Freedom251 › Honeypot Software
DentiGrid
What DentiGrid is
DentiGrid is a SIEM-native honeypot platform for MSSPs and enterprise SOC teams. It uses synthetic decoys, including SSH keys, S3 assets, Postgres tables, Kubernetes secrets, API keys, and fake Active Directory accounts, to detect unauthorized activity. The maker says it deploys without an endpoint agent in under five minutes using RMM, Microsoft Intune, Jamf, or Ansible, and that lures consume 0% CPU or memory. Triggered alerts can include an origin IP, process tree, and target node, and can be sent to SOC webhooks. Listed SIEM connections include Splunk, Microsoft Sentinel, Elastic Security, IBM QRadar, and ArcSight event export. The Splunk add-on includes HEC streaming, a modular input feed, and three prebuilt SOC dashboards. Pilot and Professional organizations connect to managed nodes; Enterprise organizations can provision self-hosted decoys in AWS, Azure, and on-premises subnets via Docker. Commercial licenses include multi-tenant management, telemetry processing, SIEM connectors, and SLA-backed support.
Who it suits
DentiGrid is intended for MSSPs and enterprise SOC teams, including MSSPs needing isolated tenant telemetry views. It may suit teams seeking decoy alerts that feed into listed SIEM integrations and SOC webhooks.
What it does well
- Decoys include cloud, database, credential, and Kubernetes lures.
- Deployment is agentless and stated to take under five minutes.
- Alerts can include origin IP, process tree, and target node.
- Telemetry is encrypted and HMAC-signed, according to documentation.
What to know first
- The listed maximum is three decoys.
- Data retention is 30 days.
- Commercial licensing has no listed price.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Commercial MSSP & Enterprise | Commercial licensing for MSSPs and enterprises · pricing not stated | On request |
As dectrax.com lists them, read 30 Sept 2026. The maker's own page has the final word.
Verdict
DentiGrid combines decoy-based detection with SOC alert details and several SIEM connections. Its stated limit of three decoys and 30-day retention are important to weigh for a deployment.
Facts from DentiGrid's own pages
- Alert details
- Alerts can include the origin IP, process tree, and target node, and can be sent to SOC webhooks. · dectrax.com, 30 Sept 2026
- Alerts
- Triggered lures send SOC webhooks with high-context telemetry such as origin IP, process tree, and target node. · dectrax.com, 30 Sept 2026
- API
- Dectrax documentation provides a REST API reference and an example API request for checking an IP threat status. · dectrax.com, 30 Sept 2026
- Audience
- Dectrax describes DentiGrid as designed for MSSPs and enterprise SOC teams, including multi-tenant management for MSSP operations. · dectrax.com, 30 Sept 2026
- Decoy assets
- Its synthetic lures include SSH keys, S3 buckets, Postgres tables, Kubernetes secrets, API keys, and fake Active Directory accounts. · dectrax.com, 30 Sept 2026
- Decoy types
- Its listed lures include SSH keys, S3 assets, Postgres tables, Kubernetes secrets, and API keys. · dectrax.com, 30 Sept 2026
- Deployment
- Dectrax says DentiGrid deploys agentlessly in under five minutes using RMM, Microsoft Intune, Jamf, or Ansible tooling. · dectrax.com, 30 Sept 2026
- Deployment options
- Pilot and Professional organizations connect to managed nodes, while Enterprise organizations can provision self-hosted decoys in AWS, Azure, and on-premises subnets via Docker. · dectrax.com, 30 Sept 2026
- Endpoint footprint
- Dectrax states that its lures consume 0% CPU or memory and require no agent footprint. · dectrax.com, 30 Sept 2026
- Endpoint impact
- The maker says DentiGrid lures consume 0% CPU or memory and have no agent footprint. · dectrax.com, 30 Sept 2026
- Hosting
- The documentation says Enterprise organizations can provision self-hosted decoys across private AWS, Azure, and on-premises subnets via Docker. · dectrax.com, 30 Sept 2026
- Integrations
- Listed SIEM integrations include Splunk, Microsoft Sentinel, Elastic, and IBM QRadar; the page also describes ArcSight event export. · dectrax.com, 30 Sept 2026
- Intended customers
- The maker identifies MSSPs and enterprise SOC teams as DentiGrid’s intended users. · dectrax.com, 30 Sept 2026
- Multi-tenant use
- The maker describes a multi-tenant management portal with isolated tenant telemetry views for MSSPs. · dectrax.com, 30 Sept 2026
- Purpose
- DentiGrid is a SIEM-native honeypot platform for MSSPs and enterprise SOC teams that uses decoy assets to detect adversary activity. · dectrax.com, 30 Sept 2026
- Security
- The documentation says sensor telemetry is encrypted and HMAC-signed before ingestion, and verified adversary IPs can be added to Palo Alto and Fortinet External Dynamic Lists. · dectrax.com, 30 Sept 2026
- SIEM integrations
- Dectrax lists Splunk, Microsoft Sentinel, Elastic Security, IBM QRadar, and ArcSight integrations. · dectrax.com, 30 Sept 2026
- Splunk package
- The Splunk add-on is described as including HEC streaming, a modular input feed, and three prebuilt SOC dashboards. · dectrax.com, 30 Sept 2026
- Support
- Dectrax says commercial licenses include the multi-tenant management portal, telemetry processing pipelines, SIEM connectors, and SLA-backed technical support. · dectrax.com, 30 Sept 2026
- Threat handling
- Dectrax documentation says telemetry is encrypted and HMAC-signed, and verified adversary IPs can be added to Palo Alto and Fortinet External Dynamic Lists. · dectrax.com, 30 Sept 2026
Where DentiGrid stands on Freedom251
- Honeypot Software#14 of 21