Product · Release 4.4.3
Supported infrastructure and validation status
What DENIS reads from, and can act through, in the released version 4.4.3: per product, the actions, the sign-in method, how far it was tested, and the known limitations. Nothing here is inferred from a standard protocol: a product is listed as tested only where the product documentation records the test.
At a glance
| Connector | What it does | Validation level and date | Environment |
|---|---|---|---|
| Cisco Catalyst 2960-X (SNMP) | Disable a port; quarantine VLAN | Verified | Real equipment, owner’s lab |
| Cisco Catalyst C9300, C9200CX (SNMP) | Disable a port; quarantine VLAN | Verified, 29 Oct 2026 | Cisco DevNet sandbox (C9200CX physical) |
| Cisco Catalyst 9200L stack (SNMP) | Disable a port; quarantine VLAN (second member) | Verified, 5 Nov 2026 | Cisco DevNet sandbox, two physical members |
| Cisco FTD through FDM | Block a device (network group) | Verified, 29 Oct 2026 | Cisco DevNet sandbox, virtual FTD 7.0.1-84 |
| Cisco FTD through FMC | Block a device through a dynamic object | Verified, 29 Oct 2026 (dynamic-object block only; the rest Experimental) | Cisco DevNet sandbox, virtual FMC 7.7.12 |
| Palo Alto PA-220 | Block a device or a flow; end sessions; quarantine | Verified | Real equipment, owner’s lab |
| Fortinet FortiGate 40F | Block a device or a flow; end sessions; quarantine | Verified | Real equipment, owner’s lab |
| MikroTik E50UG | Block a device or a flow; quarantine; end sessions | Verified | Real equipment, owner’s lab |
| UniFi Cloud Gateway Ultra | Firewall-policy block of a device or a flow | Verified | Real equipment, owner’s lab |
| UniFi Cloud Gateway Ultra with a nanoHD access point | Block a wireless client by MAC; disconnect it | Verified, 29 Oct 2026 (wireless clients only) | Real equipment, owner’s lab |
| Amazon Web Services (EC2 security groups) | Quarantine an instance; host block; release | Verified, 3 Nov 2026 | A lab AWS account (eu-central-1), not real equipment |
| TP-Link Omada | Read clients and access points; block a client | Verified, 5 Nov 2026 | Real controller 5.15 with an ER605 and an EAP110; a block through DENIS on a wired client not yet tried |
| MikroTik Wi-Fi (hAP ax lite under the CAPsMAN of an E50UG) | Block a client by MAC | Experimental; tried once, 6 Nov 2026 | Real equipment: the phone was logged out of the Wi-Fi; a join while blocked not yet recorded |
| Other MikroTik Wi-Fi paths; Cisco Catalyst 9800 wireless controller | Read clients and access points; block or end a client | Experimental | Simulated or fake device only; new in 4.4 |
| All other connectors | See the Experimental table | Experimental | Simulated device only |
How we validate
A feature is either Experimental or verified, and a pass in one environment never counts as a pass in another. Verified results name where they were obtained.
- Experimental. The connector is built from the vendor’s published documentation and tested against a simulated device in DENIS’s own test suite. It shows that DENIS behaves as intended when the device behaves as simulated, and nothing about the real device. An administrator must switch on lab use before it acts.
- Verified, Cisco DevNet sandbox. The connector was run against the vendor’s own test environment. A sandbox is a test environment run by the vendor that anyone can reserve for a limited time. It shows what the vendor’s software really answers for the version tested, with no effect on anyone’s network. It is weaker than a lab with a real client, and this page names the device and whether it was virtual.
- Verified, real equipment. A physical device in the owner’s lab, with a test client and a check that traffic really stopped or came back, for the version and actions named.
Cisco Secure Firewall Threat Defense (FTD) is virtual in the sandbox: it runs there as a software appliance, not as a physical firewall. That is why the FTD rows say “sandbox, virtual” and are never called real equipment. Each result is recorded with its date, the device and the software version, and covers only the actions named.
How to read the status
- Verified Tried for the device, version, date and actions named, in the environment the row names: real equipment in the owner’s lab (with a test client and a check that traffic really stopped), or the Cisco DevNet sandbox. A virtual device is never called real equipment.
- Partly tested Some actions or reads were tried on real equipment; the rest were not.
- Experimental The real connector code against a simulated device written from the vendor’s documentation. It shows that DENIS behaves as intended when the device behaves as simulated, and nothing about the real device.
- Not tested Expected to work through standard tables, not tried.
- Planned Not in the released version; no date promised.
Every response action, on every product, is off by default, shown in full before it runs, needs an administrator’s password, has a time limit and a release, and goes through one path with a kill switch and an hourly limit. Automatic actions are experimental and separate. No integration in this list has been tested by an independent party.
Verified on real equipment
Response through these products was tested in the owner’s lab on the device and software version named, for the actions named. A result for one action does not carry over to another action of the same product.
| Product | Reads | Actions | Sign-in | Status | Limitations |
|---|---|---|---|---|---|
| CiscoCatalyst switches (SNMP)Setup guide | Ports, link and admin state, LLDP and CDP neighbours, forwarding table per VLAN, trunk mode and VLAN list | Disable a port; move an access port to a quarantine VLAN you built; release | SNMPv3 (authPriv, SHA-1 and AES-128) or SNMPv2c communities; a separate write user or community for actions | VerifiedReal hardware: Catalyst 2960-X (WS-C2960X-48TS-L, IOS 15.2(7)E4), SNMPv2c and SNMPv3: disable port, quarantine VLAN, release, uplink refusal. The fault and safety scenarios are not yet recorded on hardware. Also verified in the Cisco DevNet sandbox on two more Catalyst models (see the sandbox table below). | Other Catalyst models and IOS 15.x releases are expected to work and have not been tried. Trunk, EtherChannel, management and CDP-neighbour ports are refused. Since 4.3 the write test of the quarantine VLAN is stricter and fewer VLAN reads are missed; since 4.4.1 the option carries no Experimental label on Cisco (the move on other makes stays Experimental). |
| Palo Alto NetworksPAN-OS firewallsSetup guide | Its own state, read back after each action (not used for discovery) | Block a device through a dynamic address group (no commit); block a flow; end sessions; quarantine through the dynamic group | XML API key (User-ID API for the dynamic group) | VerifiedReal hardware: PA-220, PAN-OS 10.1.14-h9: block through the dynamic address group, block a flow, end sessions, quarantine through the dynamic group, release, expiry and extension. | The block through the static address group is not tested on hardware and needs lab use. New in 4.3, the firewall’s own timeout for a timed block is opt-in, off by default and Experimental: the timeout was tried on the PA-220 only as a safety net, and DENIS’s use of it has not yet been run on a firewall. Not tested: HA, re-registering a lost tag. A flow block through a commit takes minutes. |
| FortinetFortiGate firewalls (FortiOS)Setup guide | Its own state, read back after each action (not used for discovery) | Block a device (address group); block a flow; end sessions; quarantine through a quarantine address group | REST API token of a REST API administrator | VerifiedReal hardware: FortiGate 40F, FortiOS 7.2.3: block device, release, expiry, extension, block a flow, end sessions and quarantine. | Not tested: IPv6, HA, VDOM mode, and several fault and safety scenarios. Other FortiOS 7.x versions are expected to work and have not been tried. |
| MikroTikRouterOS 7 routersSetup guide | Its own state, read back after each action (not used for discovery) | Block a device (address list); block a flow; quarantine by address; end sessions | REST API user (HTTPS, basic authentication) | VerifiedReal hardware: E50UG (hEX family), RouterOS 7.21.4: block device, block a flow, quarantine by address and end sessions, with their release. A client behind a MikroTik access point was blocked through the router within about three seconds and released within about three seconds (6 November 2026). | A block stops what passes through the router’s forward chain; it does not stop traffic between two clients of the same access point and does not touch the Wi-Fi association. Disabling a port is not tested and needs lab use. End sessions needs loose TCP tracking off and drop-invalid rules. Other RouterOS 7 versions are expected to work and have not been tried. |
| UbiquitiUniFi (UniFi OS, Network application)Setup guide | New in 4.3, read only: the clients the controller sees (access point, network name, VLAN, switch port) on the map and the device; some wireless fields are marked unverified. Its own state is read back after each action. | Block a device or a flow through a firewall policy; block a wireless client by MAC; disconnect a wireless client | API key of the Network application, or a local account | VerifiedReal hardware: Cloud Gateway Ultra, UniFi OS 5.1.33 with Network 10.6.106: the two firewall-policy actions, with release and expiry. Verified in the owner’s lab, 29 October 2026, on a UniFi Cloud Gateway Ultra with a nanoHD access point and one phone, for wireless clients only: block by MAC (the phone could not rejoin; released by hand; automatic expiry after 5 minutes) and disconnecting the wireless client. | The block by MAC of a wired client is not validated (on the bench the traffic came back before the time was up) and needs lab use. Port actions are not tested. |
| TP-LinkOmada controller (Open API)Setup guide | Clients, devices and uplinks the controller sees, read only (DENIS shows what a device hangs on) | Block and release a client by MAC, with read-back | Open API app (client ID and secret) | VerifiedTried on a real Omada Controller 5.15 with an ER605 gateway and an EAP110 access point, 5 November 2026: the identity page, the sign-in, the site, the devices, the clients and one client’s own blocked flag. The controller’s own block call disconnected a Wi-Fi client in about two seconds and the client could join again right after the release. | No longer Experimental (4.4.2). Not yet tried: a block through DENIS on a wired client and the measured effect on its traffic. A controller without the newer client list (5.15 has none) checks a block by the client’s own record. |
Verified in the Cisco DevNet sandbox
Tested in the Cisco DevNet sandbox on 29 October 2026, with the device and software named. A sandbox is a vendor-run test environment you can reserve; it is not the owner’s lab. Where the device was virtual, the row says so and it is never called real equipment. The other actions of these products stay Experimental.
| Product | Reads | Actions | Sign-in | Status | Limitations |
|---|---|---|---|---|---|
| CiscoCatalyst C9300-24UX (IOS XE 17.15.1) and C9200CX-12P-2X2G (IOS XE 26.02.1) switches (SNMP)Setup guide | Ports, MAC table, per-VLAN forwarding tables, trunk table | Disable a port; move an access port to a quarantine VLAN; release | SNMPv2c on the C9300; SNMPv3 (authPriv, SHA-1 and AES-128, separate read and write users) on the C9200CX | VerifiedVerified in the Cisco DevNet sandbox, 29 October 2026 (the C9200CX is a physical compact switch): reading the ports, MAC and VLAN tables, the write test, switching a port off and on, and moving a port to a quarantine VLAN and back, each confirmed by reading the switch back. | No client was plugged into the test port, so the effect on client traffic was not tested. Not tested: stacks, link aggregation and trunk refusals on real ports, LLDP, SHA-256 and AES-256. Newer IOS XE can refuse the old SNMPv2c setup: use SNMPv3. Virtual Cisco IOL switches serve no forwarding table over SNMP: DENIS reads their ports only and moves nothing; nothing is claimed for them. |
| CiscoSecure Firewall Threat Defense (FTD) managed by Device Manager (FDM)Setup guide | Its own state, read back after each action (not used for discovery) | Block a device through a network group you created, then a deployment; release | FDM REST API (bearer token); use a dedicated DENIS user | VerifiedVerified in the Cisco DevNet sandbox, 29 October 2026, on a virtual FTD 7.0.1-84 (not a physical device): test connection, the block with its deployment, the release and the cleanup, each confirmed by reading the device back. | A virtual device, not real equipment. Quarantine, flow rules (access rules), high availability and other FTD versions are not tested and stay Experimental. |
| CiscoSecure Firewall Management Center (FMC) 7.7.12Setup guide | Its own state, read back after each action (not used for discovery) | Block a device through a dynamic object you created; release | FMC REST API; use a dedicated DENIS user | VerifiedVerified in the Cisco DevNet sandbox, 29 October 2026, on a virtual FMC 7.7.12 (not a physical device): test connection, the block through the dynamic object (enforced) and its release (restored), each confirmed by DENIS’s read-back and by an independent, fresh sign-in to the FMC; the test object was deleted afterwards. | A virtual device, not real equipment. Only the dynamic-object block is verified; everything else of this connector stays Experimental: network group mode and deployment, quarantine, flow rules, other FMC versions. |
Partly tested, or relying on standard tables
Switches read over standard SNMP tables. Only what is named was tried on real equipment.
| Product | Reads | Actions | Sign-in | Status | Limitations |
|---|---|---|---|---|---|
| D-LinkDGS-1100 switches (SNMP)Setup guide | Ports and their state (this model exposes no forwarding table, LLDP or VLAN objects over SNMP) | Switch a port off and on | SNMPv2c or SNMPv3 | Partly testedPartly tested on real hardware: DGS-1100-08V2, firmware 1.00.015: reading the ports and switching a port off and on work. | Devices behind it cannot be placed automatically (place them by hand). No quarantine VLAN. |
| Other managed switchesStandard SNMP tables (IF-MIB, LLDP-MIB, BRIDGE-MIB, Q-BRIDGE-MIB)Setup guide | New in 4.3: any managed switch with standard SNMP can be read (ports, neighbours, forwarding table), where the switch implements the tables | Experimental generic control (4.3): switch a port off; move a port to a quarantine VLAN (dot1qPvid). Off by default, only after a passed write test | SNMPv2c or SNMPv3 | ExperimentalGeneric SNMP control: tested against simulated switches that answer the whole standard set; no switch model is validated on real hardware. | Reading other makes is expected to work through the standard tables but is not tested. Reports from other switches are welcome. |
Experimental connectors
Built from the vendors’ published documentation and tested against a simulated device in DENIS’s own test suite. They have not been verified against the real product (MikroTik Wi-Fi was tried once on real equipment, as its row says). Every action needs an administrator to switch on lab use, and feedback from real installations is welcome.
| Product | Reads | Actions | Sign-in | Status | Limitations |
|---|---|---|---|---|---|
| MikroTikWi-Fi: access points (wifi and wireless packages) and CAPsMANSetup guide | Clients and access points, read only | Block a client by MAC; disconnect a client | REST API user | ExperimentalExperimental. Tried once on a real access point under a CAPsMAN (see the limits); the other Wi-Fi paths (a standalone access point, the legacy wireless package) were tested only against a simulated device. Every action needs lab use switched on by an administrator. | New in 4.4. Tried once on real equipment (6 November 2026): a hAP ax lite managed by the CAPsMAN of an E50UG; a block by MAC logged the phone out of the Wi-Fi. Whether the phone could join again while blocked, a disconnect on its own and many access points were not recorded. This is separate from the verified MikroTik RouterOS router actions above. |
| CiscoCatalyst 9800 wireless controller (RESTCONF)Setup guide | Clients and access points, read only | End a client session; there is no lasting block | RESTCONF over HTTPS, a dedicated local user | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | New in 4.4. Never run against a real controller. |
| OPNsenseOPNsense firewallsSetup guide | Its own state, read back after each action (not used for discovery) | Host block (firewall alias you created); flow block, quarantine, end sessions | API key and secret | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real OPNsense. |
| SonicWallSonicOS 7 (Gen7) firewallsSetup guide | Its own state, read back after each action (not used for discovery) | Block device (address group); quarantine | SonicOS API, basic authentication | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | SonicOS Gen6 is not implemented. |
| WatchGuardFirebox (Fireware 12.5.3 or later)Setup guide | Its own state, read back after each action (not used for discovery) | Block (blocked sites) | WatchGuard Cloud API key | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real account or Firebox. |
| Check PointSecurity Management Server (Management API)Setup guide | Its own state, read back after each action (not used for discovery) | Block device (address group); quarantine; flow block | Management API key | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real Management Server. |
| JuniperSRX firewallsSetup guide | Its own state, read back after each action (not used for discovery) | Host block (address set); flow block, quarantine, end sessions | NETCONF over SSH (the host’s ssh program) | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real SRX. |
| CiscoASASetup guide | Its own state, read back after each action (not used for discovery) | Block through an object group you created | SSH | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real ASA. |
| CiscoMeraki (cloud dashboard)Setup guide | New in 4.3, read only and Experimental: the clients the dashboard sees, on the map. Its own state is read back after each action. | Client policy “Blocked”; quarantine by group policy; switch port off | Dashboard API key | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real organization. |
| RADIUSCoA and Disconnect (RFC 5176), vendor-neutralSetup guide | — | End a session through the access device that authenticated it | RADIUS shared secret | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | A protocol, not a product: never run against a real controller, switch or RADIUS server. |
| VMwareNSX-T 3.x and 4.x (Policy API)Setup guide | Its own state, read back after each action (not used for discovery) | Host block (distributed-firewall group); quarantine, flow block | NSX Manager, basic authentication | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Single Local Manager only, no Federation. |
| MicrosoftAzure network security groupsSetup guide | Its own state, read back after each action (not used for discovery) | Quarantine a VM (NSG swap); host block; flow block | Service principal (client secret) | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real subscription. |
| MicrosoftHyper-VSetup guide | Its own state, read back after each action (not used for discovery) | Isolate a VM (network adapter ACL); flow block, quarantine VLAN, disconnect | WinRM | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real Hyper-V host. |
| ProxmoxProxmox VESetup guide | Its own state, read back after each action (not used for discovery) | Isolate a guest (guest firewall); flow block, quarantine, link down | API token | ExperimentalExperimental. Tested only against a simulated device in DENIS’s own tests; not validated on real equipment. Every action needs lab use switched on by an administrator. | Never run against a real cluster. |
Generic protocol support
Support for a protocol or a format, not for a particular product. A product that speaks these is not thereby tested with DENIS.
| Protocol or format | What DENIS does with it | Status |
|---|---|---|
| Mirror (SPAN) port, network tap, RSPAN | Packet capture on one or more capture-only interfaces next to the discovery interface. | Supported. Where you mirror decides what DENIS sees; since 4.3 duplicate packets from SPAN or TAP copies can be counted or removed. |
| ERSPAN, GRE, VXLAN and Geneve mirrors | Tunnelled mirrors (for example cloud traffic mirroring) are unwrapped and read like a local mirror. Opt-in. | Tested on hand-built frames and public sample captures only, not yet on real switches or cloud mirrors. |
| LLDP, CDP, PROFINET DCP, EtherNet/IP ListIdentity, BACnet I-Am | Read passively to identify devices and neighbours. | Supported. |
| Industrial protocols | Modbus/TCP, S7comm, S7comm-plus, EtherNet/IP-CIP, DNP3, BACnet/IP, OPC UA, IEC 60870-5-104, IEC 61850, PROFINET IO, Omron FINS, MQTT, CoAP; HART-IP, KNXnet/IP and CODESYS recognised. | Decoders checked against real captures of each protocol; not yet run on live traffic at a real industrial site. |
| SNMPv2c and SNMPv3 (read) | Switch ports, neighbours and forwarding tables from standard tables. | Tested on the switches listed above only. |
| Export: syslog (CEF, LEEF, JSON), Elasticsearch/OpenSearch (ECS), OpenObserve, Prometheus, REST API | DENIS sends its alerts, findings and audit events to your tools. | Supported; not every target has been run against a real installation. |
| Notifications: e-mail, Slack, Microsoft Teams, Discord, PagerDuty, Pushover, ntfy, Jira, ServiceNow, signed webhooks | Alerts and notices to people and ticket systems. | Supported; Jira and ServiceNow not yet run against a real endpoint. |
| Context import: Entra ID, Intune, Active Directory, Jamf Pro, Azure, AWS, Google Cloud, Nessus and Tenable.io | Read-only context next to what DENIS observed; never overrides it. | Not yet verified against real tenants. |
| Sign-in: OpenID Connect, passkeys, authenticator apps | Single sign-on and second factors for the console. | Supported; passkeys are among the deployment options not yet verified in every setup. |
Planned Not in 4.4.3
On the roadmap, without dates. None of it is available yet.
- A block through DENIS on a wired TP-Link Omada client, further MikroTik Wi-Fi checks, Cisco Catalyst 9800, Meraki and Azure on real equipment or real accounts, and the Experimental label coming off whatever then passes
- Other wireless controllers
- 802.1X and RADIUS accounting as a data source
- Further EDR and MDM imports
- Blocking by domain or URL
Help verify more equipment
Verifying hardware takes time, and nobody owns every device. If you run one of the experimental products, a report of what worked and what did not is one of the most useful contributions you can make.