DENIS

Solution · Small and mid-size business

Network security monitoring for small and mid-size businesses

Know what is on your network, notice when something changes and contain a misbehaving device, without a security team or an enterprise platform. DENIS runs on one machine you control and explains every alert in plain words.

What DENIS does, in plain wordsInformation for organisations

Why internal visibility matters

Firewalls and antivirus protect the edges and the computers. In between are the devices that run neither: printers, cameras, door systems, storage boxes, phones and the occasional device nobody approved. When one of them behaves oddly, the first question is always the same: what is it, and what has it been talking to? DENIS answers that from the network itself.

Discovery that keeps itself current

  • Every device that appears is found and placed in a review queue, whether or not anyone told DENIS about it.
  • Manufacturer, type and operating system come with the evidence behind them; your correction always wins.
  • Owners, locations, warranties and criticality live next to what DENIS discovered, with a change history and CSV import and export.

Suspicious traffic, explained (NDR-style detection)

Every alert says what happened, why it scored what it did, when it is probably harmless and what to do first. Routine events go into a daily digest instead of your phone, and since 4.3 you can mark an alert as normal for a time you choose.

  • A device contacting a known-bad address, or one it never used before.
  • A camera or storage box sending far more data than usual, or active at unusual hours.
  • Someone on the internet opening a connection to one of your devices, for example through a forgotten port forward (needs traffic accounting).
  • Rogue DHCP servers, ARP conflicts and an attempt to take over the gateway.
  • New in 4.3: brute force from outside, DNS threat domains (needs a free abuse.ch key), mining pools, VPN and anonymizer use, remote-access tools, a changed gateway and a rogue DHCPv6 server.

NAC-style response through the equipment you already own

When an administrator allows it, DENIS can block a device or a connection, or quarantine a device, through supported switches and firewalls: shown in full before it runs, confirmed with a password, time-limited and reversible. It is off by default, and by default a person decides every action.

  • Verified on real equipment: Cisco Catalyst switches, Fortinet FortiGate, Palo Alto PAN-OS, MikroTik RouterOS and Ubiquiti UniFi, for the actions and versions on the supported infrastructure page.
  • Other connectors, such as OPNsense, SonicWall or WatchGuard, are experimental and act only after an administrator enables lab use.

Self-hosted and practical

One program on a small Linux server, a Raspberry Pi class machine or a Mac. No endpoint agents, no DENIS cloud and no telemetry. Notifications go to e-mail, Slack, Microsoft Teams, ntfy and other channels, and alerts can be exported to a SIEM if you have one. The honest cost is time: someone installs it, looks at the first alerts and tunes what is normal.

DENIS dashboard for a fictional company: a daily digest, tiles for devices, open incidents and alerts, four donut charts, a Top exposures today list with the reasons for each device, recent alerts, most at-risk devices and findings needing attention
The Dashboard on the demo network: every device, what changed and what needs attention first.
The Equipment page on demo data: three switches read over SNMP with an Experimental label for standard-SNMP control, and a working UniFi controller with its access point and clients
The switches, firewalls and controllers DENIS reads from or acts through, and how well each is tested.

Illustrative situations

Illustrative situations, not customer cases. Each names the detection in DENIS that reports it and what that detection needs.

  • Illustrative situation, not a customer case

    A camera or printer opens an admin session to a server

    A network camera starts an SSH, Telnet, RDP, VNC, WinRM or file-share session to the file server, as a compromised device spreading inward would.

    What DENIS reports. “IoT device opens an admin session” (new in 4.3): a camera, printer, TV, smart-home gadget or field device opens an administration session to another device; only connections whose opener is proven by the TCP handshake count. A printer that only opens file shares (scan to folder) scores lower.

    Needs. East-west recording or a mirror port that sees traffic between your devices; after a learning period.

  • Illustrative situation, not a customer case

    A new remote-access tool or VPN tunnel appears

    Someone talks a colleague into installing a remote-access tool, or a device opens a VPN tunnel to the internet that nobody set up.

    What DENIS reports. “Remote-access tool” (new in 4.3): the first use by a device of a tool such as AnyDesk, TeamViewer, ScreenConnect or RustDesk, seen by name or by the tool’s own port. “New VPN tunnel” (new in 4.3): a device opens WireGuard, OpenVPN, IPsec, L2TP or PPTP to a public address for the first time.

    Needs. Passive DNS or traffic accounting for tools (HTTPS-only tools are seen by name only); traffic accounting for tunnels. Tools you allow are never reported.

Limitations

  • DENIS is not an antivirus, an EDR or a firewall, and it does not replace the protection on your computers. Someone still has to read an alert and decide.
  • It sees what reaches the interfaces it listens on: to see traffic between other devices it needs a mirror port, a tap or a place on the gateway.
  • It cannot read encrypted traffic, only who talks to whom, when and how much.
  • DENIS has not been assessed by an independent party yet; an independent penetration test is planned.
  • An organisation may evaluate the Community edition free for 30 days from its first installation, on up to 100 devices, for evaluation and demonstration only; running its operations on DENIS needs a commercial license from the author, in the tiers DENIS 500, DENIS 5000 and DENIS 20000 (above 20,000 devices individually). See information for organisations.