How DNS Filtering Works in NISSI

NISSI's DNS Filtering module lets you manage domain block and allow rules for all your enrolled devices. You can view all DNS query activity in real-time through the DNS Query Log.

Accessing DNS Filtering

1. Log in to NISSI Command Center
2. In the left sidebar, click DNS Filtering
3. You'll see your current stats: Active Block Rules, Active Allow Rules, and Queries Blocked (recent)

Adding a Rule

1. Click + Add Rule in the top-right corner
2. Enter the domain you want to block or allow
3. Select an Action: Block or Allow
4. Select a Category to classify the rule
5. Save the rule — it becomes active immediately

Filtering & Searching Rules

Use the search bar to find a specific domain. Filter by All Actions (Block/Allow) or All Categories to narrow results.

Monitoring DNS Activity

Go to DNS Query Log in the sidebar to see real-time DNS activity across your devices:

• Queries Blocked — total DNS lookups blocked by your rules
• Queries Allowed — total lookups that passed through
• Unique Domains — number of distinct domains queried
• Active Devices — devices currently reporting DNS telemetry

The Query Log shows a searchable, filterable list of every DNS query. Use the search bar to find a specific domain or device, and filter by status (All/Blocked/Allowed) or category.

The Top Blocked Domains panel shows which domains are being blocked most frequently across your fleet, and the Category Breakdown panel summarizes blocked query categories.

How Rules Are Enforced

The NISSI endpoint agent performs passive DNS monitoring on enrolled devices. When a device queries a domain that matches a block rule, it is flagged and logged. Rules are enforced at the device level via the running agent.

Note: DNS monitoring is passive and does not intercept or proxy traffic — it monitors DNS activity and enforces rules through the agent running on each device.

Need Help?

Contact support or use the AI Assistant below.