Cyber Defence Center
Detections become incidents, the address plan fills the CMDB, exceptions become tickets, and the figures reach the dashboard.
Cyber Defence CenterEnterprise Secure DNS and IPAM System
A protective resolver, authoritative zones, DHCP, IP and MAC threat hunter and the IPAM in one appliance, alone or clustered, managed from a web interface.
What it does
Answers from the root, and says no when it should
Every connection starts with a MAC, ip and name. Whoever controls that has the deep insight of what is happening in the organisation, to provide network access for the business, and have the foundation to stop what it should not do.
- Answers from the root. Recursion with DNSSEC validation on your own node, so no outside provider sees what your organisation looks up.
- Threat Hunter. MAC and IP database, everything time stamped along with threat intelligence with threat hunting. Full-text search with correlations from DHCP and DNS.
- Filtering with policy. Block lists, thirty categories, allow and deny rules, and a check for names hidden behind another name. Every refusal says why.
- Groups and schedules. Clients are grouped by network, by hardware address or by key, and each group has its own lists and its own hours of the week.
- Closes the side doors. Safe search, blocking of resolver bypass over public encrypted DNS, protection against DNS rebinding, and a rate limit for a client that misbehaves.
- Encrypted DNS. DNS over TLS and DNS over HTTPS for the clients that can use them.
- Zones under control. Primary, secondary and forward zones, split horizon for each group, import and export in the BIND format, and two-person approval of changes.
- DHCP and IPAM. Scopes with failover, a tree of nested subnets, the next free address on request, and discovery that reports conflicts and what changed, with MAC addresses and time stamps.
- What was asked, and what was refused. A customisable query log retention and statistics for two years, with the category behind every block.
- Integrations. With Eagle SIEM Secure and Cyber Defence Center and any log collector.
- API. Secure access to Eagle DNS Secure.
- Cluster Services. The cluster is host agnostic and floats the service IPs between the nodes. Every node shows the same interface, and one page lists each node's software, updates, certificate and hardening. A primary hands its role over before it restarts.
- Updates without an outage. Signed software releases rolled out from the web interface one node at a time, when the administrator chooses, with security updates on their own if that is all you want. The Appliance updates are securely managed by the cluster.
- Industry Standards. The core foundation of Eagle DNS Secure is built on standard systems proven since years and decades. Hardened.
- Hardened and watched. Eagle DNS Secure is a virtual appliance(s) hardened and locked down, not even accessible from the console, and monitored by the cluster with live health checks every minute, metrics for your own monitoring, and encrypted backups.
48,000+
Cached answers a second on two processors, with the query log on
< 4 s
Until a failed node's address answers again
89 s
To update a two-node cluster, one node at a time
0
Queries lost during that update
In the suite
The first to know what is on the network
Eagle SIEM
The query log is a stream the SIEM can search: who asked for which name, and what was refused.
Eagle SIEMAn open door
A documented API with keys scoped to read, rules or address management, and a Security Log shipped as syslog or CEF over TLS.
How it is secured
An appliance that defends itself
A resolver sits where every client can reach it. It has to be the hardest machine on the network.
- A sign-in page, and nothing else. Until somebody has signed in, a node serves the sign-in page and not one word about what is behind it.
- Authenticator codes and roles. Administrator, operator and viewer, each signing in with a second factor.
- A configuration that is signed. Every member pulls the configuration over pinned TLS and checks its signature before applying it.
- Hardening with a way back. Hardening is applied node by node and rolls itself back after two minutes unless it is kept.
- A log that cannot be quietly edited. The Security Log and the audit trail are chained by hash and shipped over UDP, TCP or TLS.
- Encrypted at rest. The database is encrypted, and backups are sealed with AES-256-GCM under a passphrase.
Good to know
Before you ask
An image for your hypervisor
Ready-made virtual machines for VMware, Hyper-V and Proxmox, or a package for Debian. Two processors and two gigabytes of memory are enough for a node.
Eight languages
English, Swedish, Danish, Norwegian, German, French, Spanish and Italian.
A licence that never stops DNS
Signed, checked offline, one for each node. If it lapses, the node keeps answering.
Eagle SecOps Suite
One part of one system
Eagle DNS Secure is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle DNS Secure running
An hour with the people who built it, on a real system, with your questions. No slideware.