DNSEndpoint | ThreatOrigin

A malicious process on a laptop, targeted by the ThreatOrigin mark like a scope, with its connection leading out to an attacker

Blocking stops the request. It doesn't stop the malware.

A DNS block hides the symptom while the infected software keeps running and calling out. DNSEndpoint names the process behind each malicious connection, so your team can remove it at the source, without depending on an XDR.

One agent, two modes

Choose the mode per device, or apply it to whole groups at once.

MONITOR MODE

See everything, touch nothing

Runs passively. It does not intercept traffic; it watches DNS activity on the device and pinpoints the software behind every malicious connection.

ACTIVE PROTECTION MODE

Detect it and stop it

Everything in Monitor mode, plus DNS-level blocking on the device. Malicious connections are stopped before they reach the internet, wherever the device is.

DNSENDPOINT → KEY FEATURES

Find the origin on every device

DNSEndpoint brings process-level visibility to DNS security, on its own, across every endpoint you manage.

Process detection without an XDR

Identify the exact application or process behind each malicious DNS query, even where no XDR is deployed.

One agent for every device

DNSEndpoint replaces the Roaming Client and runs on office and roaming devices alike. Need visibility without DNS changes? Install it in Monitor mode.

Windows and macOS

One agent for both platforms your teams use every day.

Choose the mode per device or per group

Set Monitor or Active Protection for a single device, or apply it to whole groups at once.

There's more to discover !

Hey, I'm Sensei

I can walk you through everything about DNSEndpoint. What's on your mind?

See the process behind every malicious query