nAnalyst
Agentic Network Intelligence, an AI analyst layer for ntopng.
analyst for ntopng
your data stays with you
language questions
The recommendation
Who should choose nAnalyst
nAnalyst is an AI analyst layer for ntopng. Choose it when your problem is interpretation, not visibility: you want to ask questions in plain language and get queries, charts, evidence and suggested next steps, with your data staying on-premise.
- Analysts spend hours investigating alerts and traffic.
- You want policies written in plain language and turned into alerts.
- You want to query ntopng from Claude Code, Cursor or any MCP client.
The ideal use case
Ideal use case for nAnalyst
- Environment: ntopng deployments with flows, hosts, asset inventory, SNMP and alerts. Fully on-prem capable.
- Team: network and security analysts, with usage and cost tracked per user and per model.
- Technical requirements: ntopng Enterprise L with nAnalyst, and an LLM of your choice. Also available as an MCP server on ntopng.
- Problem solved: faster traffic and alert investigation, with reasoning steps, tool calls and raw SQL visible, and a full action audit trail.
Ideal for Every Environment
Deployment scenarios
Traffic Investigation
In seconds, users go from raw traffic to insights and next steps.
- Question: “Show me DNS query volume for each hour in the last day and top queried domains”
- The agent collects DNS traffic data and hourly volume
- Generates a line chart embedded in the chat
- Reports a table of evidence and suggests next steps, e.g. “Investigate the two most contacted domains…”
Policy Generation & Alerting
From idea to detection to alerts in seconds.
- “No SSH for host 192.168.2.38 during business hours”
- The agent generates an SQL query, executed periodically (1 or 5 minutes, hourly, daily)
- An alert is generated if the policy is violated
- The agent runs the query, explains the result, and registers the alert
Complex policies such as “traffic 2x the hourly baseline” and similar behavioral rules are also supported.
Alert Investigation via MCP
nAnalyst is also accessible as an MCP server running on ntopng, with no additional installation required. Connect from Claude Code, Cursor, or any MCP client to interact with ntopng data directly, correlate alerts, and get full security assessments with recommended remediation steps.
The alternatives
nAnalyst alternatives, compared
Same criteria for each option: role, when to choose it, limits and cost.
Generic AI assistant
- Role: Generic web search, not network-specific.
- Choose it when: You only need general advice.
- Limits: Black box, no audit trail, cloud only.
- Cost: N/A
ntopng alone
- Role: Dashboards and alerts.
- Choose it when: You investigate manually.
- Limits: Interpretation takes analyst time.
- Cost: Community free
The tradeoffs
When nAnalyst is not the right choice
- It extends ntopng and is not a standalone tool.
- It needs ntopng Enterprise L.
- Questions work in any language supported by your preferred LLM.
- It can act on your behalf (policies, alerts), so use the audit trail to review actions.
The proof
Specifications, versions, pricing and documentation
Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.
Networks tell everything, but no one has time to understand it.
The real problem isn’t visibility, it’s interpretation. Terabytes of traffic per day, thousands of alerts, and analysts spending hours investigating. Most tools answer what happened, very few can tell you why.
at a glance
Key Features
- Ask questions about your network in natural language
- Agent autonomously runs SQL queries against the database
- Gathers evidence from flows, hosts, asset inventory, SNMP and alerts
- Visualizes results as charts embedded directly in the chat
- Proposes network policies and generates alerts on violation
- Adds active monitoring checks to verify service uptime
- Silences irrelevant, low-value alerts automatically
- Full evidence logs: reasoning steps, tool calls and raw SQL. No black box
- Persists context and evidence across sessions
- Usage and cost tracking per user, per model
- Full action audit trail, agent-initiated vs user-initiated
- Also available as an MCP server running on ntopng
Specifications
Tech Specs
Comparison
Why is nAnalyst Different?
| Differentiator | nAnalyst | Generic Agent Assistant |
|---|---|---|
| Purpose-built tools | 25+ network-specific tools & expanding | Generic web search |
| Evidence transparency | Full reasoning steps, tools called and SQL | Black box |
| Audit trail | Full auditability on actions taken | None |
| Privacy | Fully on-prem capable | Cloud only |
| Cost tracking | Per user, per model, per tool call | N/A |
| ntopng & nDPI native | Yes | No nDPI |
Beta Version Available
ntopng Enterprise L with nAnalyst
- Support for Anthropic, OpenAI, Local LLM
- MCP server
- nAnalyst is not a generic prompt or LLM wrapper, it ships with 25+ purpose-built, domain-specific tools that understand your network's data model.
Screenshots
Gallery
Related
Keep exploring
Pricing and editions
Compare editions and ways to buy.
Solutions
By use case and industry.
User guide
Installation and configuration.
Get started
Ready to see it on your network?
Download the free Community edition of ntopng, compare editions and buy in the shop, or talk to the ntop team about your requirements.
