, client IP, category, action taken, and response time. Filter the stream by network, user, category, or action to focus on what matters.
Visualize DNS query volumes over time with interactive charts. Identify peak usage periods, detect anomalous spikes, and compare traffic patterns across days, weeks, or months to spot trends and plan capacity.
See the most queried, most blocked, and most categorized domains across your network. Rankings update in real-time and can be filtered by time range, network segment, user group, or specific categories.
Track individual user browsing patterns with category breakdowns, block events, and bandwidth consumption estimates. User reports help enforce acceptable use policies and identify training needs.
A dedicated security view highlights blocked unsafe content connections, restricted content attempts, restricted network C2 communications, and DNS tunneling detections. Drill down into each event for full forensic context.
Understand how your network uses the internet by category. See what percentage of queries go to social media, streaming, business applications, or other categories with interactive pie and bar charts.
Over 20 pre-built report templates cover every aspect of DNS activity. Schedule automated delivery or generate on-demand reports for meetings and audits.
High-level overview of query volumes, blocked domains, top categories, and policy compliance metrics suitable for leadership review.
ScheduledDetailed breakdown of all security events including unsafe content blocks, restricted content attempts, domain pattern detections, and DNS tunneling alerts with severity levels.
Real-TimeRanked list of most frequently blocked domains with block counts, categories, and the policies that triggered the blocks across the reporting period.
HistoricalPer-user and per-group analysis of policy compliance, showing violation trends, repeat offenders, and which categories trigger the most blocks by user segment.
ScheduledQuery volume patterns by time of day, day of week, and network segment. Identifies anomalous traffic patterns that may indicate compromised devices or policy issues.
HistoricalTamper-evident logs of all policy changes, administrator actions, and access events formatted for CIPA, HIPAA, and SOC 2 audit requirements.
ScheduledDNS query logs and reports can be exported in CSV, JSON, and PDF formats for offline analysis or archival. Automated exports can be configured to deliver reports to email recipients or cloud storage on a daily, weekly, or monthly schedule.
For real-time integration with your security operations center, our platform supports log streaming via Syslog (RFC 5424), Splunk HEC, Amazon S3, Azure Blob Storage, and Google Cloud Storage. Webhook notifications can alert your team when specific security events occur.
Pre-built integrations are available for Splunk, Elastic SIEM, Microsoft Sentinel, IBM QRadar, and Sumo Logic. Our structured log format enables easy parsing and correlation with other security data sources in your SIEM platform.
Bulk export query logs in structured formats for data analysis
Real-time log streaming to your SIEM via RFC 5424 syslog
Instant notifications for security events to Slack, Teams, or PagerDuty
Native connectors for Splunk, Elastic, Sentinel, QRadar
Full DNS visibility starts with a free trial. Deploy in minutes and immediately see every query, every block, and every trend across your entire network.
Check Domain See Plans