Features

    From Logs and Network Flows
    to Your NIS2 Audit

    25 modules running on your own server: log search, intrusion detection, NetFlow analysis, vulnerability tracking and compliance. Below you can go through them one by one.
    flowpro.local/mitre-attack
    MITRE ATT&CK matrix in FlowPro NG

    01

    Real-Time Dashboard

    • WebSocket-powered dashboard updating every 10 seconds — no manual refresh needed
    • Stat cards with trend indicators: total events, security alerts, active sources, system health
    • Threat Map — geographic visualization of incoming and outgoing traffic (choropleth)
    • Service Health Monitor — automatic 60s monitoring of 8 system services with red banner alerts
    • Uptime Monitors panel and Flow Anomalies panel with map visualization
    flowpro.local/dashboard
    Real-Time Dashboard

    02

    Log Explorer

    • Full-text search across billions of log entries with sub-second response (Elasticsearch)
    • Advanced filtering by source, severity, time range, and custom fields
    • Live Tail — real-time WebSocket streaming of new log entries
    • Saved searches (CRUD) and field statistics (column-level analytics)
    • Export to CSV and JSON with search_after pagination for large datasets
    flowpro.local/log-explorer
    Log Explorer

    03

    Event Center & Alerting

    • Elastic Detection Engine with 1,500+ prebuilt rules + 5 custom MikroTik rules
    • Cascade filters — combine severity and status for precise alert triage
    • System Events tab — service_health, compliance, uptime, and password_audit events
    • 5 notification channels: Telegram, Slack, Email, ntfy.sh, Webhook
    • Bulk operations, alert comments, and muted rules management
    flowpro.local/alerts
    Event Center & Alerting

    04

    Intrusion Detection System (IDS)

    • Suricata-powered network intrusion detection with EVE JSON processing
    • Deep-dive analysis: DNS queries, HTTP requests, TLS handshakes, FTP sessions
    • Attacker geolocation on interactive map with GeoIP enrichment
    • Alert trending with previous-period comparison (*_prev fields)
    • Export to CSV, JSON, PDF (up to 10,000 records per export)
    flowpro.local/ids
    Intrusion Detection System (IDS)

    05

    Flow Collector (NetFlow Analysis)

    • NetFlow v5/v9, sFlow, IPFIX collection via nfacctd (pmacct)
    • High-performance storage with Apache Kafka stream processing
    • 5 tabs: Overview (map 780×660), Flows (search & export), Sources, Anomalies, Detection
    • ML-based anomaly detection (bandwidth spikes, port scans, data exfiltration)
    • Source management with geographic map visualization
    flowpro.local/flowpro
    Flow Collector (NetFlow Analysis)

    06

    AI-Powered Security Analysis

    • Local LLM via Ollama (qwen2.5:72b, gpt-oss:120b) or secure cloud proxy
    • Automatic threat classification with MITRE ATT&CK mapping
    • Compliance Chat — NIS2 RAG chatbot (221 semantic chunks, pgvector, nomic-embed-text)
    • WebSocket token streaming for real-time analysis output
    • Findings export to CSV, JSON, PDF with severity-ranked recommendations
    flowpro.local/ai-analysis
    AI-Powered Security Analysis

    07

    NIS2 Compliance Automation

    • 6 frameworks: NIS2, CIS Controls v8.1, ISO 27001, GDPR, SOC 2, PCI DSS
    • 130+ automated controls with 5 check types (ES query, PG query, API, config, manual)
    • 14 tabs: Overview, Frameworks, Assessment, Risks (5×5 heatmap), Evidence, Builder, ...
    • Approval workflow for attestations with audit trail
    • Professional PDF & CSV export for auditors and management
    flowpro.local/compliance
    NIS2 Compliance Automation

    08

    NIS2 AI Assistant (Compliance Chat)

    • AI chatbot trained on the full NIS2 directive — ask questions in natural language and get instant guidance
    • RAG pipeline: 221 semantic chunks of NIS2 text indexed with pgvector (768-dim embeddings, nomic-embed-text)
    • Real-time streaming responses via WebSocket — answers appear token-by-token as they are generated
    • Context-aware: references specific NIS2 articles, categories, and implementation steps relevant to your question
    • Conversation history with persistent chat sessions — continue where you left off
    • Powered by local LLM (qwen2.5:72b) — your compliance questions never leave your infrastructure
    flowpro.local/compliance-chat
    NIS2 AI Assistant (Compliance Chat)

    09

    Threat Intelligence

    • IoC feed management: STIX/TAXII, CSV, API sources
    • 5 IoC types: IPv4, IPv4 CIDR, domain, hash, URL
    • Automatic feed synchronization every 5 minutes
    • Check IP function with hit tracking and multi-source enrichment
    • Integration with VirusTotal and AlienVault OTX
    flowpro.local/threat-intel
    Threat Intelligence

    10

    Shodan Monitor

    • External attack surface monitoring from the attacker's perspective
    • 3 tabs: Overview (6 stat cards), IP Addresses (management, map, CVE drilldown), History
    • Change tracking: new_port, closed_port, new_vuln, service_change, cert_change
    • Acknowledge workflow for change review management
    flowpro.local/shodan
    Shodan Monitor

    11

    CVE Monitor

    • NVD database synchronization with 333,000+ CVE entries
    • Watchlist for tracked products, vendors, and versions
    • CVSS score filtering and full-text CVE search
    • Automatic background sync every hour
    flowpro.local/cve
    CVE Monitor

    12

    Network Tools Suite

    • 11 tabs: DNS, MX, Network (Ping/Traceroute), Port Scan, SSL, WebScan, DNSSec, Password, Compromise, VulnScan, SEO
    • WebSocket streaming for Ping and Traceroute with GeoIP + Leaflet map
    • SSL/TLS audit with 9 check types (protocols, chain, ciphers, HSTS, OCSP, headers, cookies, CAA, server)
    • Breach detection via HaveIBeenPwned integration
    flowpro.local/network-tools
    Network Tools Suite

    13

    Honeypot Deception

    • T-Pot integration with 20 honeypot types (Cowrie, Dionaea, Heralding, Mailoney, Suricata, ...)
    • Real-time event polling (60s interval, 500 events/cycle, SHA-256 deduplication)
    • Automatic session grouping (5-minute gap) with GeoIP enrichment
    • Protocol analysis: SSH, Telnet, SMTP, HTTP, FTP, and more
    flowpro.local/honeypot
    Honeypot Deception

    14

    Uptime & Blacklist Monitoring

    • 5 probe types: HTTP, Ping, SSL certificate, Port, DNS
    • Incident management with configurable notification rules per monitor
    • Port Scan modal — WebSocket-based scan with auto-save to Network Tools
    • DNSBL blacklist monitoring across 50+ providers with false-positive filtering
    flowpro.local/uptime
    Uptime & Blacklist Monitoring

    15

    VPN Pilot

    • Centralized WireGuard & OpenVPN management — multiple VPN servers, peers, and tunnels from one dashboard
    • Real-time peer status: connected/disconnected, last handshake, data transferred, assigned IP
    • Config export — generate and download WireGuard configuration files for clients
    • Integrated with Uptime Monitor — automatic availability checks for VPN endpoints
    flowpro.local/vpnpilot
    VPN Pilot

    16

    Asset Inventory & CVE Mapping

    • Unified asset inventory covering Elastic Agents, Syslog devices (MikroTik, switches), and NetFlow exporters
    • CVE ↔ Assets correlation — automatically match known vulnerabilities to your monitored devices by vendor, product, and version
    • Vulnerability status workflow: New → In Progress → Accepted Risk → Resolved — with team assignment
    • CVSS and EPSS scoring with KEV (Known Exploited Vulnerabilities) flag for prioritization
    flowpro.local/cve-assets
    Asset Inventory & CVE Mapping

    17

    Security Score

    • Composite risk score (0–100) calculated from active IDS alerts, open CVEs, compliance gaps, and certificate issues
    • Category breakdown: IDS, Threat Intelligence, CVE, Compliance, Certificates — each with individual score and trend
    • Historical score chart — track your security posture improvement over time
    • Actionable recommendations — each category links directly to the relevant module for immediate remediation
    flowpro.local/security-score
    Security Score

    18

    Certificate & PKI Monitor

    • Automated TLS certificate discovery and monitoring — track expiry dates, issuers, SANs, and key algorithms
    • Configurable expiry alerts (30/14/7 day thresholds) with Telegram, Slack, Email, and webhook notifications
    • Certificate chain validation — detect broken chains, self-signed certificates, and revoked CAs
    • PKI internal CA overview — map your internal certificate authority infrastructure alongside public certificates
    flowpro.local/certificates
    Certificate & PKI Monitor

    19

    MITRE ATT&CK Matrix

    • Full MITRE ATT&CK Enterprise matrix — 14 tactics, 180+ techniques mapped to real detections from your environment
    • Heat map visualization — technique cells colored by alert count; click any cell to drill down into matching IDS events
    • Honeypot correlation — attacker TTP (Tactics, Techniques, Procedures) from honeypot sessions mapped to ATT&CK
    • AI-powered technique explanation — ask the local LLM to explain any technique and its mitigation
    flowpro.local/mitre-attack
    MITRE ATT&CK Matrix

    20

    Passive DNS & DGA Detection

    • Passive DNS resolution logging — build a historical record of which domains resolved to which IPs over time
    • DGA (Domain Generation Algorithm) detection — identify malware-generated domain patterns using entropy and n-gram analysis
    • Threat correlation — cross-reference DNS queries with IoC feeds and known malicious domains
    • Timeline view — investigate suspicious domain activity with full temporal context
    flowpro.local/passive-dns
    Passive DNS & DGA Detection

    21

    Playbooks (SOAR)

    • Automated incident response triggered by security alerts — define conditions based on severity, source type, rule name, and custom field matching (including CIDR)
    • 5 action types: webhook calls, email/Slack/Telegram notifications, asset tagging, IOC enrichment, and event logging
    • Template variables in actions — use {{name}}, {{severity}}, {{source_ip}}, {{destination_ip}} and more for dynamic payloads
    • Cooldown and rate limiting per playbook — prevent alert storms from triggering duplicate actions
    • Dry-run mode — test your playbook logic safely; actions are logged but not executed
    flowpro.local/playbooks
    Playbooks (SOAR)

    More From the App

    Dashboard
    Dashboard
    Log Explorer
    Log Explorer
    Event Center
    Event Center
    Asset Inventory
    Asset Inventory

    Try All Modules Free for 14 Days

    The Enterprise trial unlocks every module. You install it on your own server and need no credit card.

    Start Free TrialOnline Demo