For security operations centres
A distributed pipeline at the edge for your SOC
DPLens puts a complete security data pipeline in every Windows agent, with no central processing server to run. Data is processed, masked and reduced on your own machines before it leaves your network, and sent only where you choose, and every drop is counted against the rule that caused it.
- Windows Server 2016–2025
- Windows 10 and 11
- x64
- Complete pipeline in every agent
- No ingestion pricing
- DPLens Manager included
In short
DPLens is a UK-built, self-hosted, distributed security data pipeline at the edge for SOCs and MSSPs, delivered as a log collection agent for Windows. Every agent is a complete pipeline, so there is no central processing server to build or pay for: data is processed on your own machines before it leaves your network, and sent only where you choose. Licensing is per agent and per network source, with no per-GB ingestion cost, and nothing is dropped silently.
Distributed by design
What is a distributed pipeline at the edge?
Many pipelines sit in the middle: agents forward events to a central server, which filters and shapes them on the way to the SIEM. DPLens moves that work into the agent, on your own machines. Each agent is a complete pipeline, so your pipeline is as distributed as your Windows hosts. How a distributed pipeline compares with a central tier.
01
No central processing server to run
No central cluster to size for peak, make resilient, patch or pay for. Each Windows machine you add brings its own pipeline.
02
Less on the wire
Events you drop never cross your network, fill a disk cache or take up storage and indexing in your SIEM.
03
Savings you can show
Less infrastructure to host and less to ingest. Set a cost per gigabyte and the console shows what your reduction is worth, so the saving is something you can put in front of a budget holder.
A complete pipeline in every agent
What runs on each host?
Every agent includes all seven stages, in a fixed order: filter, parse, aggregate, optimise, enrich, mask, rate limit. There is no surcharge for any of them, and later stages spend their effort only on the events you keep.
| Stage | What it does | What your SOC gets |
|---|---|---|
| Filter | Keeps or drops events by value, text, pattern, list or network range. | Drop the noisy part of an Event ID and keep what your detections read. |
| Parse | Turns raw text into fields and normalises Windows security events to CIM or OCSF. | Consistent field names. Events that fail to parse are routed and counted, so a format change surfaces straight away. |
| Aggregate | Collapses repeats into one event carrying the count. | A burst of failed logons (Event ID 4625) from one user and address becomes one event, with the count intact. |
| Optimise | Removes fields holding a placeholder, such as a dash or a null SID. | Smaller events. Nothing is removed until you tick a value. |
| Enrich | Adds static tags and host facts. | Site, environment and host context on every event for triage. |
| Mask | Redacts, partially masks, tokenises or hashes card numbers, email and IP addresses, UK National Insurance numbers and your own patterns. | Sensitive values are handled before anything is stored or sent. |
| Rate limit | Caps events or bytes per second, with bursts smoothed out. | One noisy machine cannot exhaust a licence or swamp an indexer, and every shed event is counted. |
Data sovereignty
What happens to your data before it leaves your network?
It is processed on your own machines, by software you host. You decide what leaves and where it goes.
- Processed on your own machines. Windows events are filtered, masked and reduced on the host that wrote them. Syslog and NetFlow go through the same pipeline on the agent that receives them.
- Masked before it is stored or sent. Masking runs before anything is written to the disk cache or delivered.
- Sent only where you choose. Events go only to the destinations you configure. On syslog, Snare, NDJSON and Splunk destinations, TLS is recommended, with certificate validation on by default and mutual TLS where the receiver requires it.
- No vendor cloud. No telemetry, no call-home and no vendor control plane. Air-gapped networks are a normal deployment.
A highly optimised agent
Will processing on the host hurt the server?
Doing the work on the host only pays if the agent earns its place there. The DPLens agent is highly optimised, which is what makes processing on your own hosts practical.
Both figures are from our lab benchmark. Lab figures, not a guarantee. Request an evaluation licence and measure DPLens on your own servers, with your own pipeline rules.
Forensic confidence
How do I know I'm not dropping evidence at the edge?
A saving you cannot explain is a gap you cannot defend. DPLens drops nothing silently: every drop, mask, aggregation, failover and policy change is counted and attributed to the rule that caused it.
Counted by rule
See what each rule removed, not just a total. Losses from other causes, such as a full cache under a drop policy, are broken down with counts.
Measured stage by stage
Each stage shows events in and out, measured rather than estimated. The Overview funnel runs from Collected through the stages to Delivered.
Checked before you rely on it
Live stream shows events as the destination receives them, and how many a filter, aggregation or rate limit removed.
Your choice, stage by stage
You write the keep and drop rules. In the Optimise stage every value starts unticked, so nothing goes until you choose. When a destination's disk cache fills, you pick the policy: pause collection, drop oldest or drop newest.
Changes on the record
Applies, rollbacks and masking changes are recorded in a tamper-evident audit trail.
Source health on show
Components report Healthy, Degraded, Restarting or Quarantined, and a failing source is isolated so the rest keeps running.
Start with your detections. List the Event IDs and fields they read before you write a rule, prefer dropping the noisy part of an Event ID over the whole ID, and run DPLens alongside your current agent while you compare results. The guide to noisy Windows Security Event IDs goes through each ID, and SIEM cost reduction shows the safer reduction for each.
Manage centrally. Process at the edge.
How do I keep rules consistent across the fleet?
The processing is distributed. The control is central. DPLens Manager is included in every subscription. It manages the agents, and your events are processed in the agents and delivered to the destinations you configure.
Central configuration
Manage agent configuration centrally, so a rule proven on one server rolls out to every host in scope.
Fleet health monitoring
Watch the health of every DPLens agent across your estate.
Deployment and upgrades
Deploy agents and keep them up to date, or use Group Policy, Intune, Configuration Manager or an RMM.
Self-hosted and air-gap capable
It runs on your infrastructure, with no vendor cloud involved.
Whether you run one estate or many customers' estates, DPLens Manager has full support for multi-tenant environments. See DPLens Manager in a demo.
Your SIEM, your choice
Which SIEMs does it work with?
DPLens delivers to Splunk over cooked S2S or HEC, works with any SIEM that accepts syslog or JSON, including QRadar, Securonix, Devo and Secureworks Taegis, and sends OTLP over HTTP to an OpenTelemetry Collector.
Run two SIEMs side by side
One pipeline can deliver the same processed events to several destinations at once, each with its own queue. That is the shape of a SIEM migration: old and new in parallel, then remove the old.
Ride out an outage
On syslog, Snare, NDJSON and Splunk destinations, delivery is disk-backed, with ordered failover and automatic failback, and optional Splunk indexer acknowledgement.
No ingestion pricing
What does it cost to send more, or less?
The same. DPLens is licensed per agent and per network source (each syslog or NetFlow receiver), with no per-GB ingestion cost.
- Filtering more never costs more, and neither does onboarding a new channel for a new detection.
- A noisy week does not change what the agent costs.
- One syslog receiver taking events from 500 firewalls is one network source.
- All seven stages, every destination and DPLens Manager are included.
Secure by design
An agent you can defend in a security review.
FAQ
Questions buyers ask
What does "distributed pipeline at the edge" mean?
Each DPLens agent is a complete pipeline running on a Windows machine, so there is no central processing server between your machines and your SIEM. The edge is your Windows hosts, where the DPLens agent runs. Firewalls, switches and appliances reach it as syslog and NetFlow sources received by an agent.
Isn't another agent just more to run?
Most teams start by replacing a log agent they already run, so DPLens takes the place of what is there. See the ways in. It is one signed executable and its installer, with no .NET, Java or database to install first, and DPLens Manager is included for central configuration, fleet health monitoring, deployment and upgrades.
Will processing on the host slow the server down?
In our lab benchmark, DPLens delivered more than 30× the throughput of the popular free and paid Windows agents we tested, at about a tenth of the CPU per event. Lab figures, not a guarantee. Request an evaluation licence and measure DPLens on your own servers, with your own pipeline rules.
How do I know filtering isn't dropping evidence?
Every drop is counted and attributed to the rule that caused it, each stage shows events in and out, and rule changes are recorded in a tamper-evident audit trail. You write the rules, you can check them on Live stream before you rely on them, and you can run alongside your current agent while you compare.
Does DPLens Manager process my events?
No. DPLens Manager manages the agents: central configuration, fleet health monitoring, deployment and upgrades. Event data never reaches it: events are processed in the agent and delivered to the destinations you configure.
What happens if DPLens Manager is unavailable?
Agents already deployed keep collecting and delivering events on their last configuration.
Is DPLens priced on data volume?
No. DPLens is licensed per agent and per network source, with no per-GB ingestion cost. See the licensing model.
Which systems does DPLens run on?
DPLens runs on Windows Server 2025, 2022, 2019 and 2016, and Windows 11 and 10, on x64. Firewalls and other network devices can send syslog or NetFlow/IPFIX to a receiver on a DPLens agent.
Related
Where to go next
Distributed vs central pipelines
What changes when the pipeline runs in the agent rather than in a central tier.
Read more →DPLens for MSSPs
Running collection for many customers, with no processing infrastructure to stand up for each.
Read more →Trust Centre
How DPLens is built, signed and verified, for your security review.
Read more →See it on your own logs
Try DPLens on one Windows server before you talk to anyone.
Book a demo, or request an evaluation licence and install it on a test host. The documentation covers everything from requirements to Group Policy rollout.