Enterprise Security Connector is a virtual machine (VM) that you deploy in your enterprise to block malicious traffic and record information about machines in your network. Depending on your configuration, Security Connector can act as a DNS forwarder and a DNS sinkhole.

• Secure DNS Forwarder. Acts as an internal DNS resolver that forwards traffic to ETP where ETP policy is applied. DNS Forwarder allows you to identify machines that are making requests. By default, the DNS forwarder is enabled in Security Connector version 2.6.8 or later. For more information, see Security Connector as a DNS forwarder.
• DNS sinkhole. Receives suspicious or malicious traffic. As a DNS sinkhole, Security Connector identifies machines that are infected with malware, attempts to download malware, or communicates with command and control servers. For more information, see Security Connector as a DNS sinkhole.