BlueCat Threat Protection leverages DNS to identify and block malicious content, providing an additional layer of defense against external threats and lateral movement of infected devices. It integrates with threat intelligence feeds such as CrowdStrike to deliver real-time updates, enabling automated blocking of emerging threats. The solution offers features like DNS query blocking, visibility into DNS traffic, and reporting capabilities to identify devices accessing malicious content. It also supports integration with security information and event management (SIEM) systems for enhanced threat correlation and response. Additionally, it includes capabilities to block DNS over HTTPS (DoH) resolvers, ensuring visibility into encrypted DNS queries, and provides identity-based security to link DNS behavior to specific users. The solution extends defense-in-depth strategies by augmenting traditional security layers with DNS-based threat protection.
