Microsoft Sentinel
Ingests CEF natively.
Setup guideSIEM & SOC
SIEM and SOC streaming over CEF
Three CEF streams from the Local Resolver Logs Connector: DNS firewall (RPZ) events, DNS query logs and portal audit logs.
Elastic
Ingests CEF natively.
Setup guideArcSight
Ingests CEF natively.
Setup guideSplunk
Onboarding template with field mapping and sample records.
Setup guideIBM QRadar
Onboarding template with field mapping and sample records.
Setup guideEndpoint deployment
Roll out the Endpoint Agent with the tools you use
Silent install for Windows, macOS and Linux, pushed through the management tools you already run.
Microsoft Intune
Push the agent to managed Windows and macOS devices.
Setup guideJamf
Deploy to macOS fleets with your existing policies.
Setup guideGroup Policy (GPO)
Install across Active Directory domains.
Setup guideSCCM
Package and distribute with Configuration Manager.
Setup guideAnsible
Automate installation across Linux and Windows hosts.
Setup guidePuppet
Manage the agent as part of your desired state.
Setup guideChef
Install and configure through your cookbooks.
Setup guideThreat feeds
Response Policy Zones, in and out
Exchange intelligence with the resolvers and feeds already in your environment.
External RPZ ingestion
Subscribe to RPZ feeds over HTTPS and keep them in sync on a schedule.
Setup guideRPZ export
Publish your feeds in RPZ format for BIND, Infoblox and other third-party resolvers.
Setup guidePlatform
Platform interfaces
Encrypted DNS transport, automation and multi-tenant management.
DNS over HTTPS and TLS
Encrypted resolution over DoH and DoT, enforced per tenant.
Setup guideREST API
Automate zones, policies and reporting from your own tooling.
Setup guideActive Directory connector
Maps queries to authenticated users through the Local Resolver.
Setup guideMulti-tenant portal
Delegated administration, per-tenant policies and segregated audit trails for MSPs.
Setup guide
Automation
Built to be automated.
CEF streams into your SIEM.
Silent installs through your MDM.
RPZ feeds in and out, DoH and DoT, and a portal your SOC can live in.
Plan your integration with an engineer.
We will map DNS Armor to your SIEM, endpoint tooling and resolvers in one call.