How the Greywall works

Definitions

Compartment. A company in Securd. It is the boundary for users, policies, identities, logs, first-seen baselines and billing. Data does not cross compartments except for lists an MSSP parent publishes to its tenant compartments. An organization runs one compartment or several, for example per business unit or per environment.

Policy. The unit of scope inside a compartment, one per agent role: category rules, allow and block lists, Greywall mode and hold time. The first-seen baseline is kept per policy.

Identity. A virtual site: a DoH address issued to one agent instance and bound to a policy. A static site is an egress IP bound to a policy. Every query is attributed to one identity or site and therefore to one policy. Identities bound to the same policy share that policy's baseline.

First-seen. A name the policy has not previously resolved. The query event carries dns_q.event = "new" and reason = "first-seen". The baseline is maintained per policy inside the compartment. It is not derived from vendor telemetry and is not shared across policies.

Hold. A window, in seconds, during which a first-seen name resolves to the policy's block page address instead of its actual answer. Set per policy as greylist.holdtime.

Rank. An establishment measure on every event, derived from the global DNS graph. Names with inbound references carry a rank; names without carry none. A first-seen name with no rank warrants review before approval.

Three postures on one setting

Learn. Greywall enabled with no hold. First-seen names are recorded and resolved normally. Used during initial deployment of an agent to establish the set of required destinations.

Hold. Greywall enabled with a hold time. First-seen names are held. Names are approved or blocked during the window, or released according to policy when it expires. Shorter holds suit development agents; longer holds suit production agents.

Block. First-seen names are denied until approved. Combined with a default-deny policy for agents that hold production credentials.

Lists, feeds and categories

A name on the policy's allow list is not held; scope templates populate the allow list before enforcement begins. A name on the block list, on a threat feed, or in a denied category is blocked regardless of first-seen status. A feed match carries threat_info.categories and emits the threat.detected webhook. The hold applies to names not covered by any list or rule that the policy has not previously resolved.

What the agent sees

A successful resolution to the block page address, rather than NXDOMAIN or a timeout. Application code distinguishes a held destination from an unavailable service by comparing the answer against the address shown in the console. The developer library provides reference code for each supported runtime.

What the event looks like

{
  "@timestamp": "2026-09-12T14:03:05.221Z",
  "action": "greywall",
  "reason": "first-seen",
  "client": { "ip": "10.40.3.17" },
  "dns_q": { "name": "api.newai-svc.xyz", "domain": "newai-svc.xyz", "event": "new", "rank": null },
  "dns_a": { "data": "<block page address>" }
}

Approving and blocking

An approval is an allow list entry with a source and a source reference. A block is a block list entry, optionally with an expiry. Both are published to the resolvers on the next publish and recorded in the change log with the user, timestamp and content. Entries are created from the console, the API, or a chat integration.

Relationship to newly-seen-domain categories

The Greywall is not a newly-registered or newly-seen-domain category. Those categories are global and vendor-defined, and allow a domain by default once it ages out. The Greywall baseline is maintained per policy inside the compartment, the hold duration is set by the policy, and a held name is not allowed by default as it ages.

Related

The Greywall solution page covers compromised agent scenarios; the Why Agent DNS page covers the limits of a DNS-layer control and the accompanying egress rules.