Control D

Control D is DNS filtering: each endpoint (a device, a router or a site) sends its DNS to its own resolver, which enforces a profile of filters, services, custom rules and a default rule. Connect it once with an API token from your main Control D organization, and Neo agents can work across the sub-organizations you keep for your customers.

​

What Neo can do with Control D

• On a “this site is blocked” ticket, or a request from a Control D block page (“I was trying to access the following URL”), confirm whether Control D blocked the domain, and name the filter, service or rule that did. Neo reads the customer’s Activity Log and runs a Domain Test on the user’s endpoint, which says how the endpoint’s policy decides the domain right now
• Allowlist the domain with a bypass rule on the customer’s own profile once a technician approves it, then test the domain again to confirm
• Block a phishing domain from a ticket with a block rule
• Report blocked queries for a QBR or a security review: blocked, allowed and redirected counts, top blocked domains, and the filters and services that blocked them
• Read and manage endpoints, profiles, filters, services, internal domains and the IPs an endpoint is authorized from

​

Each ticket stays with its customer

Your main organization’s token reaches every sub-organization. On a ticket that names a company, Neo sends a call only for the Control D sub-organization that company is mapped to, and refuses the calls that reach every customer (the sub-organization list, billing). Those run from a chat with Neo or a scheduled agent. A bypass rule goes on the customer’s own profile. Neo never changes a profile of your main organization on a call for one customer, because a global profile is shared with every sub-organization.

​

Rules ask first, by default

A bypass rule lets a domain through. The Helpdesk and IT Admin presets ask a technician before Neo adds, changes or removes a custom rule; only Full Automation does it on its own. Deleting or disabling an endpoint, and deleting or pausing a profile, always ask, whatever the agent’s settings, because Control D stops filtering that endpoint. So does turning off an organization’s required two-factor sign-in.

​

Secrets stay out of the run

Neo hides an endpoint’s deactivation PIN before the agent or a script reads the answer, and never sets or clears it, or an endpoint’s custom ctrld configuration. Neo never sends your account password, which unlocking a locked profile needs.

​

Your customers are mapped to companies

Neo matches your Control D sub-organizations to the companies in your PSA and keeps the mapping on the Control D card’s Organization Mapping tab, refreshed on each PSA metadata sync. Matching uses the sub-organization name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Next comes the sub-organization’s website against the company’s website, and last an AI match for the long tail. A name that matches exactly one of your PSA companies, as it is or after stripping a legal-form suffix, or a match you confirm, is handed straight to your agents. A website match and an AI match wait for you on the Organization Mapping tab. A name two of your PSA companies share, or two sub-organizations that match one company, is left unmapped until you set it. Confirm or correct each there; a mapping you set by hand survives every later sync. See Control D API for the permission groups.

​

Next steps