Frequently Asked Questions About Obsolix

A DNS security platform that runs inside your organization. It monitors DNS queries in real time and detects, blocks and reports malicious domains using threat intelligence and behavioral analysis. It is developed in Türkiye by Ankara-based Korsis Teknoloji.

Yes. R&D and engineering are done in Ankara, and support is provided from Türkiye. It qualifies for the domestic software price advantage in Turkish public tenders.

Global DNS security services such as Palo Alto, Cisco Umbrella and Cloudflare run their analysis in the vendor's cloud and send your logs there. Obsolix stops the same threats inside your organization, works on air-gapped networks and is independent of your firewall brand. It works alongside your existing systems.

A firewall inspects traffic after the connection is made. Obsolix looks earlier, at the question "which address is this computer trying to reach?", and stops a malicious destination before the connection even starts. At the DNS layer it sees what a firewall cannot see in encrypted traffic, knows which user made the request via Active Directory, and forwards its verdict to your firewall and SIEM. It does not replace them; it works alongside them.

No. Obsolix is a layer in front of your existing DNS server; it does not touch your network, your firewall or your DNS server. Even if the Central, the database or threat intelligence becomes unreachable, DNS resolution continues uninterrupted (fail-open). If the service goes down, Kubernetes restarts it automatically, and your existing server remains the secondary DNS on clients. Rolling back is a single step: pointing the DNS address in DHCP back to its old value.

No. Logs, user identities and analysis results stay only on your organization's servers. The system sends no data out; it only downloads threat intelligence updates.

Yes. Obsolix keeps protecting and making decisions without an internet connection; the current threat intelligence and policies are kept inside the organization. Software updates can be installed as offline packages, and threat intelligence can also be fed from TAXII sources on your internal network.

Known malicious domains, DGA domains, DNS tunneling, NXDOMAIN storms, fast-flux and brand impersonation (lookalike) domains.

On your organization's server; it does not connect to any external AI service. The model shows the reasoning behind every decision in the interface.

Yes. It runs entirely inside the organization, as required by Turkish public-sector information security regulations, and is currently in use at public institutions.

Yes. It can send to multiple SIEM targets at once in CEF, LEEF and Syslog formats over UDP, TCP and TLS.

Yes. With agentless mapping from Active Directory, logs and risk analyses are shown with user names.

No. Obsolix is a layer in front of your existing DNS server; it does not touch the server itself. Your existing server remains the secondary DNS on clients, and rolling back is a single step: pointing the DNS address in DHCP back to its old value.

Ready-made sizing profiles cover everything from a small office to tens of thousands of users, and it currently runs at a public institution with more than 200,000 users.

Fill in the demo request form, and our team will get back to you with a deployment scenario suited to your organization.

Demo request form