Security Insights
Security add-on with packet-level analysis at the network edge for fast and actionable security intelligence
Challenge
Many enterprises operate with fragmented visibility between network and security teams. Furthermore, traditional network detection and response (NDR) solutions are complex, costly, and siloed, leaving blind spots that attackers can exploit.
Solution
Security Insights, an add-on to BlueCat LiveWire accessible through BlueCat LiveNX, delivers faster detection, forensic investigation, and proactive threat hunting. It quickly transforms existing network-edge data into actionable, scalable security intelligence without the blind spots of traditional NDR.
Benefits
Figure 1. Security Insights architecture
How it works
As a LiveWire add-on accessible through the LiveNX UI, Security Insights operates natively in existing LiveNX and LiveWire environments, transforming network observability into actionable security intelligence. Using the same data that powers performance monitoring, it enables practical network detection without adding tools or complexity. By leveraging flow telemetry from LiveNX and packet-level analysis from LiveWire, Security Insights correlates these findings across all environments—LAN, WAN, SD-WAN, data center, and cloud—giving teams complete visibility into where and how threats emerge.
LiveWire provides deep forensic visibility by performing packet-level capture and analysis at the network edge. It not only captures payloads—including both encrypted and cleartext—but also identifies patterns and reconstructs sessions. This process of capture and analysis is called LiveFlow. These LiveFlow records are then sent to LiveNX, which detects anomalies by aggregating and enriching comprehensive network traffic telemetry. Traffic flow data is collected in LiveNX from NetFlow, IPFIX, sFlow, and Cisco high-speed logging and unified logging.
LiveNX’s centralized dashboard then displays these detected threats and traffic anomalies. Security Insights is open and standards-based, allowing for mapping to the Open Worldwide Application Security Project (OWASP) and MITRE ATT&CK frameworks and seamless integration with SIEM, SOAR, and XDR tools for coordinated response. If a detected threat is first seen in a SIEM or another security solution, security and network teams can leverage LiveNX and LiveWire for deeper investigation.
Both LiveWire and LiveNX are required components for Security Insights.
Use cases
This section outlines three real-world detection scenarios that demonstrate the benefits of using Security Insights.
Use case 1: Detecting anomalous Transport Layer Security activity
MITRE ATT&CK ID T1571 – Non-Standard Port
A global logistics company experiences unexpected spikes in encrypted traffic on non-standard ports. Security Insights automatically detects this pattern as “Unexpected Encryption on IANA Reserved Port”—a strong indicator of malicious tunneling activity used to hide command-and-control (C2) communications.
Investigation workflow:
- Detection (Security Insights)
- Detects encrypted traffic on port 8088, which is not typically used for secure communications.
- Maps detection to MITRE T1571 and flags the event.
- Cross-references with known IANA-reserved ports for validation and automatically alerts the security operations team.
- Analysis (LiveNX)
- Visualizes affected subnets and identifies systems generating the anomalous traffic.
- Correlates flow records across WAN and SD-WAN links, confirming the pattern is isolated to a single IoT gateway.
- Detects recurring communication intervals—a hallmark of beaconing.
- Forensics (LiveWire)
- Captures and inspects packets to confirm encrypted payloads.
- Response
- Security operations team isolates the IoT gateway and blocks all outbound traffic on unauthorized ports.
- Forensic data is exported to the SIEM for post-incident validation and compliance reporting.
Outcome: Early detection prevented malware from establishing C2 persistence, reduced time to detect from hours to minutes, and improved visibility into encrypted traffic without decryption overhead.
Figure 2. Security Insights summary dashboard and detail view in LiveNX
Use case 2: Proactive threat hunting with threat intel indicators
MITRE ATT&CK ID: T1102 – Web Service
A financial institution’s threat intelligence feed reports suspicious domains associated with a recent C2 infrastructure campaign. Using Security Insights, the security team proactively hunts across their hybrid network for any evidence of contact with those domains.
Investigation workflow:
- Detection (Security Insights)
- Imports threat intelligence indicators of compromise from an external feed and maps them to MITRE T1102.
- Performs a network-wide correlation using flow telemetry to identify outbound communications to suspicious domains.
- Flags multiple endpoints contacting the domain app-sync-storage[.]net, classified as a potential C2 web service.
- Analysis (LiveNX)
- Analysts pivot into LiveNX to visualize communication frequency and duration by endpoint.
- Correlates DNS queries and flow records to confirm repeated contact from a single subnet within the R&D network.
- Detects unusual data size patterns consistent with exfiltration via HTTPS.
- Forensics (LiveWire)
- Performs packet capture for the flagged hosts to confirm payload behavior.
- Identifies POST requests containing Base64-encoded data to the suspicious domain.
- Extracts the payload for sandbox analysis to confirm malicious exfiltration.
- Response
- Sends data to the SOAR to automatically block the compromised domains and associated IP ranges.
Outcome: Stopped stealthy C2 communications before significant business losses occurred.
Use case 3: Forensic investigation of a TLS certificate abuse attack
MITRE ATT&CK ID: T1587.003 – Digital certificates
A large healthcare provider detects irregular SSL certificate behavior across its data centers. Security Insights flags multiple self-signed TLS certificates being used in outbound traffic—a possible sign of malware using forged certificates to bypass inspection controls.
Investigation workflow:
- Detection (Security Insights)
- Identifies multiple self-signed and untrusted TLS certificates in use on internal outbound connections.
- Maps detection to MITRE T1587.003 and classifies as Unusual Certificate Activity.
- Analysis (LiveNX)
- Analysts use flow visualization to isolate traffic originating from affected systems.
- Confirms repetitive, short-lived TLS sessions from an IoT medical device subnet to an external IP.
- Detects abnormal TLS handshake intervals and cipher mismatches.
- Forensics (LiveWire)
- Captures packets for full forensic analysis.
- Confirms that outbound connections contain encrypted commands hidden within TLS payloads.
- Identifies the use of self-signed certificates generated by the malware to establish persistence.
- Response
- Integrates findings into the SIEM and SOAR for automated certificate revocation and alerting.
Figure 3. Security Insights individual packet data dashboard used for a forensic search
Outcome: Prevented C2 persistence via forged TLS certificates, enhanced compliance and audit readiness by retaining packet-level evidence, and strengthened certificate governance across the organization.
Key differentiators
Where legacy NDR is centralized, complex, and costly, Security Insights is distributed, efficient, and immediate. It quickly transforms existing LiveNX and LiveWire data into actionable and scalable security intelligence without the blind spots or burdens of traditional NDR.
These four key differentiators set Security Insights apart from NDR solutions:
Unmatched data quality and visibility—without NDR’s blind spots
Traditional NDR solutions are often constrained by limited data sources or vendor-specific integrations. Security Insights provides unified, high-fidelity visibility across every domain, LAN, WAN, SD-WAN, data center, and cloud, regardless of vendor or architecture. It ingests telemetry from multiple systems and correlates it into a single view. As a result, where NDR tools only see fragments, Security Insights offers end-to-end visibility.
Rich, multi-telemetry ingestion—while NDR depends on partial feeds
Traditional NDR solutions often rely on sampled or filtered packet data to reduce ingestion volume, which sacrifices accuracy and context. Security Insights aggregates and enriches comprehensive telemetry, NetFlow, IPFIX, sFlow, and Cisco high-speed logging and unified logging to identify hidden anomalies and patterns across the entire network fabric. This approach gives analysts the complete picture, not just a summary of traffic samples.
Full packet capture and forensic depth—without the cost and delay
Most NDR tools move massive packet datasets to a centralized cloud or data lake for analysis, which drives latency, cost, and compliance concerns. Powered by LiveWire, Security Insights performs forensic-grade packet analysis locally at the network edge. Teams can instantly pivot from flow records to full packet payloads for precise investigations without backhauling data, incurring delays, or the expense of relying on the cloud for analysis.
Edge-first analytics—real-time detection where threats begin
Traditional NDR architectures analyze data after it’s transported and aggregated, introducing delays that attackers exploit. Security Insights shifts this model, generating insights directly at the edge, where many threats originate. By detecting anomalies in real time, it shortens dwell time, reduces operational costs, and ensures sensitive data never leaves controlled environments.
Solution benefits
Security Insights empowers enterprises using LiveNX and LiveWire to modernize threat detection and response with powerful capabilities that simplify operations, accelerate investigations, and strengthen security outcomes across every environment. With Security Insights, network and security teams get these benefits:
Faster detection and response
Cut investigation time from hours to minutes with real-time visibility and actionable insights.
Advanced threat hunting
Leverage raw, unaggregated flow data to uncover hidden threats and accelerate forensics.
Unified visibility
Reduce complexity by bringing network and security data together in a single, correlated view.
Figure 4. Security Insights filter by MITRE ATT&CK ID
Appendix: Security findings
This appendix provides a list of security findings generated by LiveNX and LiveWire. These findings highlight anomalies, suspicious behaviors, and policy violations detected through flow and packet analysis. While not an exhaustive NDR catalog, they represent high-value insights that accelerate detection, investigation, and response. As LiveNX and LiveWire evolve, this library of findings continues to expand, ensuring network and security teams benefit from richer visibility and stronger outcomes over time.
| Security finding | MITRE ATT&CK ID (if applicable) |
|---|---|
| Encryption On IANA Reserved Port | T1571 |
| Kerberos Detected | |
| Kerberos RC4 Detected | |
| Malicious IP or Domain Detected | |
| Microsoft IP Detected | |
| NTLM Protocol Detected | |
| RDP On Non-Standard Port | T1571 |
| Threat Intel Indicator | T1102 |
| TLS Certificate Anomalies Detected | TLS |
| TLS Client Excessive Handshakes | TLS |
| TLS Forbidden Version | T1071.002 |
| TLS Long Lived Connection | TLS |
| TLS Missing SNI | T1587.003 |
| TLS Self-Signed Certificate | T1587.003 |
| TLS Unusual Certificate | T1587.003 |
| Unassigned Encryption | |
| Unauthorized Application Use | T1071.002 |
| Unexpected Encryption | T1571 |
| TLS Unexpected Plaintext | T1571 |
| TLS Weak Cipher Suite | |
| RDP Connection After Brute Force Attempt | T1021 |
| SSH Connection After SSH Brute Force Attempt | T1021 |
| Unauthorized Application Use | |
| RDP Brute Force Attempt Detected | T1110 |
| SSH Brute Force Attempt Detected | T1110 |
| New Encryption Protocol | T1571 |
| Found RDP On Non-Standard Port | T1571 |
| New Encryption User | T1573 |
| New Encryption Service | T1573 |
| New SSH Client Version Found | T1573 |
| New SSH Server Version Found | T1573 |
| New TLS Version Found | T1573 |
| Insecure/weak cipher | T1587.003 |
| New TLS SHA1 Found | T1588 |
| New TLS JA3C Found | T1588.004 |
| New TLS JA3S Found | T1588.004 |
| Lateral Movement Anomaly <application> | |
| Clique Expansion | |
| Interface Volumetric Anomaly | |
| Application Interface Volumetric Anomaly | |
| DSCP Interface Volumetric Anomaly | |
| Application Site Volumetric Anomaly | |
| Site Volumetric Anomaly |
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
Complying with the NIS 2 cybersecurity directive
BlueCat solutions: Unified DDI, protective DNS solutions, and network observability and health
Executive Summary
As cybersecurity threats and risks evolve, so does the regulatory environment. The second iteration of the European Union’s Network and Information Security Directive, called NIS 2, is an updated cybersecurity regulatory framework set to be transposed into member states’ laws in October 2024.
Designed to tackle the escalating cybersecurity challenges and vulnerabilities facing its member states, NIS 2 regulations will impact many organizations. The NIS 2 directive outlines the requirements placed upon medium- to large-sized public and private entities that provide critical infrastructure or services vital to the European Union economy and society. Covered entities are divided into two categories, essential and important.
Compared to its predecessor, the updated NIS 2 directive has stricter requirements for cybersecurity risk management and incident reporting, expands the scope of entities that it covers, and imposes stiffer penalties for non-compliance.
The NIS 2 directive aims to boost cybersecurity with requirements across four key areas: risk management, corporate governance, incident reporting, and business continuity. To support these four overarching areas, the directive spells out 10 baseline security measures that entities must implement to manage risks. Penalties for non-compliance include non-monetary remedies, administrative fines, and criminal sanctions for management bodies.
According to the NIS 2 directive, upholding and preserving a reliable, resilient, and secure DNS is crucial to maintaining the integrity of the internet and is essential for its continuous and stable operation. But as networks grow increasingly complex and expand to the cloud, it becomes an even greater challenge to maintain a single source of truth for D N S.
A consolidated, automated, and streamlined approach to managing the core network services of DNS, DHCP, and IP address management (together known as DDI), particularly when combined with protective solutions and network observability tools, offers a robust answer to meeting the NIS 2 mandate. Together, these solutions address many elements of the directive, including risk management, incident handling, operational security, and reporting obligations.
Three of BlueCat’s products—Integrity, Edge, and Infrastructure Assurance—offer core capabilities and features that can help enterprises comply with NIS 2 directive requirements. A mapping table provides detailed descriptions of how BlueCat products can help address specific mandates in NIS 2 directive articles.
Supported by BlueCat’s solutions for unified DDI, protective DNS, and network observability and health, organizations can more easily rise to the mandate to meet NIS 2 requirements.
Introduction to the NIS 2 directive
The Network and Information Security (NIS) Directive was a landmark cybersecurity regulatory framework established in the European Union (EU) in 2016.
The EU recently introduced a second iteration, Directive (EU) 2022/2555, known as NIS 2, to tackle the escalating cybersecurity challenges and vulnerabilities facing its member states, particularly those relating to critical infrastructure and services. The NIS 2 entered into force in January 2023, and each member state must transpose this updated directive into national law by October 17, 2024.
As our reliance on digital systems continues to grow, so does related risk. The risk of exploitation by bad actors and the potential impact on society from critical sector cyberattacks requires heightened security postures. NIS 2 seeks to reinforce and build better foundations for all aspects of network and information security, from coordinated incident response and reporting to fortifying cybersecurity defenses and practices. Our growing interconnectedness also means we must be able to trust and rely on our critical supply chains as they form networks at organizational, national, and regional levels.
Under the NIS 2 directive, member states are tasked with creating or improving their:
- National cybersecurity frameworks
- Competent authorities
- Crisis management frameworks
- Computer security incident response teams
- Vulnerability databases
- Cooperation
- Risk assessments
- Reporting
- Certification schemes
Compared to its predecessor, the updated NIS 2 directive features stricter requirements for cybersecurity risk management and incident reporting, expands the scope of entities that it covers, and imposes stiffer penalties for non-compliance.
Does the NIS 2 directive apply to my organization?
Much of the NIS 2 directive covers the responsibilities and requirements placed upon medium- to large-sized public and private entities that provide critical infrastructure or services vital to the EU economy and society. NIS 2 significantly expands the list of covered sectors from just seven in the original directive. In NIS 2, covered entities are divided into two categories, essential and important, which are defined by size and type.
Essential and important entities
Under the NIS 2, an essential entity is a large organization that operates in a sector of high criticality (see the list of high criticality sectors below). While it can vary slightly by sector, the NIS 2 generally defines the threshold for a large organization as one with at least 250 employees and an annual turnover of at least €50 million or an annual balance sheet of at least €43 million.
High criticality sectors for essential entities include:
- Energy
- Transport
- Banking and financial market infrastructure
- Health
- Drinking water and wastewater
- Digital infrastructure
- Information and communication technology (ICT) service management (business-to-business managed service providers and managed security service providers)
- Public administration
- Space
Digital infrastructure refers to services that are crucial to network operations. It includes internet exchange point providers, DNS service providers, top-level domain name registries, cloud computing services, data center service providers, content delivery networks, trust services, public electronic communications networks, and publicly available electronic communications services.
Meanwhile, an important entity is an organization that is at least medium-sized and operates in other critical sectors that don’t fall under the essential category. Again, while the definition can vary slightly by sector, the threshold for medium-sized is having at least 50 employees and an annual turnover of at least €10 million or a €10 million balance sheet.
Other critical sectors for important entities include:
- Postal and courier services
- Waste management
- Manufacture, production, and distribution of chemicals
- Production, processing, and distribution of food
- Manufacturing
- Digital providers (search engines, online marketplaces, and social networks)
- Research
It’s important to note that critical sector organizations that do not meet the minimum size requirements of the ‘essential’ category are still deemed to be ‘important’ entities.
NIS 2 essential vs. important entities
| Sector | Headcount | Annual turnover | oR | Balance sheet total | |
|---|---|---|---|---|---|
| Essential entity |
Essential entity
| 250 employees | €50 million | €43 million | |
| Important entity |
Important entity
Plus, all sectors that fall under essential but are within the size threshold for important entities. | 50 employees | €10 million | €10 million |
Mandatory applicability regardless of size
The NIS 2 has mandatory applicability for certain organizations regardless of their size. This includes:
- Providers of public electronic communications networks or publicly available electronic communications services
- Trust service providers
- Top-level domain name registries and DNS service providers
Applicability is also mandatory for smaller organizations in cases such as if the entity is the sole provider of a service in a member state that is essential for maintaining critical societal or economic activities, or if disruption of the entity’s services would induce systemic risk or have a significant impact on public safety, security, or health. Member states may also deem an entity critical because of its specific importance at the national or regional level.
Determining jurisdiction
Under NIS 2, essential and important entities fall under the jurisdiction of the member state in which they are established. If entities provide services in more than one member state, they fall under the separate and concurrent jurisdiction of each member state.
However, the NIS 2 also accounts for the somewhat borderless nature of digital entities. Public electronic communications networks or publicly available electronic communications services fall under the jurisdiction of the member state in which they provide their services.
The entities below fall under the jurisdiction of the EU member state in which they have their main establishment. The NIS 2 defines a main establishment as where decisions related to cybersecurity risk management measures are predominantly made, where cybersecurity operations are carried out, or where the greatest number of EU-based employees are located. This applies to:
- DNS service providers
- Top-level domain name registries
- Entities providing domain name registration services
- Cloud computing service providers
- Data center service providers
- Content delivery networks
- Managed service providers and managed security service providers
- Online marketplaces
- Search engines
- Social networks
Applicability to supply chains
An entity’s supply chain and its suppliers, such as providers of data storage and processing services, play an important role in cybersecurity. Numerous times, entities have been the victim of cyberattacks wherein malicious perpetrators compromised the security of an entity’s network and information systems by exploiting vulnerabilities affecting third-party products and services. According to the NIS 2, essential and important entities must assess and consider the overall quality and resilience of products and services they procure, the cybersecurity risk-management measures embedded in them, and the cybersecurity practices of their suppliers and service providers, including their secure development procedures. Entities are encouraged to incorporate cybersecurity risk-management measures into contractual arrangements with their direct suppliers and service providers.
Finalizing entities that fall under the scope of NIS 2
By April 17, 2025, member states must identify the essential and important entities in their state that fall under the scope of NIS 2. Organizations will need to determine if they fall within the scope of NIS 2, identify which member states they provide in-scope services to, and register before the deadline.
It is important that your organization carefully reviews the language of the NIS 2 directive to understand specific criteria and thresholds and determine if you fall within its scope.
Figure 1. NIS 2 timeline for key dates
Key requirements and impacts of the NIS 2 directive
The NIS 2 directive aims to boost cybersecurity with requirements across four key areas: risk management, corporate governance, incident reporting, and business continuity.
Four areas of focus to boost cybersecurity
Risk management
Organizations are required to implement comprehensive risk management strategies to minimize cyber threats. They must conduct regular risk assessments, establish security policies, and implement measures to protect the integrity, confidentiality, and availability of their systems. Entities are also obligated to monitor and document their security practices on an ongoing basis, ensuring they can quickly identify and address emerging threats.
Corporate governance
Management bodies are responsible for overseeing and approving their respective entities’ protocols for cybersecurity risk management. They must also ensure they are implemented effectively. Management bodies are also required to undergo cybersecurity training and should offer similar training to their employees.
Incident reporting
Covered entities must report significant incidents to relevant authorities promptly, providing detailed information about the nature of the incident and the mitigation measures taken. Entities must provide initial notification no later than 24 hours after learning of a cyber incident, a full report no later than 72 hours after, and a final report one month later.
Business continuity
Entities are required to create a strategy that details how they will respond to and recover from incidents, with a goal of minimizing disruptions and ensuring business continuity following an attack.
Baseline security measures that entities must implement
To support these four overarching areas, the directive spells out 10 baseline security measures that organizations must implement to manage risks. They include:
- Policies on risk analysis and information system security
- Incident handling
- Business continuity, such as backup management and disaster recovery, and crisis management
- Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers
- Security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure
- Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
- Basic cyber hygiene practices and cybersecurity training
- Policies and procedures regarding the use of cryptography and, where appropriate, encryption
- Human resources security, access control policies, and asset management
- The use of multi-factor authentication or continuous authentication solutions; secured voice, video, and text communications; and secured emergency communication systems within the entity, where appropriate
Sanctions for non-compliance
The NIS 2 directive has much harsher penalties for non-compliance than its previous iteration, including non-monetary remedies, administrative fines, and criminal sanctions for management bodies.
Non-monetary remedies
The NIS 2 gives member states’ supervisory authorities the power to levy non-monetary remedies against non-compliant entities, including compliance orders, binding instructions, security audit implementation orders, and threat notification orders to entities’ customers.
Administrative fines
Fines can vary by member state, but the NIS 2 directive sets maximum fine levels for essential and important entities.
Fines for essential entities vs. important entities
| Fines for essential entities | Fines for important entities |
|---|---|
| A maximum fine of up to €10,000,000 or 2% of global annual revenue, whichever is higher. | A maximum fine of up to €7,000,000 or 1.4% of global annual revenue, whichever is higher. |
Criminal sanctions for management bodies
To reduce the pressure on IT and security teams, the NIS 2 directive includes measures that can hold top management personally liable if gross negligence is proven after a cybersecurity incident. Supervisory authorities can order organizations to publicly disclose violations or make public statements identifying the person(s) responsible for the incident. If the organization is an essential entity, an authority can temporarily ban executives from holding management positions.
DNS: A core element of a secure network under NIS 2
The Domain Name System (DNS) is a hierarchical naming system that allows communication across devices on a network. Most commonly, it translates human-readable domain names (like bluecatnetworks.com) to computer-friendly Internet Protocol (IP) addresses (like 104.239.197.100). Essentially, it allows us to connect to websites without having to memorize a string of numbers. With DNS, all we need to know when we open web browsers are websites’ names.
According to the NIS 2 directive, “Upholding and preserving a reliable, resilient and secure domain name system (DNS) are key factors in maintaining the integrity of the internet and are essential for its continuous and stable operation, on which the digital economy and society depend.”
DNS was built first and foremost to correctly and efficiently respond to queries, not question their intent. As a result, DNS has inherent limitations and potential to be used as a vector for cyberattacks. In a DNS attack, a bad actor either tries to compromise the infrastructure that provides DNS services or takes advantage of its inherently open attributes to conduct a broader attack. A well-orchestrated DNS attack against an unprotected network can bring an organization to its knees.
As networks grow increasingly complex and expand to hybrid and multicloud environments, it becomes an even greater challenge to maintain a single source of truth for DNS.
A consolidated, automated, and streamlined approach to managing DNS, dynamic host configuration protocol (DHCP), and IP address management (together known as DDI), particularly when combined with protective DNS and network observability tools, offer a robust answer to meeting the NIS 2’s mandate.
Figure 2. DNS, DHCP, and IP address management are at the heart of the digital enterprise
Unified DDI
Unified DDI solutions integrate DNS, DHCP, and IP address management (IPAM) functionalities into a single platform, providing centralized visibility and control of IP resources and core network services. Unified DDI supports NIS 2 requirements by offering:
- Improved network visibility: A centralized and unified view of your DDI data provides comprehensive visibility into network assets, their configurations, and their interactions. This is essential for identifying vulnerabilities and ensuring robust network security.
- Automated network management: Automation reduces the risk of human error and enhances the efficiency of managing namespaces, IP addresses, and related services, ensuring that configurations are consistent and secure.
- Compliance and auditing: Unified DDI platforms often come with auditing and logging capabilities, which help organizations maintain detailed records of network configurations and changes. This facilitates compliance with NIS 2 requirements for documentation, reporting, and accountability.
Protective DNS solutions
Protective DNS solutions enhance network security by monitoring and filtering DNS traffic to block malicious queries and prevent access to harmful sites or attackers’ command-and-control channels. When considering NIS 2 requirements, protective DNS solutions help with:
- Threat detection and mitigation: DNS security solutions often offer what is known as protective DNS: a service that analyzes DNS queries and mitigates or blocks connections to malicious domains. By blocking access to known malicious domains and records, protective DNS helps with early detection and prevention of cyber threats, reducing the risk of security incidents.
- Incident response: Protective DNS solutions provide deep visibility into DNS traffic, enabling quicker identification of—and incident response to—anomalies and potential threats.
- Compliance and reporting: Logging and monitoring DNS queries and responses helps with maintaining records required for compliance with NIS 2 and facilitates reporting to regulatory authorities.
Network observability and health
Network observability and health solutions focus on ensuring that your network infrastructure is secure, reliable, and resilient. Network observability and health capabilities that can help meet NIS 2 requirements include:
- Continuous monitoring and assessment: These tools continuously monitor the network for vulnerabilities and compliance with security policies, helping to identify and remediate issues before they can be exploited.
- Resilience and redundancy: Network observability and health solutions help you design and maintain a resilient network infrastructure with adequate redundancy, ensuring that critical services remain available even during incidents or outages.
- Incident response and recovery: These solutions provide tools and processes for effective incident response and recovery, ensuring that organizations can quickly restore normal operations after an operational or security incident.
Together, these types of solutions and capabilities address many elements of the NIS 2 directive. They provide actionable and demonstrable utility for:
- Risk management: Unified DDI, protective DNS, and network observability and health solutions help identify and mitigate risks through enhanced visibility, threat detection, and automated prevention.
- Incident handling: These solutions provide tools for quick detection, response, and reporting of cybersecurity incidents, aiding in effective incident handling and reducing the mean time to recovery.
- Operational security: By automating and centralizing network management, these solutions ensure consistent, fresh, and secure configurations, reducing vulnerabilities and enhancing operational security.
- Reporting obligations: The logging and auditing capabilities of these solutions help meet reporting obligations under NIS 2, ensuring that organizations can provide the necessary information to authorities when required.
BlueCat products that help meet the NIS 2 directive
Three of BlueCat’s products—Integrity, Edge, and Infrastructure Assurance—offer core capabilities and features that can help enterprises comply with NIS 2 requirements.
Integrity
Integrity is BlueCat’s platform for integrated DDI management for large enterprises. It simplifies and consolidates DDI visibility and control across the most complex network infrastructures. Powered by RESTful APIs, Integrity automates all aspects of DDI management. Integrity is comprised of BlueCat Address Manager and BlueCat DNS/DHCP Server (BDDS). Address Manager performs IP address management and acts as the main DNS and DHCP management platform (cluster or single node). Depending on your requirements, architecture, and footprint, BDDSes are single instances or clusters that selectively provide authoritative DNS and/or DHCP services. Each component is flexible and can be deployed physically or virtually.
Cloud Discovery & Visibility, an application add-on for Integrity, discovers the entirety of your on-premises and multicloud footprint and streams that data to Address Manager for up-to-date information.
Edge
Edge brings additional IP forwarding, discovery, resolution, and security capabilities to standard DDI infrastructure in three key areas: networking, security, and cloud. Edge is a lightweight, cloud-managed software solution that delivers advanced DNS capabilities via service points deployed across the edge of your network.
Edge provides an intelligent layer of control to address threats, solve namespace collisions, and optimize query response latency based on organizational policies. By mapping directly to these frameworks, Edge assists users in meeting security and compliance requirements.
Infrastructure Assurance
Infrastructure Assurance provides proactive observability, troubleshooting, and remediation for network and security infrastructure, including Integrity, firewalls, and load balancers. It identifies hidden issues, conducts automated diagnosis, and offers expert-recommended remediation steps.
With deep visibility and automation, it prevents network disruptions and streamlines tasks like maintenance and high availability validation, efficiently analyzing critical data based on best practices. Key capabilities include:
Figure 3. Unified DDI, protective DNS, and network observability and health tools offer a robust answer to NIS 2 requirements.
Mapping NIS 2 articles to BlueCat products
The NIS 2 directive is broken into nine chapters, made up of consecutively numbered articles that cover topics applicable to member states and public and private entities.
| Chapter | Title | Articles |
| I | General Provisions | 1–6 |
| II | Coordinated Cybersecurity Frameworks | 7–13 |
| III | Cooperation at Union and International Level | 14–19 |
| IV | Cybersecurity Risk-Management Measures and Reporting Obligations | 20–25 |
| V | Jurisdiction and Registration | 26–28 |
| VI | Information Sharing | 29–30 |
| VII | Supervision and Enforcement | 31–37 |
| VIII | Delegated and Implementing Acts | 38–39 |
| IX | Final Provisions | 40–46 |
The table below offers detailed descriptions of how BlueCat products can help address specific mandates in NIS 2 directive articles.
| NIS 2 article | BlueCat product | How it helps |
| Chapter I, Article 3, Essential and Important Entities | ||
| 4. For the purpose of establishing the list referred to in paragraph 3, Member States shall require the entities referred to in that paragraph to submit at least the following information to the competent authorities: (b) the address and up-to-date contact details, including email addresses, IP ranges and telephone numbers; | Integrity | Visibility of full IP footprint and namespaces, including public and private clouds, automated network discovery, and a single source of truth that stretches across all network footprints. Cloud Discovery & Visibility removes the need for manually updating managed ranges. |
| Edge | Edge’s Cloud Resolver gives full visibility into any cloud changes related to zones, virtual private clouds, or delegations, no matter how much they churn. Changes are automatically synchronized to Integrity’s core IP address management functionality. | |
| Chapter IV, Article 20, Governance | ||
| 2. Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk- management practices and their impact on the services provided by the entity. | Infrastructure Assurance | Continuous measurement of security, performance, and configuration metrics, cross-referenced with benchmark data defined by internal policies or external standards. |
| Chapter IV, Article 21, Cybersecurity Risk-Management Measures | ||
| Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services. | Integrity | Full operational management of DDI-related tasks and services across native and hybrid footprints. Cloud discovery and visibility, early detection, and prevention of threats. |
| Edge | Intelligent and protective DNS that incorporates threat feeds with enumeration and resolution across churning assets or ephemeral entities. | |
| Infrastructure Assurance | Auto-triage and root-level diagnosis of issues—like errors, misconfigurations, vulnerabilities, and downtime—as soon as they occur, with contextual awareness of related issues. | |
| 2. (b) incident handling | Integrity | Digital asset lookup (IP prefixes or namespaces, including user-defined fields for arbitrary assets or tags). Forward and reverse resolution, including event enrichment for manual or automated investigation (via APIs plus integrations with security information and event management (SIEM) tools). Blocking and policy enforcement. |
| Edge | Intelligent DNS, including DNS firewalling, threat feeds for real-time blocking, deep querying for identifying malicious or infected nodes, and protective policy enforcement. DNS forensics and investigation. | |
| Infrastructure Assurance | Performs auto-triage, issues alerts for detected anomalies, and provides recommended remediation steps that IT or security teams can follow to resolve identified issues. | |
| 2. (c) business continuity, such as back- up management and disaster recovery, and crisis management | Integrity | Application layer clustering, crossover high availability pairs, database replication, and, if required, manual system failover. |
| Edge | Cloud-based management service with as many service points as desired for architectural redundancy and resiliency. | |
| Infrastructure Assurance | Health and capacity checks, external critical services and dependencies checks, high availability readiness, automated configuration backups, and misconfiguration identification. | |
| 2. (d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers | Edge | Protection against an exploit’s payloads, particularly for command-and-control channels, leveraging threat feeds, block lists, and domain generation algorithm detection. |
| Infrastructure Assurance | Detection of anomalies and common vulnerabilities and exposures (CVEs) across multi-vendor environments, including auto-triage, reporting, and alerting. | |
| 2. (f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Edge | Reporting on potential distributed denial- of-service attempts and ability to isolate potentially infected user endpoints due to types of DNS queries and related data. These reports and data bolster or highlight the efficacy of other security devices, policies, or procedures. |
| Infrastructure Assurance | Ongoing reporting and alerting on vulnerabilities and related proliferation across security infrastructure. Analysis using Mitre’s CVE database and NIST’s National Vulnerability Database. | |
| 2. (h) policies and procedures regarding the use of cryptography and, where appropriate, encryption; | Edge | Block DNS over HTTPS resolvers with threat feeds or custom block lists. |
| 2. (i) human resources security, access control policies and asset management | Integrity | Primary asset management for IP prefixes and addresses, namespaces, and zones, including role-based access control for managing DDI assets and services. |
| 2. (i) human resources security, access control policies and asset management | Integrity | Supports single sign-on (SSO) via SAML 2.0 and acts as a service provider for SSO. |
| Edge | Custom policy enforcement for intelligent DNS resolution based on source IP, site, or content. | |
| 2. (j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate. | Edge | Supports configuration as a service provider in a SAML 2.0 federation, enabling an SSO user experience. |
| Chapter IV, Article 23, Reporting Obligations | ||
| 4. Member States shall ensure that, for the purpose of notification under paragraph 1, the entities concerned submit to the CSIRT or, where applicable, the competent authority | ||
| (d) a final report not later than one month after the submission of the incident notification under point (b), including the following: | ||
| 4. (d) (i) a detailed description of the incident, including its severity and impact; | Integrity | Provides the underlying IP, digital asset management, and service logs for incident investigation and event enrichment across multiple systems. Without an IP address management tool and related fresh DNS entries, incident logs lack context and meaning. |
| Edge | Intelligent DNS with extensive logging and deep querying allows for DNS forensics when rebuilding timelines and actions for digital events across an enterprise (including across private or public clouds). | |
| Infrastructure Assurance | Customizable dashboard for top 10 alerts to prioritize troubleshooting efforts based on the severity and frequency of identified issues. | |
| 4. (d) (ii) the type of threat or root cause that is likely to have triggered the incident; | Integrity | Provides core services and the context around netblocks, prefixes, namespaces, zones, and individual resource records to make sense of IPs, hostnames, and services throughout an organization. |
| Edge | With historical DNS query and response logging and deep DNS forensics capabilities, incident investigations can look deeper and further into what led to flows and connections being made. | |
| Infrastructure Assurance | Performs observability based on triggers like performance metrics, security flaws, or configuration drift. Once a trigger condition is met, auto-triage follows a root cause analysis workflow to surface related issues and determine the cause(s). | |
| 4. (d) (iii) applied and ongoing mitigation measures; | Integrity | Detect and block DNS-based threats and mitigate security risks associated with DNS hijacking and cache poisoning, DHCP snooping, and IP address conflicts. |
| Edge | Ongoing and intelligent mitigation delivered via DNS using ongoing threat intelligence feeds, automated blocking, SIEM integrations, policy enforcement, and machine learning (applied to evasion techniques like domain generation algorithms). | |
| Infrastructure Assurance | Codified domain expertise and community-contributed experience are used to auto-triage and recommend remediation steps, mitigating the risk of major outages for detected issues. | |
The outlook
Digital services and their secure operation are critical to the fabric of society. But with increased interdependence comes increased risk. Our responsibility to protect essential and important entities in critical sectors requires more accountability and cooperation than ever before.
Supported by BlueCat’s solutions for unified DDI, protective DNS, and network observability and health, organizations can rise to the mandate to meet NIS 2 requirements.
As threats evolve and regulations become more complex, organizations will need to continually adapt their cybersecurity strategies. The integration of advanced solutions like BlueCat’s will be crucial for maintaining security and compliance with NIS 2 and future regulations.
Learn more about how BlueCat can help you meet NIS 2 requirements.
This document is of a general and summary nature, provided for informational purposes only, and is not intended to be a substitute for professional advice and a detailed analysis of the Network and Information Security Directive (NIS 2) requirements. While we discuss how BlueCat products can assist with broader compliance efforts related to NIS 2, responsibility for ensuring compliance with all applicable laws and regulations remains with users of our products. Please review the full capabilities of BlueCat products, which can be found on our product documentation portal, and consult with your internal and external professional advisors regarding the appropriateness of BlueCat products for your intended purposes, including with respect to NIS 2 compliance.
Edge Resolver
Immediate DNS resolution in hybrid and multicloud environments
The solution: BlueCat Edge Resolver
Edge Resolver, a feature of BlueCat Edge, is an advanced solution for optimizing DNS resolution in hybrid and multicloud environments. It seamlessly connects DNS data from cloud-native and on-premises networks into one reliable map of DNS. It allows network teams to manage a single forwarding rule, providing consistent and efficient resolution, all while adapting to changes to provide the most direct resolution path. Edge Resolver automates zone discovery and ensures real-time accuracy to deliver reliable DNS for critical applications and services.
Resolving a query using Edge Resolver
As seen in Figure 1, employees or applications make their first hop query to BlueCat Edge for resolution. Edge will use a single namespace that forwards to the Edge Resolver service to access the always updated map of zones across on premises and cloud vendors. Finally, Edge Resolver delivers a direct resolution path without complex manual conditional forwarding rules. Edge Resolver breaks down discovery barriers to DNS resolution for endpoints. It surmounts routing conflicts to resources and prioritizes cloud-native or on-premises DNS resolvers based on the origin.
Figure 1. Resolving a query using Edge Resolver
Features
Multi-environment discovery
Continuously discover DNS zones across on-premises, cloud, and third- party services, delivering optimal DNS responses based on client location and more.
Direct resolution path
By knowing exactly where each DNS record resides, Edge Resolver skips unnecessary recursive steps, significantly reducing DNS resolution times.
Adaptive cache
Clients receive tailored answers based on their location, user profile, and other relevant factors, which reduces latency and improves network efficiency.
Seamless cloud integration
Built for hybrid environments, Edge Resolver integrates with AWS, Azure, and Google Cloud, allowing users to manage DNS records across multiple platforms.
Continuous polling
Edge Resolver polls for changes to DNS zones, updating its map instantly as environments shift and evolve.
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
Enable zero-touch automation for DDI
Streamline network operations with advanced automation and integrations
The solution: BlueCat Gateway
Gateway allows you to automate and transform mission-critical business requirements into DNS, DHCP, and IPAM workflows, plugins, and applications. Moreover, Gateway enables the rapid development of turn-key integrations with existing technology investments.
Zero-touch automation frees IT teams from time-consuming, error-prone, and repetitive network configuration and provisioning tasks so they can focus more on innovation.
Best of all, with everyday network tasks and functions automated and repetitive processes controlled and managed automatically, network service availability and application performance improves.
Figure 1. Traditional networks vs. Gateway configuration
Features
Automated configuration and provisioning
Gateway automates the DNS services necessary to provision and deallocate cloud and on-premise resources. This enables IT to respond faster to user requests. Automated cloud provisioning reduces bottlenecks in delivering cloud services.
Gateway self-service via web forms
Gateway provides self-service capabilities to end users by automating IT service requests via built-in web forms. Gateway empowers IT teams to instantly meet the broadest range of unique end-user requirements.
Integrate Gateway with BlueCat Labs
Gateway integrates with BlueCat Labs, our community-powered GitHub repository. Here you’ll find a wide range of tools, including production-ready certified workflows, examples, and unique community-contributed solutions.
Gateway workflow test environments
Gateway allows organizations to build, verify, and validate modules in a test environment, and easily promote them to production. This modular approach simplifies change and workflow management.
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
Out-of-the-box visibility and control over DNS traffic
With room for adding networking, cloud, DNS GSLB, and security capabilities
About BlueCat Edge
BlueCat Edge is our intelligent DNS resolver and caching layer that provides unprecedented visibility and control over DNS traffic. You can quickly and easily deploy Edge in any hybrid cloud environment. As the first hop of any DNS query, Edge intelligently directs DNS traffic, tames conditional forwarding rules, blocks malicious DNS queries, and helps monitor and collect all DNS query and response data for diagnostics and investigations.
Figure: Edge offerings start with Smart Cache, with add-ons for networking, cloud, DNS GSLB, and security.
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
BlueCat Omnipeek
Endpoint packet capture and analysis for faster mean time to resolution of network and security issues
The solution: Omnipeek for Windows
BlueCat Omnipeek is a Windows-based endpoint packet capture and analytics solution that delivers intuitive visualization and practical forensics for faster resolution of network and application performance issues, as well as security investigations. Omnipeek builds on years of LiveAction packet intelligence, offering customizable workflows and visualization across multiple network segments to enable real-time resolution of network performance and reliability issues. With advanced geolocation, security, usability, and performance features, Omnipeek offers a powerful user experience that enables rapid analysis and troubleshooting of wired and wireless networks, from the largest data centers to the smallest offices.
Features
Comprehensive media and application monitoring
Get complete visibility into Layer 7 traffic, including real-time VoIP monitoring with call playback, as well as analysis of voice, video, and wireless performance.
Intuitive visualization
Explore network activity with interactive dashboards and graphical displays showing utilization, protocols, flows, applications, and geolocation data.
Expert analytics and alerts
Leverage built-in expert analysis for rapid problem detection, with automatic alerts triggered by anomalies or policy violations.
Flow-centered analytics
Monitor response time, throughput, and potential issues in real time with traffic organized by flows (conversation pairs).
Endpoint visibility and forensics
Capture and analyze traffic directly from Windows-based laptops and servers for faster troubleshooting and root-cause identification.
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
BlueCat and Equinix
A partnership for a hosted DDI management solution in multicloud environments
The solution: BlueCat Integrity on Equinix Network Edge
BlueCat and Equinix bring BlueCat’s core DNS and DHCP solution on Equinix Network Edge, which is hosted by Equinix and delivered by BlueCat. The straightforward configuration process through an automated workflow enables customers to swiftly deploy devices in a flexible as-a-service model. This solution extends BlueCat Integrity to Equinix Fabric, making it easy to provide DDI services to endpoints across clouds and endpoints connected over other networks.
Deploying BlueCat Integrity on Equinix Network Edge avoids high egress fees and variable costs that come with deploying in the public cloud. With centralized management and cost-effective scalability, Equinix Network Edge and BlueCat Integrity provide a change-ready cloud infrastructure solution for businesses striving for efficiency, agility, and cost savings.
Features
DNS
Integrity’s feature-rich recursive and authoritative DNS solutions can be deployed in any environment, delivering a responsive and reliable network that manages unwanted traffic, rapidly enables core services, and speeds application performance and availability.
DHCP
Integrity’s DHCP solution offers built-in security, high availability, a scalable architecture, and dual-stack support. We help you make the most of limited IPv4 space and manage dual-stacked IPv4 and IPv6 environments.
IP address management
BlueCat Address Manager provides an authoritative source of intelligence and insight into the relationship between the devices, users, and IP addresses on your network, using built-in IP modeling tools and network templates for simplified management.
Full-featured APIs
Integrity enables an automated environment through a robust library of APIs that facilitate continuous updates, improve threat detection, and enforce policies by providing instant access for users and applications. Our API-first approach works with any environment and optimizes existing IT investments.
High availability
Integrity delivers highly available DDI services across the enterprise, with the flexibility to deploy in highthroughput, centralized architectures or fully distributed environments. DNS and DHCP failover ensure that IPv4 and IPv6 retain the highest standards of service uptime.
Integration with Equinix Network Edge
Equinix Network Edge is available globally, enabling a highly available platform through geographically redundant options. High availability can also be achieved through compute and network layer redundancy.
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
Threat Protection: policy-based workflow for securing DNS queries
Block attacks at the DNS layer, stopping threats before they ever reach your business
The solution: BlueCat Threat Protection
Smartphones, point-of-sale (POS) systems, desktops, and security cameras all rely on DNS to connect to the network and external sites. Whether the device is in a fixed location or is mobile and lives beyond the walls of your enterprise, BlueCat Threat Protection can protect it from accessing malicious content and further proliferating threats into your network.
The coordinated use of multiple, complementary security countermeasures is key to enterprise defense in depth strategies. Threat Protection delivers critical contextual network data extending across wired and wireless networks, virtual environments, and mobile endpoints, to augment industry-standard layers of security.
Defend against attacks with CrowdStrike threat feeds, the most active repository of threat intelligence in the industry. Subscribe DNS servers to the security feed, which is automatically delivered through DNS and continuously updated to block threats as they emerge.
To protect against malicious activity, networking and cybersecurity teams need to maintain visibility into DNS traffic. Threat Protection provides DoH blocking to retain visibility into DNS queries by preventing lookups to known public DoH resolvers.
Figure 1. Protect the enterprise by blocking DNS based phishing, DGA, and tunneling attacks
Features
Customizable actions
Each security feed can be configured with its own action, such as redirect, blocklist, do not respond, and log, allowing administrators to tailor the response to their needs.
Reporting
Aggregation of query and response data for a complete view of response policy activity with respect to threat category, source of threat, and targets.
IPAM integration
Integration with BlueCat IPAM, DNS and DHCP solutions enables Threat Protection to be centrally managed and orchestrated through BlueCat Address Manager.
Response policy zones
Provide organizations with the option of maintaining a set of hosts and zones that can be intercepted and handled accordingly.
Logging and visibility
Matches can be logged to determine which devices have attempted to access known malicious content to identify infected systems.
Localized lists
Organizations can augment and maintain their own local lists to blocklist additional sites or allowlist results.
Supported threat feeds
Threat Protection enables seamless integration of security intelligence, including BlueCat DOH blocklists, CrowdStrike, and other third-party threat feeds.
DOH blocking
Retain visibility into DNS queries by blocking lookups to known public DOH resolvers.
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
Reliable external DNS service
Easily manage cloud-hosted public DNS zone
The solution: BlueCat Cloud DNS Service
For BlueCat Integrity users, BlueCat Cloud DNS Service is a cloud-hosted external authoritative DNS service integrated seamlessly with BlueCat Address Manager. Customers can host their public DNS zones in a reliable, low-latency, and distributed denial-of-service (DDoS) attack-resilient Anycast network to allow external clients to access them. It can be used on its own or in combination with existing DNS service providers or self-hosted external DNS servers. Cloud DNS Service ensures that external DNS is always resolvable, providing a dependable solution for organizations.
By using Address Manager and Cloud DNS Service, you can easily provision public DNS zones. Even better, you can manage public zones effortlessly by adding, removing, and updating all zones from a single source of truth. This centralized approach not only saves time and effort but also ensures accurate and consistent management of all public zones.
Figure: How Cloud DNS Service works
Features
Centralized control panel
With a single control panel in Address Manager, manage internal and external DNS zones for dynamic updates
Easy zone deployment
Deploy updates or create new public zones for DNS resolution right from Address Manager or via RESTful API
DDoS mitigation
Ensure service uptime when under DDoS attacks with mitigation techniques that allow for static and dynamic rules applied immediately upon detection
Secure DNS resolution using DNSSEC
Seamlessly automate the zone signing process with DNSSEC to authenticate the origin and integrity of responses
Authenticated and secure updates to Cloud DNS Service
Use TSIG for secure communication between primary and secondary DNS servers
BlueCat’s Intelligent Network Operations (NetOps)
BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.
Network Management Megatrends 2026: AI, automation, and the future of NetOps
EMA research uncovers that enterprises are transforming network operations by adopting AI, scaling automation, and simplifying complexity across hybrid and multicloud environments.
Network operations is undergoing a fundamental transformation.
As hybrid and multicloud architectures expand and AI workloads accelerate, organizations are rethinking how they manage, secure, and optimize their networks. The Network Management Megatrends 2026 report from Enterprise Management Associates (EMA) highlights a shift toward more automated, integrated, and data-driven NetOps.
Even as enterprises still face skills shortages, fragmented tools, and rising complexity, they are progressing toward proactive operations. To get there, a new model is emerging—one that delivers automated action, real-time insight, and unified control across network operations.
BlueCat’s solutions support this shift by turning core DNS, DHCP, and IP address management (DDI) activity into continuous signals for real-time observability and intelligent operations.
What the research reveals
Enterprise network operations is evolving across technology, teams, and data. EMA found that:
- AI is now a primary driver of NetOps strategy, enabling automation and operational insight
- Automation is becoming foundational, especially for ongoing management and maintenance activities (known as Day 2 operations), such as troubleshooting and optimization
- Skills gaps are worsening, making it harder to scale operations without automation
- Operating models are shifting from traditional network operations centers (NOCs) to cross-domain NetOps, SecOps, and CloudOps teams
- Data quality and accessibility are emerging as critical success factors for modern network operations
Key research stats
79% of organizations say automating Day 2 operations is a high priority
AI-driven automation and insights are the No. 1 requirement for network management platforms
Skills gaps and fragmented tools are the top barriers to Day 2 automation
73% of enterprises may replace network monitoring tools within two years
Operations are shifting from traditional NOCs to cross-domain teams
DNS ownership is fragmented across teams—impacting visibility and control
42% struggle to collect network telemetry from cloud environments
Only 36% fully trust their network monitoring data, highlighting a barrier to automation
Key findings
NetOps teams are under significant pressure, with less than a third reporting successful network operations strategies. A major contributor to this issue is tool sprawl. Most teams rely on between four and 10 monitoring and troubleshooting tools, but only 32% are satisfied with them, and nearly three-quarters are considering replacing them.
AI has rapidly become the top strategic driver for NetOps, with nearly all organizations expecting to run AI workloads within the next two years. However, only 35% believe their current observability tools are ready to support operations for these workloads. Compounding the challenge are talent shortages: Over half of enterprises struggle to hire and retain skilled network engineers, particularly in areas like security, AI networking, and automation. Meanwhile, hybrid and multicloud environments add complexity, with limited visibility and skills gaps preventing many teams from effectively managing modern infrastructure.
Despite these challenges, AI is emerging as a critical enabler of NetOps transformation. More than half of organizations now view AI-driven capabilities as essential, particularly for automation and proactive operations. Teams that have adopted AI tend to be more mature, predictive, and efficient, reinforcing the need for modernization across tools, processes, and skill sets.
What the data shows
Automation is a priority, but barriers remain (Figure 34 + 37)
Most organizations consider automating Day 2 operations a high priority—but progress is often slowed by skills gaps and fragmented tooling. This reflects a central challenge in modern NetOps: scaling operations without scaling headcount. While automation is widely seen as essential, teams must address gaps in expertise, tooling integration, and data quality to fully realize its value.
Tool sprawl is driving a platform shift (Figure 18 + 23)
Enterprises rely on multiple tools to monitor and troubleshoot networks, and most plan to make changes to their toolsets soon. This signals a broader shift toward platform consolidation and integration. Rather than adding more tools, organizations are simplifying their environments to improve visibility, reduce operational overhead, and enable more consistent management across hybrid and multicloud infrastructure.
Foundational network data is becoming critical (Figure 30)
DNS logs and topology data are gaining importance—especially among more successful NetOps teams. As environments become more distributed, foundational data sources like DNS and topology provide essential context for understanding network behavior. These insights help teams correlate events across domains, accelerate troubleshooting, and strengthen security visibility.
What this means for network and security leaders
EMA’s research points to a clear direction for modern network operations: simplify, automate, and unify.
- Automation is essential for scaling operations and addressing persistent skills gaps
- Fragmented tools must be consolidated and integrated to improve visibility
- Trusted, high-quality data is foundational to effective automation and decision-making
- Cross-domain collaboration is critical as NetOps, SecOps, and CloudOps converge
- Faster resolution is becoming the priority—mean time to resolution (MTTR) matters more than detection alone
Organizations that align with these priorities will be better positioned to improve resilience, reduce downtime, and support increasingly complex digital environments.
Access the full EMA research report
Explore the trends shaping modern network operations
What you’ll learn:
- How AI and automation are transforming network operations
- Why organizations are consolidating tools and simplifying infrastructure
- Best practices for improving visibility, resilience, and performance
Today’s enterprise networks are complex to change, difficult to troubleshoot, and challenging to operate predictably.
They span cloud, SaaS, on-premises infrastructure, remote sites, edge locations, and constantly changing workloads. Telemetry volumes continue to explode while operational context becomes increasingly fragmented. And network teams are constantly fielding change requests, adding users and devices, and responding to security threats.
The result is overworked and under-resourced network teams.
If you’re attending Cisco Live 2026 and evaluating:
- AI for network operations;
- Observability platforms;
- DNS, DHCP, and IP address management (DDI) modernization;
- Network automation; and/or
- Operational resilience strategies,
Stop by the BlueCat booth (No. 8409) to learn firsthand how our Intelligent NetOps solutions can help you build a network that supports constant change without increasing operational, performance, or security risks.
Or, if you’re ready for a more in-depth conversation, book a meeting with us. We’d love to provide personalized insights and walk you through tailored demos. (Plus, if you book in advance, you’ll receive an exclusive swag bag and be entered to win a Nintendo Switch 2!)
In this post, you can read on for more depth about what you can see firsthand at BlueCat’s booth, as well as learn why our portfolio of offerings matters for network teams. We hope to see you from May 31 through June 4 at the Mandalay Bay Convention Center in Las Vegas.
What you’ll see firsthand at BlueCat’s booth
Troubleshooting network issues, changing the network, and determining whether changes have the desired effect are difficult and time-consuming. Teams disagree on causes, changes require constant validation, and complexity undermines confidence in operational data.
The fix starts at the network’s foundation. Organizations need real-time, unified network visibility and contextual intelligence to empower teams to act confidently and reduce risk. That’s the idea behind Intelligent NetOps.
Our booth will feature hands-on demonstrations of how BlueCat’s solutions directly address the operational challenges network teams face every day.
Unified network visibility
We’ll demonstrate how you can connect DDI, observability, identity, traffic, and policy into a single operational model. Instead of isolated dashboards and disconnected telemetry, you get a unified, real-time view of your network.
The result is faster root-cause analysis, better operational context, and greater confidence when making changes across complex hybrid environments.
Al-driven operational workflows
You can witness our AI-powered network agent, LiveAssist, delivering real-time intelligence on the network’s state and recommended operational improvements. LiveAssist enables organizations to:
- Operationalize AI across network operations
- Understand load and performance issues with AI-enabled workloads, traffic, and inference operations
- Perform root cause analysis
- Receive prescriptive recommendations on actions to take to improve network resiliency, performance, and security
LiveAssist virtual engineer
You can also discover how LiveAssist equips network teams to investigate issues, identify root causes, and take decisive action through a conversational workflow powered by real-time and historical network intelligence.
By combining telemetry, DDI data, configuration information, and identity context, LiveAssist reduces manual correlation and accelerates decision-making.
MCP servers and broader agentic AI integrations
We’ll also provide a tech preview of our Model Context Protocol (MCP) servers, which connect BlueCat network intelligence with AI agents, enterprise workflows, and development environments. These integrations provide secure access to a structured network context, enabling AI systems to query, analyze, and act on operational data more effectively.
Together, these capabilities can shift organizations toward intelligent, self-healing networks. They can confidently detect and prioritize issues, automate workflows, and ensure human control where it matters most.
Why BlueCat’s offerings matter for network teams
Your network team doesn’t need more disconnected alerts.
You need trusted visibility, rapid validation, better context, coordinated workflows, and reliable automation. BlueCat can help you move from fragmented operations toward a trusted operational model built around visibility, intelligence, automation, and control.
Organizations that adopt BlueCat’s Intelligent NetOps solutions are already seeing measurable operational improvements, including:
- An average 50% reduction in mean time to repair (according to a Forrester Total Economic Impact™ study),
- Improved resilience for critical infrastructure, and
- Faster operational workflows through automation.
When networking teams have real-time intelligence of the state of their network, they can deploy and make changes much faster, with far greater confidence in the outcome and dramatically reduced risk.
Our mission is to help network teams move quickly, boost confidence, reduce downtime, accelerate troubleshooting, and move toward an intelligent, self-healing network. As your network transforms, your ability to operate swiftly and confidently becomes your competitive advantage.
Learn more about how BlueCat is moving agentic AI from insight to action with its new AI integrations.
For years, BIND DNS and ISC DHCP on Linux have been the reliable workhorses of the enterprise network. But in today’s complex network environments, these reliable, legacy tools often come with a heavy maintenance tax.
If your network team is buried under a mountain of constant operating system (OS) patches, security vulnerabilities, and complex manual configurations, you aren’t alone. Managing traditional, open-source DNS, DHCP, and IP address management (together known as DDI) is resource-intensive and leaves little room for the strategic projects that actually move your organization forward.
You shouldn’t have to sacrifice the flexibility of your DDI environment to get enterprise-grade stability. Instead, with Micetro, BlueCat’s DDI orchestration platform, you can add Micetro DNS/DHCP Server (MDDS) appliances to provide a seamless path to modernization.
In this post, we first touch on the hidden costs of running BIND DNS and ISC DHCP on Linux. Next, we offer three key reasons to switch to MDDS and highlight key BIND DNS challenges and how MDDS addresses them. Finally, we explore the business value that MDDS offers and highlight the power of MDDS appliances for today’s network environments.
The hidden costs of the status quo
Organizations running BIND DNS and ISC DHCP on Linux often face a common set of hurdles:
- The patching treadmill: Constantly testing and applying OS-level updates to stay ahead of Common Vulnerabilities and Exposures (CVEs).
- Configuration drift: Inconsistent setups across different servers that make troubleshooting a nightmare.
- Resource drain: High-level engineers spend their time maintaining the network rather than on innovation.
MDDS appliances are designed specifically for network teams that need a turnkey experience without the overhead of managing a Linux distribution.
Why make the switch to MDDS?
Below are three reasons to make the switch to MDDS with Micetro.
1. A true turnkey experience
- Simplified setup: An appliance-based solution provides pre-integrated BIND and ISC DHCP, reducing the time and expertise needed to install and harden everything from scratch.
- Pre-validated environment: Hardware and software are tested together, eliminating guesswork about versions or interactions between the OS and DNS or DHCP services.
2. Patching and updates
- No OS-level upkeep: BlueCat manages appliance OS patches and BIND and ISC DHCP updates, freeing your team from the ongoing burden of testing.
- Consistent security posture: Regular Micetro appliance updates from BlueCat ensure consistent, predictable security hardening across your entire deployment.
3. Centralized orchestration and visibility
- Tight integration with Micetro: Micetro’s single pane of glass manages your DNS and DHCP services, providing real-time visibility, logging, and automation for all your resources.
- Policy consistency: Enforce uniform DDI policies from a single console, rather than juggling multiple servers and configuration files.
Comparing BIND challenges to MDDS advantages
The table below highlights several common challenges with BIND DHS and how MDDS addresses them.
|
BIND DNS challenge |
MDDS advantage |
|
Manual OS patches and upgrades |
Automated updates through Micetro’s centralized management |
|
Inconsistent configurations across servers |
Standardized appliance deployment with centralized management |
|
Complex disaster recovery |
Built-in high availability with simple failover configuration, automated backup and restore |
|
Difficult to scale |
Unlimited scalability with no appliance limits for Micetro customers |
|
Separate management interfaces | Single pane of glass for all DNS and DHCP administration—BIND, Microsoft, MDDS, or others |
|
Limited integration capabilities |
Micetro API for automation and orchestration |
|
Security vulnerabilities |
Hardened appliance with regular security updates, applied to all appliances in just a few clicks |
The return on investment of modernization with MDDS
Beyond just technical specs, moving to MDDS delivers tangible business value:
- Reduced operational costs: MDDS eliminates the need for ongoing OS patching or BIND updates, resulting in fewer maintenance windows and reduced staff hours.
- Improved network uptime and resiliency: MDDS supports geo-redundancy and failover, mitigating single points of failure.
- Faster deployments and migrations: Micetro’s automated data cleansing and scope migration significantly shorten project timelines.
- Flexible growth path: MDDS allows for scaling with additional appliances as the business grows or keeping certain sites on BIND for a phased transition.
BlueCat Gen5 appliances for the highest performance
For environments that demand the highest performance, MDDS runs on our latest BlueCat Gen5 appliances. These rack-optimized systems feature dual-power AC/DC supplies and lights-out management, ensuring they can handle the most intensive enterprise throughput requirements.
The combination of Micetro’s orchestration and MDDS appliances offers the best of both worlds: the power of a modern DDI platform and the simplicity of dedicated hardware. Whether you are consolidating remote branch servers or finally moving away from manual Linux management, BlueCat is here to help you transform your landscape.
Ready to simplify your DNS infrastructure? Request a demo of Micetro and MDDS today to see how we can help you eliminate the maintenance tax and get back to building the future of your network.
Frequently asked questions
MDDS is a turnkey appliance, meaning it comes with pre-integrated, hardened BIND and ISC DHCP software. This eliminates manual installation, OS-level patching, and configuration guesswork, enabling a much faster, more secure deployment.
Yes. Micetro lets you manage BIND and MDDS appliances from a single interface. This flexibility lets you keep certain sites on BIND while transitioning others to MDDS, providing a gradual, controlled migration path.
Yes, MDDS serves as a complete, enterprise-grade alternative to self-managed BIND. It provides the same core DNS functionality but adds the benefits of automated updates, centralized management through Micetro, built-in high availability, and dedicated hardware performance.