Development plan

Roadmap

What we are working on: recently released modules, beta modules you can use today, modules in preparation and what comes after them.

flowpro.local/playbooks

Released

1 module

Active Directory Integration
Synchronizes users, computers, groups and organizational units from one or more Active Directory domains over LDAPS, at an interval you choose. Built-in checks find inactive accounts, old passwords and risky group memberships. Each AD computer is linked to its FlowPro asset. Part of the Enterprise license.

3 modules

File Integrity Monitoring (FIM)
Detects unauthorized changes to files on monitored endpoints: edits, deletions and permission changes in system files, configuration directories and application binaries. Ready-made policies for PCI-DSS, CIS Benchmark and NIS2. Every deviation from the baseline raises an alert with the file hash, time and the user or process that made the change.
Windows Event Log Dashboards
Security, System and Application event logs from Windows in one place: logons (successful and failed), account changes, group membership changes and privilege use. 10 detection templates cover brute force, cleared audit logs, suspicious service installations and more. Each event shows the user's Active Directory profile.
GPO Monitoring
Tracks Group Policy Objects across all Active Directory domains: creation, edits, deletion and link changes, with full history. Each policy is scored against security recommendations and drift from your approved baseline is flagged. A side-by-side comparison shows exactly what changed between two versions.

3 modules

SIEM Correlation Engine
Correlates events from logs, NetFlow, IDS and threat intelligence. Chained detection rules recognize attacks that span several systems, such as lateral movement, credential abuse or data exfiltration. Related events within a time window are merged into one incident with a timeline and severity, so you review one case instead of hundreds of alerts.
Case Management + NIS2
Incident handling from start to finish: cases, evidence, assigned tasks and an audit trail. Attach logs, alerts, screenshots and notes to each case. For NIS2 it prepares the timeline and pre-filled notifications, including the 24-hour early warning and the 72-hour report. Access by role and SLA tracking keep you within the regulatory deadlines.
Agentic AI SOC Analyst
An AI agent that investigates alerts on its own: it queries logs, flows, threat intelligence and asset context, sorts alerts by severity and writes an investigation report with recommended actions. It runs only on local LLMs on your infrastructure, nothing is sent to an external cloud. It handles first-level triage around the clock so your team can focus on confirmed threats.

3 modules

UEBA
User and Entity Behavior Analytics: machine learning learns the normal behaviour of every user and device and reports deviations such as unusual login times, impossible travel, unusually large data access or a first connection to a sensitive system, without writing rules. Each anomaly gets a risk score based on asset criticality, the user's role and history, and is compared with users in similar roles.
JA3/JA4+ Encrypted Traffic Analysis
Identifies malware, command-and-control channels and unauthorized applications in encrypted traffic using JA3/JA4+ fingerprints of the TLS handshake, without decrypting anything or deploying certificates. A signature database maps known malicious fingerprints to threat families, and your own rules can flag specific applications or TLS versions. Each match comes with the NetFlow context of the connection.
Network Asset Auto-Discovery
Finds and classifies devices passively from the NetFlow, DHCP, DNS and ARP traffic already in your network, with no active scanning or agents, which suits OT and IoT environments. Devices are sorted by type (server, workstation, printer, IoT, network equipment) and a new or unknown device is reported as soon as it appears. Results feed the existing Assets module with traffic volume, connection history and vulnerabilities.