For managed security service providers
A distributed pipeline at the edge for every customer you run
DPLens puts a complete security data pipeline in every Windows agent, so each customer's data is processed on their own machines before it leaves their network, and sent only where you choose. You manage it centrally, with full support for multi-tenant environments and no ingestion pricing.
- Windows Server 2016–2025
- Windows 10 and 11
- x64
- Multi-tenant environments
- No ingestion pricing
- Any SIEM that accepts syslog or JSON
In short
DPLens is a UK-built, self-hosted, distributed security data pipeline at the edge for SOCs and MSSPs, delivered as a log collection agent for Windows. MSSPs use it to run collection for many customers with no processing infrastructure per customer: every agent is a complete pipeline, so each customer's data is processed on that customer's own machines. DPLens Manager, included in every subscription, manages the agents centrally, and licensing is per agent and per network source, with no ingestion pricing.
Onboarding
How do I onboard a customer without building infrastructure for them?
There is no collector tier to size, host or patch for each new customer. The pipeline arrives with the agent, on Windows machines the customer already has. How a distributed pipeline compares with a central tier.
Set up a reference machine
Configure one Windows machine with the customer's sources, filter and masking rules, and destinations. Check the result on Live stream.
Package it
Build a deployment package from that machine. It carries the configuration, with secrets encrypted.
Roll it out
Deploy with DPLens Manager, or through the tools the customer already approves: Group Policy, Intune, Configuration Manager or an RMM.
Bring in network sources
Point firewalls and other devices at a syslog or NetFlow/IPFIX receiver on a DPLens agent. One receiver taking events from 500 firewalls is one network source.
Run it centrally
Central configuration, fleet health monitoring, and upgrades through DPLens Manager.
No ingestion pricing
What happens to my cost when a customer's data volume grows?
Nothing changes on the DPLens side. Licensing is per agent and per network source, with no per-GB ingestion cost, so your cost follows the estate you manage, and a customer's event rate does not move it.
01
Predictable on fixed-fee contracts
A noisy month at one customer does not change what the agent costs. Neither does onboarding a new channel for them.
02
No tier on your cost base
With no central processing servers per customer, there is less infrastructure to host, patch and keep resilient across your book.
03
Reduction you can show
A separate saving: filtering lowers what reaches the SIEM. If you carry the SIEM cost, that protects your margin. If your customer does, it is a saving you can show them: set a cost per gigabyte and the console values the reduction.
Data sovereignty
Where is my customers' data processed?
On their own machines. Each customer's data is filtered, masked and reduced on that customer's own machines before it leaves the customer's network, and sent only where you choose. There is no shared DPLens processing tier for events to pass through, because the pipeline runs in the agent.
- Masked before it is stored or sent. Card numbers, email and IP addresses, UK National Insurance numbers and your own patterns are redacted, partially masked, tokenised or hashed before anything is written to the disk cache or sent.
- Delivered only where you configure. Events go only to the destinations you configure: the customer's own SIEM, the platform you run for them, or both.
- No vendor cloud. No telemetry, no call-home and no vendor control plane. Air-gapped customers are a normal deployment.
A highly optimised agent
Will the customer's server owners accept it?
The pipeline runs on their machines, so they will ask. The DPLens agent is highly optimised, which is what makes processing on their own hosts practical.
Both figures are from our lab benchmark. Lab figures, not a guarantee. An evaluation licence lets a customer measure DPLens on their own servers, with their own pipeline rules. For their risk team, every release is signed and ships with checksums and an SBOM. See the Trust Centre.
Manage centrally. Process at the edge.
How do I manage many customers centrally?
DPLens Manager is included in every subscription. It manages the agents and does not process your customers' data: events are processed in the agents and delivered to the destinations you configure, and event data never reaches Manager. If Manager is unavailable, deployed agents keep collecting and delivering on their last configuration.
Central configuration
Manage agent configuration centrally, rather than machine by machine.
Fleet health monitoring
Watch the health of your DPLens agents across the estates you run.
Deployment and upgrades
Deploy agents and keep them up to date across the fleet.
Self-hosted and air-gap capable
No vendor cloud involved.
Whether you run one estate or many customers' estates, DPLens Manager has full support for multi-tenant environments. Bring the questions your service delivery team would ask, and we will answer them in a demo, with the product in front of you. See DPLens Manager in a demo and choose "MSSP or partner" as your role.
Mixed SIEM estates
Can each customer be on a different SIEM?
Yes. The agent delivers to whichever destination you configure, so you use one agent and one pipeline model across your customers, whatever they run.
| Customer's platform | How DPLens delivers |
|---|---|
| Splunk | Cooked S2S on 9997 or HTTP Event Collector on 8088, with optional indexer acknowledgement. Splunk integration |
| QRadar, Securonix, Devo, Secureworks Taegis | Works with any SIEM that accepts syslog or JSON. All integrations |
| Collectors that expect Snare format | Snare-format output over TCP or TLS. Syslog and Snare |
| OpenTelemetry | OTLP over HTTP (protobuf) to an OpenTelemetry Collector or any OTLP endpoint, conventionally on 4318. OpenTelemetry |
The customer's SIEM and yours
One pipeline can deliver the same processed events to several destinations at once, each with its own queue, so the customer's SIEM and yours can both receive them.
Consistent fields for your content
Normalise Windows security events to CIM or OCSF names, so your detection content sees the same fields across customers.
Secure by design
An agent you can defend in a security review.
Reselling too?
Looking to resell or co-sell DPLens?
This page is about running DPLens for your customers. If you also want to resell it, or to work with us on opportunities, the partner programme covers that side.
FAQ
Questions MSSPs ask
Do I need to stand up processing infrastructure for each customer?
No. Every agent is a complete pipeline, so processing happens on the customer's own machines. DPLens Manager handles central configuration, fleet health monitoring, deployment and upgrades.
Where does my customers' data go?
Your customers' data is processed on their own machines, then delivered only to the destinations you configure: their SIEM, the platform you run for them, or both. There is no vendor cloud, telemetry or call-home.
Does customer event data pass through DPLens Manager?
No. Event data never reaches DPLens Manager. Agents process events on the customer's own machines and deliver them to the destinations you configure.
What happens to customers' collection if DPLens Manager is unavailable?
Agents already deployed keep collecting and delivering events on their last configuration.
Does DPLens support multi-tenant environments?
Yes. DPLens Manager, included in every subscription, fully supports multi-tenant environments. The best way to judge it against your service model is to see it, so see it in a demo and bring your service delivery lead.
How is DPLens licensed for an MSSP?
DPLens is licensed per agent and per network source (each syslog or NetFlow receiver), with no per-GB ingestion cost. Prices are quoted for your estate, so tell us how you run your service.
Can I run customers on different SIEMs?
Yes. Delivery is configured by destination, and DPLens works with Splunk, any SIEM that accepts syslog or JSON, and OpenTelemetry Collectors. See SIEM integrations.
Which systems does DPLens run on?
DPLens runs on Windows Server 2025, 2022, 2019 and 2016, and Windows 11 and 10, on x64. Firewalls and other network devices can send syslog or NetFlow/IPFIX to a receiver on a DPLens agent.
What support is included?
Every subscription includes support 9am to 5pm UK time, Monday to Friday. Enhanced support is available as a paid option.
Related
Where to go next
Distributed vs central pipelines
What changes when the pipeline runs in the agent rather than in a central tier.
Read more →DPLens for SOCs
A complete pipeline in every Windows agent, with every drop counted against its rule.
Read more →Compare DPLens
Dated, sourced comparisons with the agents and pipelines your customers may run today.
Read more →See it on your own logs
Try DPLens on one Windows server before you talk to anyone.
Book a demo, or request an evaluation licence and install it on a test host. The documentation covers everything from requirements to Group Policy rollout.