Feature Requests

eDNS0 and ECS are already supported, but the client subnet information is only used for CDN routing optimization. When a gateway/firewall (e.g. OPNsense with Unbound) forwards DNS queries with ECS headers containing the originating LAN client IP, that IP should be logged and displayed in the dashboard query log — not just used for CDN decisions. This would allow firewall-only deployments (without Relay or Roaming Clients) to have per-device visibility in the analytics, which is currently impossible since all queries appear to originate from the gateway IP. Why this is a strong request: ECS is already an open standard (RFC 7871) — You already use it for CDN optimization. It doesn't require any agent or Relay deployment, easy to deploy for small clients. ControlD and NextDNS both have this.

It would be super helpful if there was a DNS Filter report that could show the distribution of requests from TLD's. Essentially a graph or pie chart, with counts, grouping by TLD. This way we can hunt for TLD's that should not be in use, and probably should be blocked.

Can you rename the CyberSight service? Calling it "CyberSight.BehaviorTracking.Console" let's end-users know that management is tracking them. ;)

It would be helpful if there were more audit logs

DNS filtering catches a lot—but the most dangerous threats have learned to hide in plain sight. A phishing link in an email that routes directly to an IP. Malicious content tucked inside Google Drive or Microsoft 365. These aren't edge cases; they're exactly where attackers go when they know DNS is watching. We're building full URL and IP scanning directly into the CyberSight browser extension—an added layer of protection that catches what DNS alone was never designed to stop, without the headaches of a proxy. Admins will also get a level of precision that DNS can't offer—the ability to allow a domain while blocking specific content within it , putting real policy control back in their hands. What This Means for You Blocks phishing and malicious content hiding inside trusted domains like Google Drive and Microsoft 365 Granular path-level control—allow a site broadly, block the parts that don't belong Proxy-level protection without the proxy: no added complexity, no performance trade-offs Fuller visibility into what users are actually encountering, not just what DNS resolved

AI tools are everywhere in the modern workplace—and most organizations have no clear picture of which ones employees are actually using. CyberSight is changing that. The AI Usage Dashboard brings a dedicated, purpose-built view to CyberSight that shows exactly which AI tools are being accessed across your organization, by whom, and how often. Unlike DNS-only reporting, CyberSight's full URL and application-level context means the data reflects actual usage—not just background noise from prefetched domains or embedded resources. What This Means for You Clear visibility into which AI tools—ChatGPT, Claude, Gemini, Copilot, and others—are being used across your organization User-level drill-down so you can see who's using what, not just that something was accessed Exportable reports for compliance reviews, security audits, or client-facing deliverables No new agent deployment required—works with your existing CyberSight setup

CyberSight user behavior analytics transformed visibility for Windows deployments—and we want to bring that same capability to macOS. Mac-heavy teams will now have the same depth of user-level visibility across their entire fleet, without gaps in coverage based on operating system. What This Means for You Visibility and user-level activity logs extended to macOS devices Consistent behavioral insight across mixed Windows and Mac environments Faster investigations and incident response without switching between tools

For schools running Chromebook fleets, meaningful visibility into user activity has been a gap—and CyberSight is how we plan to close it. We're working to bring the same user-level insight available on Windows to the DNSFilter ChromeOS extension, with education teams squarely in mind. What This Means for You Visibility and user-level activity logs extended to Chromebook deployments Deeper insight into student and teacher activity across your fleet Consistent behavioral visibility across mixed-OS environments No additional tools required—everything within DNSFilter

Would it be possible to have a scheduled report that showed a summary of blocked pages visited (Site/Domain, Category) that could be drilled down by User/Roaming Client?

Customizable scheduled report that shows number of requests to specific domains broken down by user. Ability to limit/select domains included on report shows total requests to domain(s) shows all users those requests came from