Documentation
Everything you need to get up and running with nPro.
01 Installation
nPro follows the KISS principle. Our installer handles everything from system detection to database configuration with a single command.
curl -sL https://download.npro.ai/download/install.sh | sudo bash
Deployment Output Example
[-] System Detected (Ubuntu 24.04)......................... [DONE]
[-] Prerequisites & Repositories........................... [DONE]
[-] nPro Manager Installation/Update...................... [DONE]
[-] Starting nPro Manager Service......................... [DONE]
[-] Verifying API Health................................... [DONE]
[-] ClickHouse Installation................................ [DONE]
[-] Verifying Database Connection (User: admin)............ [DONE]
[-] Npro Backend Installation/Update....................... [DONE]
[-] Starting Backend Service............................... [DONE]
[-] Verifying Backend Health............................... [DONE]
[-] Network Configuration (Ports: 1515, 1514, 21560)....... [DONE]
===========================================================
INSTALLATION/UPDATE COMPLETE
===========================================================
Access: http://192.168.1.1:21560
Credentials: admin / admin
02 Agent Deployment
Installing the server gets your Host Dashboard running. To actually monitor endpoints, you deploy an
nPro agent onto each device. Agents are created and
managed from the Agent Dashboard — no manual config files required. Log into your dashboard at
http://<your-server-ip>:21560,
then open Agents → Deploy New Device to begin.
The Deploy New Device screen walks you through five steps. The installation command in Step 4 is generated automatically from the values you enter in Steps 1–3, so the device name, group, and manager address are already filled in when you copy it.
1 Device Name
Give the device a memorable name so you can identify it later in the dashboard — for example jacks-windows11-laptop. This name is required; it feeds directly into the generated installation script.
2 Select Operating System
Choose the target platform. nPro generates the correct command for each:
- Debian / Ubuntu x64 & ARM
- CentOS / RHEL x64 & ARM
- Apple Silicon (M1/M2/M3) & Intel Mac
- Windows 10 / 11 / Server
3 Assign to Group (optional)
Assign the device to a group (e.g. production, workstations) for cleaner segregation and group-level monitoring policies. You can create a new group inline from this screen. Leave it as default if you don't need grouping yet.
4 Run Installation Script
Copy the generated command and run it on the target device. A Debian/Ubuntu x64 example looks like this (your device name, group, and manager address are filled in automatically):
wget https://packages.npro.ai/agent/npro-agent_amd64.deb && \
sudo NPRO_MANAGER='192.168.1.1' NPRO_AGENT_NAME='jacks-ubuntu-server' \
NPRO_AGENT_GROUP='production' dpkg -i npro-agent_amd64.deb
Windows uses a PowerShell Invoke-WebRequest + msiexec command; macOS uses a curl + installer command. The dashboard generates the right one for your selected OS.
5 Start Service Command
Once installed, start the agent service so it connects to your manager. On Linux:
sudo systemctl daemon-reload && sudo systemctl enable npro-agent && sudo systemctl start npro-agent
Within about 30 seconds the device appears in your Agent Dashboard and begins streaming events. Windows and macOS start commands are shown on their respective OS selections.
Repeat for
each device you want to monitor. The agent communicates outbound to your manager on ports
1514/tcp (events) and 1515/tcp
(enrollment) — no inbound ports are required on the endpoint.
03 System Requirements
Network Configuration
Ensure the following ports are open for proper communication:
- 1515/tcp: Agent
- 1514/tcp: Events
- 21560/tcp: UI
Logs & Debugging
You can find critical logs at the following locations:
- /var/log/npro_manager_install.log
- /var/log/clickhouse_install.log
- /var/log/npro_backend_install.log
04 Tech Stack
05 SIEM Features
Unified XDR and SIEM Protection
Combines extended detection and response with security information and event management for comprehensive threat detection, incident response, and compliance.
File Integrity Monitoring (FIM)
Monitors file systems for changes in content, permissions, ownership, and attributes, identifying who made changes and when.
Vulnerability Detection
Collects software inventory and correlates it with CVE databases to identify and alert on vulnerable software for timely remediation.
Active & Incident Response
Automatically triggers countermeasures like blocking connections, stopping processes, or deleting files upon threat detection.
⚡ Offense Monitoring
Offense Monitoring is nPro's risk-based alerting layer. Rather than requiring analysts to triage thousands of individual alerts, the correlation engine groups related security events from the same agent into a single Offense — scored, MITRE-tagged, and ready for investigation.
Accessing Offense Monitoring
Navigate to Offense Monitoring in the left sidebar. The page loads all active offenses ranked by risk score. Offenses with a CRITICAL or HIGH score should be the first stop for any SOC analyst starting a shift.
Reading the Offense Table
| Column | What it means |
|---|---|
| Risk Score | 0–100 composite score. Critical ≥ 85, High ≥ 65, Medium ≥ 40. |
| Agent | Agent ID and device hostname of the affected endpoint. |
| MITRE Tactics | ATT&CK tactics observed in the correlated event cluster (e.g. Defense Evasion, Persistence). |
| Events (24h) | Raw alert count feeding this offense in the past 24 hours. High count = sustained activity. |
| Status | Open / Investigating / Closed / False Positive. |
| Age | Time since last event. Hover for absolute timestamp. |
Triaging an Offense
-
1
Click the offense row
The Offense Details panel slides in from the right, showing agent info, MITRE tactics, source/destination IPs, threat intel status, and the full offense time window (First Seen → Last Seen).
-
2
Mark Investigating
Claim ownership of the offense. This signals to other SOC members that this threat is being actively worked.
-
3
Add Analyst Notes
Document findings at the offense level. Notes persist and are visible to any analyst who opens the offense. Use this for shift handover context.
-
4
Close the offense
Mark as Resolved once remediated, or False Positive if the correlation fired incorrectly. Closed offenses are excluded from the active view.
Tip: Threat Intel IOC match
If an offense shows a red Threat Intel IOC match banner, the agent has matched an indicator from your configured STIX/TAXII feed. Treat these as highest priority regardless of the numeric risk score.
06 NRTG Monitoring
Maps & Dashboards
Visualize your network with real-time data for insights into IT infrastructure health.
Distributed Monitoring
Monitor an unlimited number of remote locations in a single pane of glass.
Alerts & Notifications
Set custom thresholds and receive alerts via email, push, or HTTP requests.
Flexible Probes
Secure communication between all components using TLS encryption.
07 Advanced Integrations
- VirusTotal Integration: Paste a free API key for enhanced malware scanning.
- Cloud Security: AWS, Azure, and GCP monitoring for infrastructure changes.
-
Threat Intelligence — STIX 2.1 / TAXII 2.1
Connect any STIX 2.1 / TAXII 2.1 feed — your internal MISP instance, a commercial provider, or an open feed like AlienVault OTX — and nPro automatically ingests indicators of compromise and matches them against your live log traffic in real time. Configured entirely from the dashboard.
- Supports MISP, OTX, and any standards-compliant TAXII 2.1 server
- IOC matches surface as a flagged indicator directly in Offense Monitoring
- Air-gap compatible — matching engine runs locally, no outbound calls during detection
- Stays idle until you enable it — zero performance impact when not configured
- AI Analysis: Special AI button to analyze security logs and recommend solutions.
Understanding nPro's Architecture
nPro is a unified security and network observability platform that runs entirely on your own infrastructure. At its core, nPro combines three distinct subsystems — an XDR threat detection engine, a SIEM log correlation and alerting layer, and an NRTG-based network monitoring component — all sharing a single ClickHouse time-series database backend for high-performance querying across billions of events.
System Requirements
nPro is optimised for Ubuntu 24.04 LTS. Minimum recommended specifications for a production deployment are 4 CPU cores, 8GB RAM, and 100GB SSD storage for log retention. For high-ingestion environments handling more than 10,000 events per second, we recommend 8+ cores, 32GB RAM, and NVMe storage. ClickHouse's columnar storage means disk I/O is the primary bottleneck — SSDs are strongly preferred over spinning disks.
Log Source Compatibility
nPro ingests logs via Syslog (UDP/TCP), Filebeat, and direct API integrations. Supported log sources include Linux and Windows endpoints, pfSense and OPNsense firewalls, Cisco and Juniper network devices, Nginx and Apache web servers, cloud workloads on AWS and Azure, and containerised environments running Docker or Kubernetes. Custom log parsers can be added via the pipeline configuration interface.
Deployment Modes
nPro supports three deployment topologies. Single-node deployment is suitable for environments up to approximately 5,000 managed devices and provides the simplest operational model. Distributed deployment splits the ingestion, processing, and storage layers across separate servers to handle higher event volumes. Air-gapped deployment operates without any outbound internet connectivity and is designed for classified or highly regulated networks where no external communication is permitted.
Data Retention and Querying
ClickHouse's columnar compression achieves typical compression ratios of 10:1 or better on security log data, enabling cost-effective long-term retention on standard hardware. The nPro query interface supports both a visual timeline explorer and direct SQL queries against the underlying ClickHouse tables for advanced users. Retention policies can be configured per log source, allowing high-frequency network flow data to be aged out faster than security event logs that may be required for compliance audits.
Getting Help
The nPro documentation covers installation, configuration, log source integration, alert rule creation, and network topology mapping in detail. If you encounter an issue not covered in the documentation, our support team is available via the account portal. Enterprise customers receive dedicated technical support with guaranteed response times. MSSP partners have access to a dedicated partner portal with deployment guides, white-label configuration options, and priority escalation paths.