DENIS

Compare · NDR and NAC

DENIS and other NDR and NAC platforms

DENIS provides NDR-style detection and NAC-style response, together with network visibility and asset management, in one self-hosted program. It is not a full enterprise NDR or NAC platform. Here is what to expect from it, and what to ask any vendor.

Try the Community edition Supported infrastructure

NDR-style detection

Passive monitoring, device fingerprinting, per-device baselines, rules for events such as rogue DHCP servers and ARP conflicts, and scored, explainable alerts grouped into incidents.

NAC-style response

DENIS contains a device by asking equipment you already own to act: a switch (disable a port, quarantine VLAN), a firewall (address group, list or one deny rule), a controller or a cloud platform. Every action is shown in full first, needs an administrator, has a time limit and a release. It does not authenticate devices with 802.1X and does not replace your RADIUS or policy server.

What is different

One self-hosted program, no endpoint agents and no cloud service. Every score is a sum of named reasons and every device-type guess lists its evidence. The asset register, the network map and the response actions live in the same console.

Questions to ask any vendor

Which equipment, models and software versions has it been verified with? What happens to an action when the tool loses its connection? How is an action undone? What does the tool refuse to do, whatever you confirm?

  • DENIS answers these in the enforcement guide and the setup guides.

Good to know

DENIS is not inline and does not block by itself unless you set that up. Automation and Autopilot are experimental and off by default. DENIS has not been independently verified by a third party yet.