Frequently Asked Questions

Unlike fragmented security tools, nPro integrates these four engines into a single on-premise stack. Npro SIEM aggregates and correlates raw logs; Npro XDR provides active threat defense and MITRE ATT&CK® mapping; Npro EMS (NRTG) monitors network health and infrastructure uptime; and Npro DLP watches what leaves the endpoint. Data flows seamlessly between them, allowing you to see a security threat in the XDR while simultaneously seeing its impact on network performance in the EMS.

nPro is a self-hosted solution designed for maximum data privacy and control. Our optimized installer deploys the entire stack, including the high-performance ClickHouse database, directly onto your infrastructure (optimized for Ubuntu 24.04 LTS). This ensures your sensitive log data never leaves your network.

Our 5-Minute Deploy script automatically detects your OS, configures the backend services, sets up the ClickHouse database, and opens the necessary ports (1514, 1515, 21560). This eliminates the configuration hell typically associated with deploying enterprise SIEM and XDR solutions.

Yes. Npro XDR includes built-in File Integrity Monitoring. It tracks changes to sensitive system files in real-time, helping you meet compliance requirements and detect unauthorized modifications by attackers.

Traditional SIEM tools often require complex integrations and manual correlation across separate systems. nPro removes those silos by running XDR, SIEM, EMS and DLP as one platform on one database, so events from every engine land on a single timeline with real-time threat correlation and MITRE ATT&CK® mapping. The Enterprise tier adds SOAR and Jira integration and AI-powered threat analysis. Together this helps reduce mean time to detect (MTTD) and mean time to respond (MTTR).

nPro runs wherever you can run a Linux server: on-premise data centres, private clouds, your own instances on public clouds (AWS, Azure, GCP), and hybrid estates that mix them. Cloud and container security, workload protection and file integrity monitoring apply regardless of where your assets reside.

Npro XDR runs continuous malware and vulnerability detection alongside Security Configuration Assessment (SCA) against benchmarks, so security gaps are flagged before they are exploited. Findings appear in the same dashboard as the rest of your security events, where you can prioritise them next to live threat activity.

nPro helps organisations meet the logging, monitoring and data residency requirements of Malaysia's PDPA, Indonesia's PDP Law and Singapore's PDPA, as well as international frameworks including GDPR, ISO 27001, SOC 2, PCI DSS, HIPAA and the NIST Cybersecurity Framework. Because every log and DLP event stays on your own infrastructure, you can show regulators what happened without moving data offshore. Compliance and audit reporting is built into the SIEM, and the Enterprise tier adds one-click compliance reports for HIPAA and PCI DSS.

DLP is one of the four engines in the platform, not a separate purchase. On Pro and Enterprise it runs from the same agent as XDR, SIEM and EMS and is covered by the same flat per-agent price. It is not part of the Free tier, but you can try it free for 30 days with the Data Exposure Audit. Inspection is never metered, so the bill does not move with how much content is scanned.

Both, and in that order. Every endpoint group sits in one of four postures. Disabled inspects nothing. Monitor records events silently and stops nothing. Audit warns the employee and explains why the action is risky, then lets them continue, and the event is recorded. Enforce blocks the action on the channels you have set to block. The warning can be shown in English, Bahasa Malaysia or Bahasa Indonesia. Groups move independently, so finance can be enforcing while the rest of the fleet is still in Monitor or Audit. Moving a group into Enforce requires typing a confirmation phrase, so no one puts a fleet into blocking by accident.

Eight: USB and removable devices, sensitive data discovery, clipboard, print, cloud uploads, messaging, screen capture and email. Every channel shares one classification engine and one event model, so a clipboard event and a USB write correlate without any extra configuration.

Email is detection only. Outbound email is flagged through your mail platform’s audit feed, so you can see what left, but inline blocking needs a mail gateway and is the next phase rather than something the engine does today. Sensitive data discovery and print are also monitor-only today: they report what they find but do not block.

Yes, and the rest of Southeast Asia's main national IDs too. The detector set covers Malaysian NRIC, Indonesian KTP and NPWP, Thai national ID, Singapore NRIC and FIN, Vietnamese CCCD and Philippine PhilSys numbers, alongside passport, bank account and payment card numbers, with keyword matching in English and Malay. Detectors use checksums and nearby keywords, so an ordinary 12-digit number is not mistaken for an ID. Admins can also add their own detectors, such as internal project codes or policy numbers, and test them on sample text before saving.

It helps with the evidence. Since the 2024 PDPA amendments, organisations must appoint a Data Protection Officer and notify the Personal Data Protection Commissioner of a data breach within 72 hours. nPro DLP records detected egress events by channel and endpoint in your own database, so your DPO can see what left, when and how, without that evidence being sent offshore. nPro supports the investigation; the notification itself is still yours to make.

Yes. The Free tier covers up to 30 agents with three of the four engines: XDR, SIEM and EMS (NRTG), including malware and vulnerability detection and file integrity monitoring. DLP is included from Pro upwards, and you can try it free for 30 days with the Data Exposure Audit. Beyond 30 agents, or to add DLP, the Pro tier is $4.50 per agent per month with no device limits.

Free is $0 for up to 30 agents, with XDR, SIEM and EMS. Pro is $4.50 per agent per month (for example, $450 a month for 100 agents) and includes everything in Free plus DLP, with no device limits; yearly billing saves 20%. Enterprise is custom-priced and adds SSO/SAML, one-click compliance reports for HIPAA and PCI DSS, advanced RBAC, multi-site dashboards, SOAR and Jira integration, AI-powered threat analysis and a 1-hour response SLA. Contact the nPro team for a detailed comparison.

Upgrading is managed through your license key. You can move to a higher tier (e.g., increasing your NRTG distributed probes or XDR endpoint count) via the client portal. The platform will automatically recognize the new limits once the license is refreshed, requiring no re-installation.

Yes, you can schedule a downgrade for your next billing cycle. Because nPro is self-hosted and relies on a local ClickHouse database, a downgrade simply limits the number of active agents or probes reporting to your dashboard at the start of the next period. We recommend ensuring your active device count matches your new tier limits before the transition date to avoid data gaps.

No. The core database and backend components are included in your subscription license. You are only responsible for the underlying hardware or VPS resources where you choose to host the nPro stack.

nPro.ai offers tiered support including self-service documentation, technical support for implementation and troubleshooting, and dedicated customer success managers for enterprise accounts. Partners receive additional technical enablement and sales support resources.

The nPro.ai Partner Program enables consultants, VARs, and MSPs to monetize their client relationships through reseller, referral, and technology partnerships. Partners can activate Pro features for clients and earn 40% recurring commission for the lifetime of the customer relationship, not just one-time payouts.

Yes. The nPro architecture is ideal for MSPs who want to provide a Security-as-a-Service model. You can deploy individual, isolated stacks for each client on their own Ubuntu instances, ensuring total data sovereignty for your customers.

Partners get deep-dive documentation on setting up Distributed Probes and hierarchical topology maps. This allows you to monitor complex client infrastructures across multiple geographic sites from a single centralized nPro dashboard.