Logs and detection

    SIEM and centralized log management: every event in one place

    FlowPro NG collects logs from servers, workstations, firewalls and routers, stores them in Elasticsearch and continuously checks them against detection rules. When something suspicious happens, you know right away. Everything runs on your own server.
    Try it free for 14 daysOnline demo
    flowpro.local/logs
    Log Explorer in FlowPro NG

    You have the logs. Nobody reads them.

    Every server, firewall and workstation records what happens on it, but each one in a different place and format. When an incident hits, you piece the trail together by hand from dozens of sources. Meanwhile an attacker can wipe the logs on the compromised machine.

    A SIEM gathers the logs in one place away from the monitored devices, normalizes them and continuously looks for known attack patterns. Instead of digging through files you get alerts: failed logins, a new admin account, a cleared audit log.

    What you get

    SIEM and log management in FlowPro NG

    Log Explorer

    Full-text search and KQL queries across all logs. Filters by source, severity and time, field statistics, Live Tail of new entries, saved searches and export to CSV and JSON.

    1,500+ detection rules

    Elastic Detection Engine with prebuilt rules grouped into categories by data source. One click enables the rules for sources you actually have data from. Built-in rule packs for FortiGate, Linux, MikroTik, Ubiquiti and Windows.

    Event Center

    All alerts in one place, filtered by severity, status and time. Each alert moves from open to resolved or false positive. Bulk operations, comments and muting a rule without disabling it.

    Elastic Agent and syslog

    Install Elastic Agent on Linux, Windows and macOS with one command and manage it centrally through Fleet. Routers, firewalls and other network devices send logs via syslog (UDP 514).

    Alerts where you will see them

    Send new alerts to email, Telegram, Slack, ntfy.sh on your phone or your own webhook. Rules can be imported and exported in NDJSON format.

    Retention per data category

    Set how long data is kept separately for 10 categories (syslog, IDS, metrics, audit, flows and more). Old logs are removed by an Elasticsearch ILM policy, flows by a ClickHouse TTL. The upper limit is set by your license.

    • Elasticsearch
    • Elastic Agent
    • Fleet
    • Syslog
    • Logstash
    • KQL
    • Linux
    • Windows
    • macOS
    • FortiGate
    • MikroTik
    • Ubiquiti
    • NIS2

    How it works

    Up and running in a few steps

    1. 01

      Install FlowPro NG

      On an Ubuntu 24.04 server with one command from the APT repository. Elasticsearch, Fleet Server and Logstash for syslog are set up automatically.

    2. 02

      Connect log sources

      Deploy Elastic Agent to servers and workstations with the command FlowPro NG generates for you. Point network devices at the server address via syslog. New sources appear in the Asset Inventory.

    3. 03

      Enable rules and channels

      In Settings, enable the rules for categories that receive data and choose where alerts should go. From then on you only handle what shows up in the Event Center.

    FAQ

    Frequently asked questions

    What is a SIEM?

    A SIEM (Security Information and Event Management) collects logs and security events from across the network into one place and evaluates them with rules. It alerts you to suspicious activity and provides the evidence when handling an incident. FlowPro NG is a SIEM that runs on your own server.

    What is the difference between SIEM and log management?

    Log management collects and stores logs and lets you search them. A SIEM adds detection on top: it continuously matches logs against rules and raises an alert on a match. FlowPro NG does both, with Log Explorer for search and the Event Center for detection.

    Do I need a SIEM for NIS2?

    NIS2 requires organizations to be able to record, detect and document security events. Central log collection with detection is the most direct technical way to meet that. A SIEM alone does not make you compliant, organizational measures are part of it too. For those, FlowPro NG offers the NIS2 Compliance Pack add-on.

    Is the SIEM in FlowPro NG free?

    Yes. Log Explorer, the Event Center and detection rules are included in the free version for 5 agents and 30 days of history. Paid licenses add more agents, longer data retention and further modules.

    Do my logs leave my network?

    No. FlowPro NG runs on your server and stores logs locally. Only the license check and technical instance status (version, number of agents) leave the network, never log content.

    Related solutions

    Network anomaly detection17 detections over network flows every minute: port scans, floods, data exfiltration, beaconing, lateral movement, tunnels.Intrusion detection (IDS)Suricata IDS inspects network traffic packet by packet and alerts you to intrusion attempts, malware and exploits. DNS, HTTP, TLS and FTP included.Active Directory monitoringUsers, computers and groups from Active Directory in one place. Automatic checks find inactive accounts, old passwords and risky settings.
    How FlowPro NG compares to Wazuh, Elastic, Splunk and Flowmon

    Try it on your own network

    The 14-day Enterprise trial unlocks every module. You install it on your own server, no credit card needed.

    Start Free TrialOnline Demo