nAnalyst
Agentic Network Intelligence, an AI analyst layer for ntopng.
nAnalyst is an autonomous, AI-based network intelligence extension for ntopng that explains what is happening in your network, and why. Ask questions in plain English (or any language supported by your preferred LLM) and let the agent run the queries, chart the results, propose policies, and act on your behalf.
Networks tell everything, but no one has time to understand it.
The real problem isn’t visibility, it’s interpretation. Terabytes of traffic per day, thousands of alerts, and analysts spending hours investigating. Most tools answer what happened, very few can tell you why.
at a glance
Key Features
- Ask questions about your network in natural language
- Agent autonomously runs SQL queries against the database
- Gathers evidence from flows, hosts, asset inventory, SNMP and alerts
- Visualizes results as charts embedded directly in the chat
- Proposes network policies and generates alerts on violation
- Adds active monitoring checks to verify service uptime
- Silences irrelevant, low-value alerts automatically
- Full evidence logs: reasoning steps, tool calls and raw SQL. No black box
- Persists context and evidence across sessions
- Usage and cost tracking per user, per model
- Full action audit trail, agent-initiated vs user-initiated
- Also available as an MCP server running on ntopng
Ideal for Every Environment
Use Cases
Traffic Investigation
In seconds, users go from raw traffic to insights and next steps.
- Question: “Show me DNS query volume for each hour in the last day and top queried domains”
- The agent collects DNS traffic data and hourly volume
- Generates a line chart embedded in the chat
- Reports a table of evidence and suggests next steps, e.g. “Investigate the two most contacted domains…”
Policy Generation & Alerting
From idea to detection to alerts in seconds.
- “No SSH for host 192.168.2.38 during business hours”
- The agent generates an SQL query, executed periodically (1 or 5 minutes, hourly, daily)
- An alert is generated if the policy is violated
- The agent runs the query, explains the result, and registers the alert
Complex policies such as “traffic 2x the hourly baseline” and similar behavioral rules are also supported.
Alert Investigation via MCP
nAnalyst is also accessible as an MCP server running on ntopng, with no additional installation required. Connect from Claude Code, Cursor, or any MCP client to interact with ntopng data directly, correlate alerts, and get full security assessments with recommended remediation steps.
Specifications
Tech Specs
Comparison
Why is nAnalyst Different?
Beta Version Available
ntopng Enterprise L with nAnalyst
- Support for Anthropic, OpenAI, Local LLM
- MCP server
- nAnalyst is not a generic prompt or LLM wrapper, it ships with 25+ purpose-built, domain-specific tools that understand your network's data model.
Screenshots
Gallery
