Blog

How to Measure Your SIEM Compression Ratio (and Why the Published Figure Does Not Apply)

Published compression ratios cannot tell you what your logs will compress to. Here is how to measure your own ratio and use it for sizing.

13 October 2026 · 2 min read

Is there a self-hosted platform that combines SIEM, XDR and DLP?

Most teams run SIEM, XDR and DLP as three separate products, and the DLP part usually inspects data in a vendor cloud. Here is what a single self-hosted platform looks like, the options available, and when it is the wrong choice.

9 October 2026 · 4 min read

SIEM Storage Sizing: How to Calculate What You Actually Need

The gigabytes-per-day figure is the least useful input. Here is how to size SIEM storage from your own event rate, compression ratio and retention policy.

6 October 2026 · 3 min read

Philippines Data Privacy Act: Why Concealing a Breach Is a Crime

The Philippines has the smallest fines in the region and the sharpest teeth. Concealing a breach involving sensitive personal information is a crime, and it lands on people.

28 September 2026 · 5 min read

Thailand PDPA Compliance: What the PDPC Is Actually Fining

Thailand's PDPA was widely treated as a law that did not bite. Then the PDPC issued one fine in 2024 and eight more in 2025. Inadequate security appears in every case, failure to notify in three of them, and the regulator is now scanning the dark web for Thai data itself.

28 September 2026 · 6 min read

The 72-hour clock: breach notification across Southeast Asia

Malaysia, Indonesia, Thailand and the Philippines all run a 72-hour breach clock, and Singapore gives three days. The clock starts when you find out, which makes detection the part that matters.

25 September 2026 · 6 min read

Why Log Retention Got Expensive in 2026 | nPro

Enterprise flash prices rose 6.5x in a year. That turns log retention from a storage question into a compression one.

22 September 2026 · 6 min read

Migrating from Wazuh to nPro: a planning guide

Nobody leaves Wazuh because it detects badly. They leave because the indexer, the storage and the tuning became somebody's full-time job. What to inventory, what carries over, and when to stay put.

18 September 2026 · 2 min read

Why cloud DLP is a residency problem

Data loss prevention has to read your most sensitive content in order to protect it. When that inspection happens in a vendor's cloud, you have exported exactly the data you were trying to contain.

15 September 2026 · 3 min read

What Is UEBA? User and Entity Behaviour Analytics Explained

Rule-based detection catches attacks that match a known pattern. UEBA catches the ones that don't — a real user, with real credentials, doing something they have never done before. Here is how behavioural analytics works and what it needs to function.

28 July 2026 · 5 min read

STIX and TAXII Explained: How Threat Intelligence Actually Moves Between Systems

STIX is the language threat intelligence is written in. TAXII is how it travels. Together they turn a spreadsheet of suspicious IP addresses into structured, machine-readable intelligence your platform can act on automatically.

24 July 2026 · 4 min read

AI-Assisted Investigation in the SOC: What It Does, and What It Cannot Do

Large language models are genuinely useful for security investigation — summarising timelines, translating questions into queries, drafting reports. They are also confidently wrong on occasion. Here is where the line sits, and why it matters where the model runs.

23 July 2026 · 4 min read

YARA Rules Explained: Pattern Matching for Malware Detection

Hash matching catches a file you have seen before. YARA catches the next variant of it. A practical guide to how YARA rules are structured, how to write one, and how to avoid the false positives that make teams switch them off.

21 July 2026 · 5 min read