Threat & Vulnerability · Integration
DNSFilter
Add DNSFilter to your product for your customers, and give your AI agents governed access to it.
DNSFilter's API at api.dnsfilter.com/v1 issues a token from an email and password exchange and then scopes every call to an organization id, so a multi-tenant caller has to carry that id explicitly rather than rely on a default. The objects that matter are networks, which are the public IP ranges or resolvers a site uses, roaming clients or Relay agents for off-network devices, and policies that bind category and threat rules to those assets. Query and block reporting is retention-limited by plan, so a report request beyond the retained window returns an empty set rather than an error, which reads as a working integration with no threats. Category names are fixed identifiers and allow or block lists are attached to a policy rather than to a network, meaning a change made against the wrong object silently affects nobody. fastn holds each customer's token, keeps the organization scoping right and handles upkeep.
In your product
Embedded for your customers. Per-tenant auth, no per-customer code, maintained by fastn.
Let a customer connect their own DNSFilter organization and choose which networks your product may read
Surface blocked-query detections and their categories inside your own security dashboard
Add or remove a domain from a customer's allow or block list from within your product's admin screen
Show which roaming clients have not checked in recently so a customer can chase the devices
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
Let an agent add a domain to a named policy's block list after a confirmed detection, leaving other policies untouched
Have an agent summarise the top blocked categories for a customer over the retained reporting window
Audit, per tenant, every policy change an agent made in DNSFilter and which organization id it was scoped to
Example prompt
Which domains were blocked most often for this customer's main office network last week?
Set up DNSFilter in 4 steps
- 01Enable the DNSFilter connector from your fastn dashboard.
- 02Have each customer authorise their own DNSFilter account, so calls run under their credentials rather than a shared key.
- 03Decide which findings, detections and assets your product needs, map those fields, then enable the actions and triggers you want.
- 04Call it from your product and expose it to your agents through the same governed connection.
Why teams use the DNSFilter integration
What you get by embedding it with fastn instead of building it yourself.
- Ship a DNSFilter integration without building it. Your customers connect their own DNSFilter account inside your product and work their findings, detections and assets there, with no per-customer code on your side.
- Handle the part that actually costs time: a rescan re-reports everything, so the same finding arriving twice must not read as two problems. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so a DNSFilter update is not your on-call problem.
- One integration serves your product and your agents. The same governed DNSFilter connection powers in-product features and gives AI agents scoped, audited access, so you get security findings in front of the people and systems that act on them without wiring it twice.
Used by these teams
Compare with
AWS Security Hub
Microsoft Sentinel
CrowdStrike FalconOften used alongside
Tools the same teams tend to run next to DNSFilter, across other categories.
ServiceNow
Okta
DatadogDNSFilter integration FAQ
How do I add a DNSFilter integration to my product?
Enable the DNSFilter connector in your fastn dashboard, then let each customer authenticate their own DNSFilter account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no DNSFilter client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own DNSFilter account?
Yes. Every connection is scoped to the individual customer, so each authorises their own DNSFilter account and only ever sees their own findings, detections and assets. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this DNSFilter integration?
Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. Let an agent add a domain to a named policy's block list after a confirmed detection, leaving other policies untouched
Who maintains the DNSFilter integration?
fastn does. When DNSFilter changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.
How does a new DNSFilter finding reach my product?
Through event triggers rather than polling, delivered per tenant, so your product reacts when a finding is raised or its severity changes rather than on a schedule that is always slightly out of date.
How is DNSFilter finding noise kept manageable?
Findings are deduplicated per asset so a rescan does not re-raise what you already have, and you can filter by severity and status before anything reaches your product. That matters more here than in most integrations, because the volume is what stops teams acting on any of it.
What can I build with the DNSFilter integration?
A common starting point: let a customer connect their own DNSFilter organization and choose which networks your product may read. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the DNSFilter integration cost?
It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding DNSFilter does not change your per-connector cost. You can start free with 3 connected accounts.
Add DNSFilter to your product
Start free with 3 connected accounts. No sales call required, and no per-customer integration code.