We got tired of
renting our own data.
Legacy SIEMs charge by the gigabyte. Network monitoring tools charge by the sensor. They hold your data hostage behind metered APIs.
We built the Npro Platform to run on your infrastructure. You hold the keys. You own the data.
Data Sovereignty
Your logs stay in your VPC. Whether it's HIPAA, PCI-DSS, or GDPR, data never leaves your premise. Air-gap friendly by design.
Hyper-Efficiency
Written in Rust and Go. Our backend sips CPU while processing thousands of events per second. No Java bloat.
Total Convergence
Npro (Security) and NRTG (Network) share one database. Correlate a firewall breach with a bandwidth spike instantly.
The Pipeline
How we ingest, process, and store your data without the "Index Tax".
Why ClickHouse?
Standard databases (PostgreSQL/MySQL) choke on logs. Elasticsearch is RAM-hungry. ClickHouse allows us to store billions of rows on standard hardware with instant retrieval.
API-First Design
Every chart in our dashboard is powered by the same REST API available to you. Automate your SOC, build custom reports, or integrate with ticketing systems programmatically.
The "Rent vs Own" Reality
Risk-Based Alerting & Offense Correlation
Raw alerts generate noise. Offense correlation cuts through it. nPro's correlation engine groups related security events from the same agent into a single Offense — a ranked, MITRE ATT&CK‑tagged threat cluster your SOC team can triage in one place.
Event Correlation
Related alerts from the same agent are grouped into a single offense. One investigation card replaces thousands of raw log lines.
MITRE ATT&CK Mapping
Each offense surfaces the ATT&CK tactics involved — Defense Evasion, Lateral Movement, Privilege Escalation — mapped to the kill chain automatically.
Risk Scoring
Every offense is scored 0–100. Analysts see Critical, High, Medium, and Low priorities at a glance — no manual triage of thousands of raw events required.
SOC Workflow
- Mark offense as Investigating to claim ownership
- Add Analyst Notes at the offense level for shift handover
- Close as Resolved or flag as False Positive
- Full first_seen / last_seen timestamps for incident timelines
What an Offense Captures
- Agent ID and device hostname
- Threat Intelligence IOC match indicator
- Event volume over 24 h — distinguishes sustained attacks from noise
- Source and destination IPs involved
STIX 2.1 / TAXII 2.1 Threat Intelligence
nPro connects to any STIX 2.1 / TAXII 2.1 feed and automatically matches ingested indicators of compromise against your live log traffic — entirely on-premise, with no data leaving your perimeter.
Connect Any Feed
Your internal MISP instance, commercial providers, or open feeds like AlienVault OTX. Configured from the dashboard — no config files.
Real-Time IOC Matching
Indicators are matched against incoming log traffic in real time. Offenses from IOC-matching agents are flagged with a Threat Intel badge.
Air-Gap Compatible
Pull feeds manually or via scheduled sync on air-gapped networks. The matching engine runs locally — no outbound calls during detection.
Offense Integration
IOC hits surface directly inside the Offense Monitoring view — analysts see which offenses involve known malicious indicators without switching tools.
Our mission
Our Mission: Security Without Compromise
Every organisation deserves enterprise-grade security visibility without being forced to send sensitive data to a third-party cloud.
Why we built nPro
The SIEM market is dominated by cloud platforms that charge per gigabyte, require lengthy professional services, and store your most sensitive telemetry on infrastructure you do not control. In Southeast Asia and other emerging markets that is both a financial barrier and a compliance risk.
Compliance-first architecture
Built for regulated industries where security logs must remain inside a sovereign perimeter. On-premise deployment satisfies residency mandates without architectural compromise.
Built by security engineers
We have operated SOC environments and deployed SIEM platforms at scale, and seen how fragmented tooling creates the gaps attackers exploit. XDR, SIEM and network monitoring are unified here because we know what silos cost during a live incident.
A platform that grows with you
From ten servers to ten thousand nodes across multiple countries. The ClickHouse backend handles billions of events with sub-second queries, and distributed probes monitor remote sites without routing all traffic through one location.
Trusted across industries
Our MSSP partners use nPro to deliver white-labelled security operations across Southeast Asia and beyond. If you are evaluating a SIEM platform or building a managed security offering, we are happy to help you work out whether nPro fits.