Demo and evaluation
See DPLens on your Windows logs, or test it on your own host.
Two ways to start. Book a demo built around your sources, your SIEM and your numbers, or ask for an evaluation licence and install the agent yourself.
- Windows Server 2016–2025
- Windows 10 and 11
- x64
- Offline licensing
In short
Book a demo if you want to see DPLens collect from Windows, drop noisy Event IDs before they reach your SIEM and deliver to Splunk or a syslog SIEM, with the savings worked out on your figures. Request an evaluation licence if you would rather install it on a test machine yourself. The licence is verified offline, so an air-gapped evaluation works the same way.
Choose a path
Talk it through, or try it yourself
A
A short demo
For security leads, SIEM owners and anyone building a business case. We work from your sources and your SIEM, and finish with the savings model on your own ingest figures.
Book a demo →B
An evaluation licence
For engineers who want to test on one host before talking to anyone. We arrange an evaluation licence with you, and the documentation takes you from install to events at your SIEM.
Request an evaluation licence →Book a demo
What we will cover
Tell us a little about your estate and where your logs go. We use it to build the demo around your situation rather than a generic tour.
Your sources
Which Windows Event Log channels, Sysmon, log files, syslog devices or NetFlow you collect today, and what the Recommendations scan suggests for a machine like yours.
A live filter on noisy Event IDs
A filter rule on high-volume Security events such as Event ID 4662 or 5156, with the pipeline funnel showing what the rule removed. Every drop is counted and attributed to the rule that made it.
Delivery to your SIEM
Cooked S2S on 9997 or HTTP Event Collector (HEC) on 8088 for Splunk, or syslog, Snare or NDJSON for QRadar, Securonix, Devo, Secureworks Taegis and other syslog or JSON SIEMs, with disk-backed caching, failover and TLS. Or OTLP over HTTP to an OpenTelemetry Collector.
The savings model, with your numbers
Your daily ingest and your cost per gigabyte, run through the same model as our savings calculator.
We reply by email to agree a time. If you would like a technical follow-up, an evaluation licence or a partner to work with in your region, say so in the form.
Evaluation licence
Test DPLens on your own host
Install DPLens on a test machine, point it at a test destination and see what it does to your own event volume, without a sales call first.
Request a licence
Tell us how many hosts and which Windows versions you want to test, and whether the machines are air-gapped.
We send what you need
We reply by email and arrange an evaluation licence that fits the hosts you want to test, along with the download and documentation links.
Verify and install
Check the download against its published checksums and Authenticode signature, then install the MSI. It needs no internet access, so the same steps work on an isolated network.
Your first hour
Follow Your first hour: apply the licence, add a Windows Event Log source and a destination, and watch events flow.
DPLens 1.0 runs on 64-bit Windows: Windows Server 2025, 2022, 2019 and 2016, and Windows 11 and 10. The documented provisioning allowances are about 30 MB for the program, 1 GB of working state plus the disk cache, and 150 MB of memory. The console uses port 8443 and is reachable from the machine itself by default; no other port opens until you configure it. The full list is in Requirements. To see central configuration and fleet health across several hosts, ask us about DPLens Manager, included in every subscription.
You can install and configure DPLens before the licence arrives, and collection starts as soon as you apply it. The console warns 30 days before an evaluation licence expires, with 7 days' grace after. See Licensing.
Read before you install
In the documentation
FAQ
Questions before you book
Can I evaluate DPLens on an air-gapped network?
Yes. The licence is verified offline with no licensing service, and DPLens has no telemetry, so it needs no internet access. DPLens Manager is air-gap capable too. Tick the air-gapped box and we will send everything you need to carry across. See air-gapped log collection.
Do I need a Splunk or SIEM instance to evaluate?
You need somewhere to send events, such as a test Splunk indexer or any syslog receiver. The console's live stream then shows each event exactly as that destination receives it, and the Overview funnel shows how many events each pipeline stage removed.
What does DPLens cost?
DPLens is licensed per agent and per network source (each syslog or NetFlow receiver), with no per-GB ingestion cost. See pricing, or ask in the demo.
Can I buy through a partner?
DPLens is building a partner network in every region. Mention your preferred partner or region in the form, or see the partner programme.