DNSEye is a DNS log analysis and threat detection platform that monitors outbound DNS traffic to identify malicious activity and trace it back to its origin. The platform uses a DNS Detection and Response (DDR) approach to detect anomalies in DNS traffic across devices, users, and applications. It covers both known and previously unseen threats, including detection of suspicious queries to firstly visited (previously unvisited) domains as a defense against zero-day threats. DNSEye enriches DNS log data bidirectionally using EDR/XDR telemetry and correlates it with domain threat intelligence from DNSSense's Cyber X-Ray platform. This enrichment enables security teams to pinpoint responsible users or applications behind suspicious DNS queries, along with timing and recurrence details. The platform includes a Security Incidents module that supports rule-based automation for incident response, using customizable rules based on threat intelligence feeds, best practices, and user-defined actions. AI engines handle complex or evolving incidents that fall outside predefined rule sets. A Security Gap feature provides visibility into areas of the network where existing security controls may be insufficient, helping teams prioritize remediation efforts. DNSEye is designed for rapid deployment (within one hour) without requiring network remapping or agent installation. It supports multi-tenant environments and integrates with various DNS server platforms. To reduce SIEM and SOAR costs, it forwards only actionable alerts rather than raw DNS logs.