TotalHealSaaSGuard

How it works

1. SeeWith DNSGuard on your networks, apps appear within the hour: users, look-ups, networks and use by day.
2. ScoreEach app gets a risk from its category and how widely it is used.
3. DecideSanction the tools the company pays for, tolerate the harmless ones, block the rest.
4. EnforceA blocked app’s domains are refused by DNSGuard on every network and desktop that uses it.
5. Stay aheadA new high-risk app raises an alert; categories you choose are blocked the first time a new app appears.

Reference architecture

Key capabilities

• Discovery without an agent or a proxyUsage comes from DNSGuard’s hourly SaaS counts, full DNS logs where a policy keeps them, and the host names in NetWatch sensor and firewall events already in TotalHeal. Nothing new is installed and no traffic is decrypted.
• Privacy by designDNSGuard sends the app and how many clients used it in each hour — never URLs, page content or anyone’s browsing history. Personal (BYOD) networks and policies that log nothing are never counted, and discovery can be turned off per policy.
• A catalogue of 106 cloud appsOffice suites, storage, file transfer, messaging, video meetings, generative AI, collaboration, document tools, translation, e-signature, development, cloud consoles, paste sites and tunnels, remote access, CRM, marketing, web mail, social media and streaming — matched by their domains, the most specific first.
• Risk for every appEach category has a base risk from what it lets data do (file transfer, paste sites and tunnels: very high; generative AI, remote access, document tools: high); wide use raises it, and a sanctioned app is lowest.
• What each app is used forLook-ups, refused look-ups, users, networks, sources, first and last seen, and use by day over up to 90 days, for every app seen or decided.
• Sanction, tolerate or blockEvery decision carries a note and is kept in the audit trail. Blocking puts the app’s domains on the deny list of every DNSGuard policy straight away; unblocking or sanctioning removes exactly the domains SaaSGuard added and nothing an administrator put there.
• New risky apps raise an alertEvery hour SaaSGuard checks for apps used for the first time; a high-risk one nobody has reviewed raises an alert mapped to MITRE ATT&CK (T1567 exfiltration over web services, T1219 remote access software) in the same incident queue as endpoint and identity alerts.
• Block new apps automaticallyChoose categories — paste sites and tunnels, file transfer, remote access — and a new app in them is blocked the first time it is seen. Apps you already decided about are never changed.
• Generative AI in viewChatGPT, Claude, Gemini, Copilot, DeepSeek, Perplexity and other AI assistants are their own category, so you can see who uses them and sanction the one the company pays for.

In the console

Deployment options

System requirements

Technical specifications