BlueCat Edge’s ability to detect DNS threats and identify malicious queries comes in quite handy. We can keep track of the low or minor things. It has even helped us track down misconfiguration, which was great. We have had some situations where we had to take corrective action on malicious intent going outward. For example, we had a particular machine going to a malicious site at 2 AM, and we had to take that proactive or automatic action to stop it from going there. We can deny them the ability to even connect. A lot of companies use what is called web content filtering. They want to prevent you from going to certain websites. For example, on your work machine, you want to go to playboy.com. Your machine makes the DNS call, gets the IP address, and attempts to make that connection to that website. The web content filtering at that point will jump in and say, "Hey. You are trying to go somewhere that you are not supposed to be going to." It blocks you. It happens very fast. When you make the DNS request to find out where playboy.com is located, before you even get the DNS response to try and connect to the site, you are blocked. It happens at a level much faster than web content filtering because in some cases, when you try to connect, you might even get a payload that comes down to you before your web content filtering kicks in. BlueCat Edge offers provider-agnostic DNS discovery and resolution across multiple cloud environments. We are using it because routing DNS traffic is critical to the operations of our business. We have the ability to define rule sets and be able to say that this traffic is destined for Cloud A and then we are going to forward that over there. When a request comes in for Cloud B, we are going to set it over there. If a request is for something on-prem in our data center, it is going to get routed over there. I love that ability of BlueCat Edge. It has made our life very easy. We use the Security Dashboard, and we have the ability to see things. We also have CrowdStrike features turned on, so we get to see some things that are flowing, such as DGA. We have threat protection turned on. We have DGA and top-level DTLD that you are not supposed to go to. We could have that visibility at a finite level, which is great. This visibility from the Security Dashboard has helped save time when not only troubleshooting but also with any configuration issues. If there is a configuration issue, we have to go look and figure out a fix for that configuration issue that we created accidentally. In terms of securing our infrastructure from end to end so that we can detect and remediate threats, we do get the flags that are thrown as soon as something comes up from something within our internal network. The DNS queries are immediately dumped to our SIEM solution in our security team's purview where they could immediately take action. We also have some of the automations turned on to generate emergency tickets to the appropriate team. It makes life so much easier. BlueCat Edge has probably reduced our threat risk by 50% to 60%.
