What is DPLens?
DPLens is a UK-built, self-hosted, distributed security data pipeline at the edge for SOCs and MSSPs, delivered as a log collection agent for Windows. It processes, masks and reduces event logs, files, file integrity, syslog and NetFlow on your own machines, then delivers to Splunk, OpenTelemetry (OTLP) or any syslog or JSON SIEM. Licensing is per agent and per network source, with no ingestion pricing.
Distributed pipeline at the edge
Manage centrally. Process at the edge.
A central processing tier means servers you size, patch and keep available, and data crosses them before it is filtered or masked. DPLens moves that work into every Windows agent, so there is no central processing server to build or run. DPLens Manager, included in every subscription, manages the agents centrally.
The work moves to the host, so the agent has to earn its place there. The DPLens agent is highly optimised: in our lab benchmark it delivered more than 30× the throughput, at about a tenth of the CPU per event, of the popular free and paid Windows agents we tested. Lab figures, not a guarantee. Request an evaluation licence and measure DPLens on your own servers, with your own pipeline rules.
Get started
Start from your team, or from the job in front of you.
Every way in leads to the same place: a complete pipeline at the edge. Replace a Splunk Universal Forwarder or Snare agent and cut what reaches the SIEM, and the same agent then takes on file integrity monitoring, masking of personal data and air-gapped collection.
For SOCs
A pipeline you can account for, with no tier to run
A complete pipeline in the Windows agent and no processing tier to size or patch. Every drop is counted, so you can reduce what reaches the SIEM and still show what went.
DPLens for SOCsFor MSSPs
A pipeline in each customer's estate
Events are processed on each customer's own machines. DPLens Manager manages the agents centrally, and the licence follows agents and network sources, not a customer's log volume.
DPLens for MSSPsOr start with the agent you run today
Replace the UF
Splunk Universal Forwarder replacement
Deliver to your indexers over cooked S2S or HEC with the index and sourcetype your searches expect, and filter noisy events on the host before they count against your ingest licence.
Plan a UF replacementReplace Snare
Snare agent replacement
Send Snare-format records to the collector you already run, over TCP or TLS with disk-backed delivery, with filtering on the host to cut volume.
Plan a Snare replacementWeigh it up
Compare DPLens
Side-by-side, dated and sourced comparisons with the forwarders, agents and pipelines teams most often weigh up against DPLens.
See the comparisonsOr start from the job
Windows Event Log collection
Security, System, Sysmon and custom channels, filtered by Event ID at the source.
SIEM cost reduction
Filter, aggregate and rate-limit on the host, with every drop counted.
File integrity monitoring
Scheduled change detection that supports PCI DSS v4.0.1 Requirement 11.5.2.
PII masking and redaction
Mask card numbers, email addresses and UK National Insurance numbers before anything is cached or sent.
Air-gapped log collection
Offline signed licence keys, no telemetry and no licensing service.
All solutions
Every job DPLens does, on one page.
Integrations
Collect once. Send anywhere.
DPLens collects from your Windows hosts and the devices around them, then delivers to the SIEM you already run. Send to one destination or several, and switch later with a configuration change, not a new agent rollout.
Collect from
Send to
DPLens Manager
Central management, included.
Manage centrally. Process at the edge. DPLens Manager manages your agents and does not process your data, because the pipeline stays in every agent. It is included in every DPLens subscription.
Every DPLens subscription includes support 9am to 5pm UK time, Monday to Friday. Enhanced support is available as a paid option.
Central configuration
Manage the configuration of every DPLens agent centrally, rather than machine by machine.
Fleet health monitoring
Watch the health of every DPLens agent across your estate.
Deployment and upgrades
Deploy DPLens agents and keep them up to date across the fleet.
Self-hosted and air-gap capable
Runs on your infrastructure, including air-gapped networks, with no vendor cloud involved.
Multi-tenant environments
Whether you run one estate or many customers' estates, DPLens Manager has full support for multi-tenant environments.
A solution you can trust.
A pipeline in every agent means the agent has to be trustworthy, because it runs on the machines that matter most, with access to their logs. Signed releases, SBOMs, no call-home, least privilege and a tamper-evident audit trail let your security team verify it for themselves.
Signed, verifiable releases
Every full release is Authenticode-signed and published with SHA-256 checksums, so you can verify a package before it reaches a server.
SBOMs with every release
CycloneDX and SPDX software bills of materials ship with every release, ready for your software composition analysis and CVE triage.
Secure by design
Engineered for security from the first line of code, because an agent on your most important servers has to be.
Runs entirely on your infrastructure
Nothing calls home: no telemetry, no licensing service, no auto-update and no vendor control plane. Licence keys are verified offline, so an air-gapped machine is a normal deployment.
Tamper-evident audit trail
Sign-ins, configuration changes and rollbacks, and licence and masking-policy changes are recorded in an append-only audit trail, so any alteration is detectable.
Least privilege
DPLens holds only the rights it needs to collect and deliver your logs.
Compliance and regulation
Supports the frameworks you answer to.
DPLens helps you evidence collection completeness, integrity monitoring, data minimisation and residency. Meeting each control remains your responsibility.
We're looking for partners and resellers, worldwide.
Resellers, distributors, MSSPs, integrators and technology partners in every region. DPLens puts a complete pipeline in every Windows agent, with no processing tier to run and no ingestion pricing, and DPLens Manager is included in every subscription. It is an easy addition to what you already sell.
See what a pipeline at the edge does for your SOC or MSSP.
Book a demo built around your own sources and SIEM, and see DPLens Manager for yourself. Or request an evaluation licence and measure DPLens on a Windows host of your own, with your own pipeline rules. No ingestion pricing: licensed per agent and per network source.