Case studies

    FlowPro NG in practice

    What our customers deploy, what they use day to day and what we learned along the way. We do not name customers without their consent.
    Water utility · NIS2 regulated entityCustomer deployment

    Water utility: network, servers and domain in one place

    The company supplies drinking water and treats wastewater, so NIS2 applies to it. It needed central log collection, visibility into network traffic and evidence for audits, without a cloud service and without a team to run several separate tools.

    What was deployed

    • One on-premises server with Ubuntu 24.04, 32 GB RAM and a 1 TB data disk
    • A Suricata IDS sensor fed with traffic mirrored by a MikroTik router
    • Syslog from network devices and agents on the servers
    • Active Directory connected over LDAPS
    • File integrity monitoring on key servers

    What they use it for

    • IDS and log alerts in one place, the Event Center
    • Active Directory checks point out inactive accounts and old passwords
    • Data stays inside the company network

    What we learned

    IDS data made up the largest share of the volume. That is why retention is set separately for each category (IDS, syslog, metrics, flows), so the disk does not fill up needlessly and important records stay as long as required.

    Suricata IDS SIEM and log management Active Directory monitoring
    Software companyCustomer deployment

    Software company: servers and databases at several sites behind NAT

    Windows and Linux servers run in the office and on remote networks. The company wanted one view of their health, security events and the performance of the databases its applications run on.

    What was deployed

    • FlowPro NG on an office server behind a MikroTik router
    • Agents on Windows and Linux servers, remote networks included, via the public address
    • Monitoring of Microsoft SQL Server and PostgreSQL

    What they use it for

    • A detail page per server with performance, events and database metrics
    • Remote agents send data just like the ones in the office

    What we learned

    When the server sits behind NAT, agents must reach it on the public address and the router must also allow access from the internal network to that address (hairpin NAT). Then remote and local agents work with the same settings.

    SIEM and log management Vulnerability management
    Internet service providerTypical scenario

    Internet service provider: network traffic and data retention

    An ISP needs to see what happens on its network (attacks on customers, compromised customer devices that scan or send spam) and at the same time meet the legal duty to retain traffic and location data.

    What was deployed

    • NetFlow/IPFIX export from core and access routers
    • Detection of DDoS, scans and other anomalies in the flows
    • Blacklist monitor for the provider's address ranges
    • Extended flow retention and record export for authorised bodies

    What they use it for

    • A compromised customer device is spotted by its network behaviour, not by complaints
    • Retained data stays on the provider's own server
    NetFlow analysis Network anomaly detection ISP data retention

    Want to see it on your network?

    Try the 14-day Enterprise trial on your own server, or write to info@flowpro.eu and we will go through your setup with you.

    Start Free TrialOnline Demo