In this article, you will learn everything you need to know about the DNS Security - Endpoint module. DNS Security - Endpoint is based on the DarkLayer Guard engine, the world’s most advanced endpoint DNS threat hunting tool, and boasts our Threat to Process Correlation technology, allowing you to spot processes, users, URLs, and attacker origins used to infiltrate your network. DNS Security - Endpoint makes the DarkLayer Guard - Endpoint work in tandem with our VectorN Detection AI-based traffic pattern recognition engine to also give you HIPS/HIDS and IOA/IOC capabilities and spot hidden malware, completely autonomous of code and signatures.
1. Description
2. How does DarkLayer Guard - Endpoint work?
3. DNS Security - Endpoint view
4. DNS Security - Endpoint settings
DESCRIPTION
DNS Security - Endpoint is responsible for filtering all network packets based on the DNS request origin and destination. It replaces the manual or DHCP-set DNS values with IP Addresses from the Client Host IP Address range, thus effectively telling the computers to resolve the DNS requests themselves. The original DNS values from the network card settings are not lost but are saved under GUIDs in the Windows Registry and used when DNS requests are made towards internal resources (print servers, local file servers, or anything that has a private IP Address assigned) or external resources. The traffic filtering engine blocks malicious packets from communicating across the network, prevents man-in-the-browser attacks, detects zero-hour exploits, protects from data or financial exfiltration, and prevents data loss or network infections.
- Here is an example of how DarkLayer Guard's multi-layered protection works against malware, social engineering scams, and drive-by attacks:
DNS Security - Endpoint blocks malicious websites by making sure that users do not establish untrusted connections. If a connection is made, an attacker is able to open backdoors into a PC by using zero-day exploits or by executing remote shellcodes. The module also makes sure that data is not automatically filled into online forms belonging to fraudulent websites.
- An example of how DNS Security - Endpoint protects users from financially exploiting malware (banking trojans) can be seen below:
The DarkLayer Guard - Endpoint filter receives more than 800.000 new weekly updates to keep up with cybercriminals’ threats. A filter update is provided every 2 hours. The update is based on a wide range of data, such as newly registered domain names, reverse engineering of advanced malware, monitoring of criminal network sinkholes, and data gathered during e-crime analysis. This insight into cybercrime enables Heimdal to block data from a PC or network from being sent to a hacker-controlled server, therefore protecting corporate or personal data from exfiltration.
Heimdal does not share a full repository of the DNS detections due to the tremendous data volume of the AI Predictive DNS, VirusTotal will not necessarily show the Heimdal detection. You will have to rely on the Investigate mode in the Heimdal Dashboard.
HOW DOES DARKLAYER GUARD WORK?
On macOS, when DNS Security - Endpoint is enabled, the DarkLayer Guard - Endpoint engine creates a local DNS Server that acts as a filtering engine before resolving the user's DNS Query. The DarkLayer Guard DNS Server hijacks the DNS IP Address on the active Network Adapter(s) to scan for malicious websites and other web locations (servers, online ads, etc.) that can potentially install malware or be used as gateways for cyberattacks.
Once the DNS IP Address is set, every web location you access via the Internet will be processed through a database that is set locally in the HEIMDAL Agent installation path. This database is about 15 MB in size, and 95% of the websites blocked are located here.
If the website is identified as being infected, the DarkLayer Guard - Endpoint engine will block it, and you will see this block page (in the browser):
Additionally, if you perform nslookup on a malicious domain, the resolving IP Address will be tpeblockserver.trafficmanager.net / 20.86.55.232 (our HEIMDAL Security block page). If the website is not blocked after being processed through the local database, it will pass, but there is a second step. The website will be parsed through another database, in the cloud (about 6GB in size), where it will be checked again. If it’s found to be malicious, DarkLayer Guard - Endpoint will block it. If it’s safe, you’ll just be able to access the website normally.
Note: All this filtering process takes place in milliseconds and will not affect your internet connection speed.
DNS Security - Endpoint view
The DNS Security - Endpoint product page is a unified view that displays all the information collected by the HEIMDAL Agent that is running on the endpoints in your organization (on both Windows and macOS devices). The collected information refers to the DNS queries that are filtered by the HEIMDAL Agent's DarkLayer Guard engine. At the top, you see a statistic regarding the number of Analyzed Traffic Requests, the number of Prevented Attacks, the percentage of Prevented Attacks, and the number of Category Blocks. You can navigate between multiple pre-filtered views to quickly and easily access the information that you need to process to analyze and remediate potential vulnerabilities.
The DNS Security - Endpoint comes with macOS features that are similar to the ones found on the HEIMDAL Agent for Windows. However, not all Windows features are yet supported on macOS.
The collected information is placed in the following views: Standard, Threat Type, Hostname/Latest Threats, TTPC, Category Blocks, and Full Logging.
-
Standard
The details displayed in the Standard view table are the following: Hostname, Username, IP Address, Analyzed Requests, Prevented Attacks, and Risk Level. The Standard view is a complete overview of the total analyzed requests and prevented attacks, as well as a pre-calculated risk level for your device. All entries are identified by hostname, username, and IP address. The calculated risk score is based on the time frame selected in the HEIMDAL Dashboard and offers a great way to visualize and measure the impact of your awareness training and security procedures that you facilitate in your organization, as you can track the changes in your high-risk users' behavior over time.
The Analyzed Requests represent the total DNS requests intercepted by the HEIMDAL Agent (whether they are blocked or allowed). The Prevent Attacks represent the DNS requests that are blocked by the HEIMDAL Agent, while the Allowed requests represent the DNS requests that are allowed (whitelisted). -
Threat Type
This view displays a table with the following details: Threat Type, Number of matches, Most Targeted Hostname, and Username. The Threat Type view has all entries sorted into types of threats and the number of times the specific threat type is seen in your environment. You also get quick visibility over the host and user who has been targeted the most by the mentioned threat type. This can be used to gain a quick overview of the severity of threats currently encountered and will greatly help a security team prioritize their high-level remediation efforts. -
Hostname/Threats
This view displays a table with the following details: Hostname, Username, Domain Blocked, Threat Type, and Number of matches. The Hostname/Threats view is broken down into individual threats on specific hosts, including the associated Domain Name and the number of times that DarkLayer Guard has blocked the threat on that Host and User. This can be used to gain a detailed visualization of which devices are currently the most targeted and offer a security team direct insights into what devices they need to focus on protecting first. -
Latest Threats
This view displays a table with the following details: Hostname, Username, Threat Type, Threat Source, TTPC, and Date. The Latest Threats view offers detailed information about each block that has been performed by DarkLayer guard, including Threat Type, associated Domain name, and Process correlation captured on the affected host. This information is prefiltered by time and date, and is the place to get a real-time view of what is currently happening in the environment, as the latest attacks are inserted at the top of the page. -
TTPC
The TTPC or Threat To Process Correlation feature is currently supported on Windows only.
Category Blocks
The Category Blocks feature is currently supported on Windows only. -
Full Logging
The Full Logging feature is currently supported on Windows only.
The Domain view displays a table with the following details: Domain and the Total Hits. -
Investigate
This view allows you to get DNS-related statistics on any domain you input in the search field. The view is split into 3 subsections:
a. Global Threat Intelligence - displays a top 3 of most accessing processes, the DNS-E matches (the number of times, in the selected timeframe, the domain has been intercepted via DNS-E), the Global DNS-E matches (the number of times, in the selected timeframe, the domain has been intercepted by DNS-E in the Global Heimdal Security database), the domains/URLs related to the same IP Address, the DNS-E + DNS-N matches (the number of times, in the selected timeframe, the domain has been intercepted by DNS-E and DNS-N), the Global DNS-E + DNS-N matches (the number of times, in the selected timeframe, the domain has been intercepted by DNS-E and DNS-N in the Global Heimdal Security database).
b. Predictive DNS Score - displays a maliciousness score based on an Artificial Intelligence algorithm (ranging from 0 to 100) that is corroborated with the presence of the domain (in question) on the DNS Security Endpoint blocklist (blocklist match). The higher the score, the higher the probability that the domain in question is infected. The Predictive DNS Score will showcase a Risk Level (None, Low, Medium, High, Critical) based on the above-mentioned score.
c. DNS Statistics - displays a graphical representation of the daily number of hits for the chosen domain (the blue
the line shows that the queried domain was found clean at the time of the query, while the red line shows that the queried domain was found infected at the time of the query.
d. Requester distribution - displays a map and statistics of the top public IP Addresses that called the domain in question (the origin of the DNS query to the domain in question). -
CASB
The CASB feature is currently supported on Windows only.
The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode corresponding to each view.
The Filters functionality allows you to filter entries by Operating System.
DNS SECURITY - ENDPOINT settings
The Heimdal Agent includes DarkLayer Guard™, a DNS filtering engine that protects your computers from accessing malicious domains and URLs by analyzing communication patterns in your outgoing and incoming internet traffic.
DarkLayer Guard™
DarkLayer Guard - enables or disables the DarkLayer Guard DNS filtering engine on the endpoint.
General Settings
Vector - identifies both known and undiscovered malware attacks by analyzing communication patterns in your outgoing and incoming internet traffic.
Check Interval - adjusts the interval DarkLayer Guard uses to automatically check for new definitions in the filtering database.
Compatibility Settings
Pause DarkLayer Guard when Cisco Secure Endpoint connector is detected - automatically pauses DarkLayer Guard when an active Cisco AnyConnect or Fortinet VPN adapter is detected, preventing network compatibility issues. DNS filtering automatically resumes after disconnecting from the VPN.
Force DHCP DNS usage - ensures DarkLayer Guard filtering operates directly on top of your network DHCP-assigned DNS settings. This is recommended for environments using specific VPN services that reset the DNS settings on the network interface after disconnection. If DarkLayer Guard fails to add the required DNS loopback addresses, the system reverts to automatic DHCP DNS. By default, this option is disabled, and DarkLayer Guard should work on any computer type.
This option is NOT recommended if you use:
- Static DNS IP addresses on your network interface
- Domain Controller or DNS Server machines
Content Filtering Settings
Allowlist - provides granular control over network access by defining exceptions to DarkLayer Guard interceptions. Any domain explicitly added to the allowlist bypasses DarkLayer Guard filtering. You can add individual domains, subdomains, top-level domains (.com, .co.uk, etc.), or multiple domains at once by uploading a CSV file (domains must be comma-delimited and listed on the same row). A sample CSV template is available for download.
Blocklist - enables you to prohibit access to specific domains explicitly. Any domain added to the blocklist is blocked by DarkLayer Guard, preventing access to endpoints regardless of Heimdal's threat detection. You can add individual domains, subdomains, top-level domains (.com, .co.uk, etc.), or multiple domains at once by uploading a CSV file (domains must be comma-delimited and listed on the same row). A sample CSV template is available for download.Custom Block Pages - customize the page displayed to end users when DarkLayer Guard blocks a domain. You can upload a custom HTML block page file, set an organization name, customize the block page message, and import a logo file (image). When you import a new logo, the old custom HTML block page is removed.
Install Block Page Certificate - automatically installs the certificate required for block pages to work on the |HTTPS rotocol across all machines in the endpoint group. This enables users to see custom block pages for both HTTP and HTTPS blocked domains.
IMPORTANT
Do not use the DarkLayer Guard™ engine in combination with another DNS traffic scanning application, as they may conflict with each other and neither will function correctly. Disable other traffic scanning applications installed locally before enabling Heimdal's DarkLayer Guard engine.