Verdicts on every DNS query, inside your network.

One Docker image takes your log stream, pulls out the domain names, looks them up in batches and writes each event, with its risk level and score, to your SIEM, Elasticsearch, Kafka, an HTTP endpoint or a file. No per-product integration.

Pull from Docker Hub Quick start

verdictiq/connector:0.1.0
linux/amd64 · linux/arm64
Distroless, non-root, no shell
One YAML file on /data

Sourcesyslog, HTTP / HEC, Kafka, file
ParserExtracts the domain
Limit + queueBursts dropped and counted
Verdict cacheOne lookup per domain per hour
BatchUp to 1,000 domains
Only domain names leaveVerdict APIPOST /verdict/bulk
Risk filterPer output minimum level
OutputsJSON, CEF or LEEF

Run it in one command

Docker Engine 20.10 or later on amd64 or arm64. The web UI is published on the host's loopback address only; drop the input ports you do not use.

docker run -d --name viq-connector \
  --restart unless-stopped \
  --stop-timeout 30 \
  -p 127.0.0.1:5005:5005 \
  -p 514:5514/udp -p 514:5514/tcp \
  -p 8088:8088 \
  -v viq-connector-data:/data \
  verdictiq/connector:0.1.0

Check that it is up

curl http://127.0.0.1:5005/health

Answers with status "ok". On first start the connector writes a default /data/config.yaml.

What the flags do

-p 127.0.0.1:5005:5005: Web UI, reachable from this host only.
-p 514:5514/udp -p 514:5514/tcp: Devices send syslog to port 514; the connector listens on 5514 inside the container.
-p 8088:8088: HTTP and Splunk HEC input. Drop it if you do not push logs over HTTP.
-v viq-connector-data:/data: Keeps configuration and state across restarts and upgrades.
--stop-timeout 30: Lets in-flight lookups and writes finish on stop.

First setup happens in the browser

A setup wizard writes the whole configuration for you. Create your VerdictIQ account before the first sign-in.

Open http://localhost:5005 on the Docker host. On a remote server, open an SSH tunnel first and use the same address on your workstation.
ssh -L 5005:127.0.0.1:5005 <server>
Choose Sign in with VerdictIQ account. Sign in on the portal tab and allow access; the tab closes and the wizard continues.
Add the first source: for example UDP syslog on :5514 with the preset for your DNS server. Paste a real log line into Test parser.
Add the first output, where enriched events go. Send test event checks the connection.
Point your devices at port 514 of the Docker host, then watch Live Events and Metrics.

Nothing is sent to VerdictIQ while no output works: events are counted as dropped, so no quota is used before results can be delivered.

Your logs in, your SIEM out

Every source has a parser preset. Every output writes only the events at or above its own minimum risk level.

Sources
Type	Use it when
`syslog`	Devices and DNS servers send syslog over UDP, TCP or TLS.
`http`	A shipper pushes JSON or NDJSON, or Splunk HEC (forwarder, Vector, Fluent Bit, Cribl). A token is always required.
`kafka`	DNS logs already sit on a Kafka topic. TLS and SASL supported.
`file`	A DNS server writes a log file on the same host. Rotation is followed.

Parser presetsbindinfobloxdnsmasqwindows_dnscefleefjsonkvregex

Outputs
Type	Formats	Notes
`syslog`	json · cef · leef	UDP or TCP, RFC 5424, reconnects on its own.
`elasticsearch`	json	Elasticsearch and OpenSearch Bulk API, dated index names.
`http`	json · ndjson · hec · cef · leef	POST or PUT with bearer, Splunk or basic auth.
`kafka`	json · cef · leef	Producer with optional domain key, compression and TLS.
`file`	json	JSON lines at an absolute path.

What leaves your network

Only domain names, over HTTPS. Raw log lines, client addresses and every other field go only to the outputs you configure.

Quota follows domains, not events: The connector looks up the registrable domain: www, mail and cdn of the same site are one lookup, reused for an hour from the cache. API use follows distinct domains per hour, not your event rate.
Never sent: IP addresses, single-label names and internal suffixes such as .local, .corp and .arpa.
Keep the UI on localhost: The UI requires a VerdictIQ sign-in of the connected organization and answers only to localhost. Use an SSH tunnel or kubectl port-forward to reach it remotely.
Outbound access it needs: HTTPS to api.verdictiq.io for lookups and auth.verdictiq.io for sign-in. HTTPS_PROXY, HTTP_PROXY and NO_PROXY are honored.

The enriched record

Each event keeps its raw line and parsed fields and gains an indicator and a verdict block. CEF, LEEF and syslog outputs map the risk level to their own severity.

{
  "@timestamp": "2026-10-01T12:30:45.123Z",
  "source": {
    "id": "core-dns",
    "name": "Core DNS",
    "address": "192.0.2.53:41234"
  },
  "event": {
    "raw": "<30>Oct  1 12:30:45 ns1 named[1234]: client 192.0.2.10#53211: query: www.example.com IN A",
    "fields": { "client_ip": "192.0.2.10", "query_type": "A" }
  },
  "indicator": {
    "value": "www.example.com",
    "domain": "example.com",
    "normalized": "example.com"
  },
  "verdict": {
    "score": 82,
    "risk_level": "high_risk",
    "evidence_saturation": "strong",
    "signal_count": 4,
    "cached": false,
    "status": "ok"
  }
}

Risk level to output severity
risk_level	CEF	LEEF sev	Syslog
`clean`	0	1	6 info
`low_risk`	2	2	6 info
`moderate`	4	4	5 notice
`suspicious`	6	6	4 warning
`high_risk`	8	8	3 error
`critical`	10	10	2 critical

Pull the image

Every configuration key, metric, API status and troubleshooting step is on the Docker Hub page.

Open Docker Hub Create a VerdictIQ account