Self-Hosted SIEM.
Zero Cloud Dependency.
nPro is an on-premise SIEM platform that ingests, correlates, and alerts on security events from your entire infrastructure — without sending a single log to a third-party cloud.
What Is a Self-Hosted SIEM?
A Security Information and Event Management (SIEM) platform collects logs from across your infrastructure — servers, firewalls, endpoints, cloud workloads — and correlates them in real time to detect threats, meet compliance requirements, and support incident response.
The critical distinction is where that log data lives. Cloud-based SIEMs transmit your security telemetry to an external vendor's infrastructure. For organisations under GDPR, PDPA, ISO 27001, or PCI-DSS, this creates both a compliance risk and a concentration of sensitive data outside your control.
nPro is built on the principle that your security data belongs on your hardware. Every log, every alert, every correlation result stays within your network boundary.
Everything a Modern SIEM Needs
Log Ingestion at Scale
Ingest from Syslog, Filebeat, Windows Event Forwarding. Supports Linux, Windows, firewalls, cloud workloads, and containers.
MITRE ATT&CK Correlation
Map every alert to MITRE ATT&CK tactics and techniques. See the full kill chain so your SOC responds with context.
Real-Time Dashboards
Live threat timelines and compliance dashboards. Query billions of events in under a second with ClickHouse columnar storage.
Alert Rules Engine
Write detection rules or import Sigma rules. Route alerts to email, Slack, or webhook with threshold and temporal conditions.
Compliance Reporting
Pre-built reports for ISO 27001, PCI-DSS, GDPR, and PDPA. Configurable audit log retention policies per data source.
Air-Gap Support
Full functionality with zero outbound internet. Designed for classified environments and networks with strict isolation requirements.
Why Self-Hosted Beats Cloud SIEM
No Per-GB Billing
Cloud SIEMs charge by data volume. Teams reduce log verbosity to cut costs, creating the blind spots attackers exploit. nPro's flat licence means you log everything without worrying about the bill.
Your Data Never Leaves
Cloud SIEMs require you to stream sensitive operational data to an external vendor. nPro processes everything locally, satisfying even the strictest data residency mandates.
Deploys in 5 Minutes
nPro's automated installer configures ClickHouse, the backend, and all network ports automatically on Ubuntu 24.04 LTS. From zero to operational in minutes.
Scales With Your Hardware
Add capacity by adding servers — no per-node licensing required. ClickHouse achieves 10:1 compression ratios on log data for cost-effective long-term retention.
The Rest of the Platform
Further Reading
How self-hosted SIEM gets deployed, priced and audited in practice.
SIEM vs EDR vs XDR
Where each tool sits, and why most teams end up running more than one.
Why log retention got expensive in 2026
Flash prices rose sharply. Compression ratio, not price per terabyte, now sets your retention window.
The MSSP business case for on-premise SIEM
Why managed providers are moving tenant data back inside their own perimeter.
Migrating from Wazuh to nPro
Wazuh is free. The OpenSearch cluster underneath it is not. What transfers, and what you rebuild.
Philippines Data Privacy Act: concealing a breach is a crime
What the law requires, and the logging you need to prove you met it.
SIEM implementation checklist
Scoping, log source priorities, detection tuning and a phased rollout, step by step.
How long to keep security logs
Compliance drivers, hot vs cold tiering, and where forensic value stops paying for the storage.
SIEM storage sizing
Work out the storage you actually need from your measured event rate, not a vendor estimate.
Singapore PDPA: a SIEM guide for enterprises
The Protection Obligation, mandatory breach notification, and what the PDPC expects.
Deploy Your SIEM Today
Free tier for XDR, SIEM and EMS. No credit card. Up and running in 5 minutes.