In plain words
What DENIS does for you, in plain words.
This page is for the person who owns the business or runs the office, not for the network engineer. It says what DENIS watches, what it tells you, what you are asked to do and, just as important, what it does not do. Every technical detail is on the pages linked at the bottom.
The short version
A quiet observer that knows what belongs on your network.
Think of a receptionist who knows every person who normally walks through the door, notices a stranger, and tells you. DENIS does the same for the devices on your network: it learns who and what is normally there, notices what is new or different, and tells you in everyday language.
Every device that is connected
Computers, phones, printers, cameras, door controllers, smart TVs, servers, industrial machines. If it is plugged into the network or on its Wi-Fi, DENIS notices it, usually without anyone telling it first.
What each one probably is
DENIS guesses the maker and the kind of device from the signals the device gives off, and shows the reasons for its guess, so you can see why it thinks a box is a printer.
Who talks to whom
Which devices exchange data with which others, and with which places on the internet, how much, and at what time of day.
What is normal for each one
After a learning period (24 hours by default) DENIS knows the usual habits of each device, so it can tell when one starts behaving differently.
What it catches
Five kinds of trouble, and what each one looks like.
These are examples of the situations DENIS is built to notice. Each one comes with the same two questions answered: what did we see, and what are you asked to do.
-
A device appears that nobody knows
What DENIS sees. A new, unfamiliar device joins the network: a visitor’s laptop, a plug-in someone brought from home, or something that should not be there at all.
What you are asked to do. Decide if you recognise it. If you do, confirm it and note who owns it. If you do not, ask around, and ask whoever looks after your IT to check it.
-
A device starts behaving strangely
What DENIS sees. A device that normally talks to one or two places suddenly talks to many, sends far more data than usual, or is active at 3 a.m. when the office is empty.
What you are asked to do. Read the plain-language explanation on the alert. It says what happened, when it is probably harmless, and what to do first. Often the answer is a quick question to a colleague.
-
A camera or printer talks where it should not
What DENIS sees. A camera, a printer or a smart gadget reaches out to the internet or to your file server in a way that it never did before. These devices rarely get security updates, so they are a favourite hiding place.
What you are asked to do. Check whether someone changed something. If not, ask your IT support to isolate or update the device. DENIS shows what it talked to, so you can describe the problem exactly.
-
Someone on the internet connects to one of your devices
What DENIS sees. A device such as a solar inverter, a camera or a storage box is reachable from the internet, for example because a router forwards a port to it, and someone out there opens a connection to it.
What you are asked to do. Check whether that device should be reachable from the internet at all. If not, ask whoever looks after your router to remove the forwarding. DENIS shows where the connection came from, which port it used and whether other devices were reached. If it is expected, mark that port as expected for the device.
-
Industrial equipment is told to do something unusual
What DENIS sees. On a factory, plant or building-controls network, DENIS listens to a copy of the traffic. It notices when a controller is told to stop, restart or take a new program, or when a machine that should only be read is suddenly written to.
What you are asked to do. Contact the engineer or operator responsible for that machine and ask whether this was planned. DENIS only listens on these networks. It never sends commands to the equipment.
When something happens
You are never handed a wall of codes.
- 1
Something is noticed
DENIS raises an alert and gives it a score from 0 to 100. Every point of the score has a named reason.
- 2
You are told, in words
The alert explains what happened, what happens if it is ignored, when it is safe to ignore, and what to do. You can receive it by e-mail or in chat tools such as Slack or Microsoft Teams, or just look in the console.
- 3
You decide
Confirm a device you know, mark something as expected so it stops asking, pass it to the person who looks after IT, or leave it open until someone has time. Related alerts are grouped into one incident so you are not buried.
New in 4.4.3
What changed in version 4.4.3, in plain words.
It knows where a device is
When you decide to block or isolate a device, DENIS shows where that device is plugged in and which firewall is on its path, and says exactly what the action will and will not cover. If it is not sure, it says so instead of guessing.
It shows how your equipment is wired
The map shows the cables between switches, firewalls and access points, each marked as confirmed, a best guess or set by hand, and an Equipment page lists each device once.
It tells you what needs you
A notification bell lists what you should know, and the messages name the device, so you do not have to look it up.
It can prepare a response for you
A detection rule can prepare a block that an administrator approves with one click. Blocking by itself is experimental, off by default and starts with a trial of at least 7 days in which nothing is blocked.
It is quieter on your other security tools
You can switch off the port scan and the ping, for the whole network or for one part of it, and a documentation page explains exactly what DENIS sends, so your security team is not surprised.
It keeps itself up to date
Security updates install automatically unless you switch that off, after the same checks as a manual update and with a backup and automatic rollback.
Honest limits
What DENIS does not do.
- It is not an antivirus. It does not scan files or remove viruses from computers. It does not replace the protection on your laptops and servers.
- It does not install anything on your devices. It watches the network from the side, so it cannot see inside a computer, and it cannot read encrypted traffic.
- It does not guarantee that nothing bad happens. It shows you what is on the network and what changed, so that you can notice problems sooner.
- It cannot decide for you. Somebody has to read an alert, judge whether it makes sense for your business, and act. DENIS only makes that job shorter.
- It does not block or change anything by itself unless you set it up to. Optional actions that block a device or a connection, quarantine a device or switch off a network port exist, but they are off until an administrator turns them on, and by default each one needs an administrator’s decision and password. Letting a rule act by itself is experimental. The supported switches, firewalls and controllers have setup guides in the documentation. Letting your own rules or Autopilot (the “Protect Me” button) block by themselves is a separate, even more experimental choice, off by default and always time-limited. Autopilot starts by only showing what it would do, and it can miss real threats. Do not rely on any of this as protection.
- It has not yet been independently verified by a third party, and it has not yet been run on live traffic from a real industrial site. Plan a trial period first.
Who it is for
Three kinds of reader.
A small business
You have no security team, maybe an IT person for a few hours a week. DENIS gives you one screen that shows what is connected, plus plain alerts when something changes.
An IT service provider serving many customers
One installation can keep each customer separate, with their own users, settings and records. Small collectors at customer sites report to one central console. New and experimental since 4.1: a provider can open a customer’s own DENIS remotely, only as far as the customer allows, and the customer can disconnect it with one click.
A factory, plant or building with industrial equipment
DENIS listens to a copy of the traffic and never talks to the machines, so it is safe to put next to equipment that dislikes surprises.
What it costs to run
One small machine, and someone to read the alerts.
- One computer you already control. DENIS is a single program that runs on a Linux server, a small single-board computer such as a Raspberry Pi, or a Mac. There is no database server to add.
- Nothing on your devices. No software has to be installed on laptops, phones or machines.
- No DENIS cloud. Your data stays in one file on that machine. DENIS has no telemetry and no monthly cloud subscription to a DENIS service.
- Placement matters. The machine must be connected where it can see the traffic you care about, and each additional site needs its own small collector.
The honest cost is time: someone has to install it, look at the first alerts and tune what is normal. You can try it without touching your network by loading the built-in demo, a fictional company, in a couple of minutes.
Second layer
Want the technical detail?
The technical pages are unchanged. They show exactly how DENIS decides, what it decodes and how it protects itself.
How it works, in full
Where DENIS is connected, what it sees from there, and the pipeline from packets to explainable alerts. Every feature, with screenshots.
Security and trust
What data DENIS keeps, what it sends out, how releases are signed, and an honest list of what is verified.
Documentation
Quick start, console tour, detection rules, alerting, industrial networks and deployment. Start with the quick start.