Skip to main content

XDR / NDR POC validation

​
Generate the activity your POC needs—and keep the evidence.

DSP creates controlled, observable security activity, records exactly what it generated, and gives engineers evidence to compare against XDR/NDR detections during customer validation.

Run the first scenario →See the POC workflow
GenerateRun controlled network, web, identity, protocol, and host activity.
RecordKeep structured run evidence under one ID for repeatable validation.
CompareReview what DSP generated against detections in the connected platform.
DSP proves what activity it generated. It does not automatically claim that an alert fired or that an XDR case was successfully correlated. Detection and case outcomes must be verified in the connected security platform.

​
Fastest path

1

Install DSP

On a Linux host with Python 3.11+, Git, and curl:
2

Configure the first run

In the menu choose Configure environment, set the authorized target CIDR, select local, and use normal for the first test.
3

Run and review

Choose Run scenario, then Show latest report to review what DSP generated.

Quick Start

Use the simplest local-mode path from prerequisites to the first report.

POC Workflow

See the practical sequence from target discovery and controlled activity to XDR/NDR review and result recording.

Scenario Coverage

Review the current network, DNS, web, identity, and host-behavior scenarios.

XDR Correlation Demo

Combine DSP run records, NDR detections, and optional external alerts into a clear XDR investigation.

​
What you need

For the simplest first run, prepare:
  • a Linux operator host with Python 3.11+, git, and curl
  • an authorized target CIDR
  • network reachability from the DSP host to that target network
  • access to the XDR/NDR console for detection review
Normal DSP execution does not require an XDR API token. Webshell mode is optional and should be used only when activity must originate from an authorized host inside the target environment.

​
What DSP gives you

Controlled scenarios

Generate repeatable scan, DNS, web, identity, protocol, and host-behavior activity.

Discovery-driven execution

Start from a CIDR and let DSP use discovered hosts/services to drive scenario execution.

Evidence per run

Keep structured events, traffic summaries, validation output, reports, and verification templates under one run ID.

Simple coverage profiles

Use normal for representative targets or high to apply the same per-target volume across more discovered targets.

​
Current validation status

DSP v1.4.0 is documented as READY WITH KNOWN LIMITATIONS. Local execution plus real JSP and PHP webshell execution are validated. ASPX/Windows IIS remains preview because real Windows webshell runtime validation is still pending.

Check validation status

Review the exact provider and platform boundaries before a customer POC.