Advanced Filtering
Block malicious domains and enforce content policy in real-time, before anything executes.
Learn more
Behavior Analytics
Understand user behavior, not just the alert.
A block tells you a request was stopped, not what the device was doing before or after. Behavior Analytics records the rest: Which applications, sites, and full URLs a device reached, on which device, in what order, and for how long. An investigation that used to span several tools and several days happens in one timeline.
- 200 billion DNS queries resolved daily
- 12 months of activity history retained
- 57,000+ organizations protected
Where the record earns its place
-
Accelerate incident response with user-to-activity forensics
An alert fires and the responder needs to know which user, which device, which applications, and what happened in the hour on either side. The timeline holds processes executed, applications opened, sites and full URLs reached, and device state changes, tied to a user and a timestamp. Nobody has to reassemble it from three consoles.
-
Discover and quantify shadow IT
Every cloud application and SaaS tool your people are reaching, including the ones that never tripped a policy event. You get the complete picture of unsanctioned tool usage on your managed fleet without deploying a CASB, and the numbers to take into the conversation about it.
-
Find the SaaS licenses nobody is using
Smart idle tracking separates real engagement, including meetings and training video, from time a window simply sat open. IT and finance get the difference between a seat somebody uses and a seat somebody was assigned, from the same agent, with no vendor-reported login data involved.
What you get
Reconstruct, rank, record, retain
-
Reconstruct any hour from the timeline
Start at any event and read forward or backward through what that user and device did around it, in sequence, at the application, site, and full URL level. The order is what tells you whether an event was user-driven or automated.
-
Risk you can rank
Threat Trends aggregates observed threat activity across your environment and surfaces the categories appearing most often, along with the users who need attention first.
-
Activity data that holds up
Smart idle tracking separates real engagement from true idle time, so the numbers survive the moment somebody challenges them in a meeting.
-
One year of record
A full year of activity logs for compliance requirements and long-term forensics, exportable by CSV and API into the tooling you already run.
Deploys through the Roaming Client you already run. No new agent, no second console, no network overhaul.
Who it is for
-
For security and IT teams
The behavioral context that turns an alert into a decision, on the fleet you manage, with nothing new to deploy and no second console to learn. When an auditor asks what a device was doing on a given afternoon, the answer comes from a record rather than a reconstruction.
-
For MSPs and partners
Client conversations about shadow IT and insider risk usually stall on evidence. This produces it per client, in the multi-tenant console you already use, and exports by CSV and API for the reports you already send. Technician time goes into the fix rather than the reassembly.
Stop reconstructing. Read the record.
See which applications and sites your fleet is actually reaching, reconstruct any afternoon in one timeline, and keep the year of history that answers the question you get asked later.
Five suites. One engine.
Each suite is a distinct outcome of shared platform intelligence. Start with one and expand at your pace, with no replatforming between them.
-
-
Behavior Analytics
Visibility into user behavior so anomalies and indicators of compromise surface earlier and with higher fidelity.
Learn more -
AI Governance & Controls
Discover the AI tools and agents your devices reach, then apply policy to them as separate entities from the people using those machines.
Learn more -
Encryption & Privacy
Enforce privacy as policy, with encrypted transit for every user everywhere they work.
Learn more -
Threat Intelligence
Proprietary, DNS-First threat intelligence with patent-pending lookalike domain detection.
Learn more
FIND OUT MORE
FAQs
Read the answers to the most frequently asked questions. Want to know more? Visit our help desk.
Partly, and only the part we can do well. UEBA baselines normal activity for each user and device and surfaces what departs from it, usually across identity, email, and cloud logs alongside a SIEM. This suite covers the DNS and endpoint layer of that picture: Which applications, sites, and full URLs a device reached, in what order, and for how long.
A SIEM correlates events across many sources and needs rules, tuning, and somebody to own it. This is narrower on purpose: DNS and endpoint behavior, held in one place and readable without a query language. Teams run both, and the export exists so this data lands in the SIEM you already have.
Applications and sites reached, full URLs, device state changes, active time, idle time, and streaming time, each tied to a user, a device, and a timestamp. All of it appears in one chronological timeline and exports by CSV and API.
No. We record that a device reached an application or a site. We do not inspect prompts, files, messages, or responses.
It is built for security investigation and IT operations, and it is honest about what it records. Activity is logged at the application and site level, per device, so a security team can reconstruct an incident and an IT team can see which licenses are in use. How you use it, and what you tell your people about it, is set by your own policy.
Nothing new. It runs as an extension of the DNSFilter Roaming Client you already deploy, in the console you already use, with no network changes.
One year of user activity logs, which covers most compliance retention requirements and long-term forensic needs.
Yes. CyberSight is live, so this suite is already in customers' hands rather than arriving with the launch.