Tools and Licensing

nAnalyst exposes network intelligence functions to the AI agent as discrete tools. Which tools are available depends on your ntopng license: higher editions unlock progressively more tools, following the same license model used throughout ntopng (see versions and licensing).

The agentic tool layer was introduced in ntopng 6.7.

Tip

You do not need this page to see what your instance can do. From Enterprise M upward, click the Tools button in the nAnalyst chat header to open the Tools Catalog — a live, searchable list of every tool available to the agent on this box, with its license and annotations.

License model

nAnalyst is included from Enterprise M upward — there is no separate nAnalyst SKU and no per-tool add-on to purchase. The chat assistant and its full reasoning loop require at least Enterprise M. Community and Pro installations expose only the live-data tools listed below and do not include the chat assistant.

The number of tools grows sharply with the edition:

Higher editions always include everything unlocked by lower editions. Gating is enforced per tool in code: pro_tools.lua skips registering any tool whose edition gate the running instance does not meet. If your license does not include a tool, that tool is never registered for the session — it is invisible to the agent, not merely rejected at call time. The same tool set is used regardless of the client (chat interface or MCP).

Note

chart is available from Enterprise M, but only the pie and line chart types render below Enterprise XL. Asking for a bar, bubble or heatmap chart on Enterprise M or L returns a “requires Enterprise XL” error to the agent.

Annotations

Each tool carries machine-readable annotations, shown in the in-product Tools Catalog (open it from the tools icon in the nAnalyst chat header):

• read-only — does not modify ntopng state; safe to run unattended

• write — mutates configuration (policy, alert exclusion, monitoring); always confirmed with the user before execution

• artifact — can emit a rendered object in the chat (chart, geomap, Sankey, chord)

• clickhouse — requires the ClickHouse historical flow store to be enabled

Tool reference

Tool	Description	License	Annotations
add_active_monitoring_script	Enable a new active-monitoring check for a host	Community	write
discover_lan	Active + passive LAN device discovery (ARP/mDNS/SSDP, MAC-table fallback)	Community	read-only
get_country_stats	Top-N countries by traffic on the current interface	Community	read-only
get_interface_addresses	IP addresses of the monitored interface	Community	read-only
get_live_flows_for_host	Active flows involving one IP	Community	read-only
get_live_flows_summary	Aggregated live-flow summary (by country/app/proto/…)	Community	read-only
get_mac_info	Manufacturer, device type, pool, IPs for a MAC	Community	read-only
list_available_active_monitoring_scripts	Active-monitoring script catalog	Community	read-only
list_enabled_active_monitoring_scripts	Currently enabled active-monitoring checks	Community	read-only
chart	Render a chart. pie/line from Enterprise M; bar/bubble/heatmap require Enterprise XL	Enterprise M	read-only, artifact
describe_table	Full column schema (name, type, comment) for a ClickHouse table	Enterprise M	read-only, clickhouse
get_live_flow	Live flow snapshot for the flow currently open in the UI	Enterprise M	read-only
list_expected_servers	Approved DNS/NTP/DHCP/SMTP/gateway server whitelist	Enterprise M	read-only
list_networks	Configured local network CIDR subnets for an interface	Enterprise M	read-only
list_tables	List queryable ClickHouse tables with one-line descriptions	Enterprise M	read-only, clickhouse
query	Execute arbitrary ClickHouse SQL against ntopng tables	Enterprise M	read-only, clickhouse
add_host_alert_exclusion	Suppress alerts for a host IP (reason mandatory)	Enterprise L	write
get_access_control_list	Configured flow-level ACL rules	Enterprise L	read-only
get_asset_info	Persistent asset identity/inventory from the DB	Enterprise L	read-only, clickhouse
get_infrastructure_stats	Aggregate stats across all interfaces	Enterprise L	read-only
get_observation_point_exporters	Exporters reporting to an observation point	Enterprise L	read-only
get_site_sankey	Site-to-site traffic Sankey	Enterprise L	read-only, artifact
get_top_exporter_interfaces	Top exporter interfaces by traffic	Enterprise L	read-only
list_flow_exporters	All NetFlow/sFlow/IPFIX exporters feeding ntopng	Enterprise L	read-only
add_certificate_alert_exclusion	Suppress alerts for a TLS certificate	Enterprise XL	write
add_domain_alert_exclusion	Suppress alerts toward a domain	Enterprise XL	write
chord	Chord diagram for same-type entity relationships	Enterprise XL	read-only, artifact, clickhouse
create_ai_policy	Create + save an AI security policy	Enterprise XL	write
geomap	Geographic world map (choropleth heatmap or live dots)	Enterprise XL	read-only, artifact, clickhouse
get_asn_config	Configured customer / sub-customer / remote ASN policy	Enterprise XL	read-only
get_exporter_sites_map	Flow exporters grouped by site (graph / sankey)	Enterprise XL	read-only, artifact
get_historical_flow	Historical single-flow record from ClickHouse	Enterprise XL	read-only
get_host_info	Live real-time host stats (flows, scores, alerts, QoE, DNS, TCP health)	Enterprise XL	read-only
get_modbus_stats	Modbus (ICS) per-flow stats	Enterprise XL	read-only
get_nedge_firewall_policy	nEdge inter-LAN firewall rules (nEdge only)	Enterprise XL	read-only
get_network_policy	Local/corporate device networks + whitelists	Enterprise XL	read-only
get_profinet_stats	PROFINET (ICS) per-flow stats	Enterprise XL	read-only
get_s7comm_stats	S7comm / Siemens (ICS) per-flow stats	Enterprise XL	read-only
get_site_traffic	Site-to-site traffic matrix (bytes per site pair)	Enterprise XL	read-only
get_snmp_device_config	SNMP polling config for one device	Enterprise XL	read-only
get_snmp_device_info	Full SNMP device snapshot (interfaces, LLDP/CDP neighbors)	Enterprise XL	read-only
get_snmp_interface_details	Detailed stats for one SNMP interface	Enterprise XL	read-only
get_snmp_interface_roles	SNMP interface roles (transit/peering/access) across devices	Enterprise XL	read-only
get_timeseries	Fetch timeseries as compact min/max/avg/last summary	Enterprise XL	read-only, artifact
get_vlan_traffic	VLAN traffic by port/protocol, live or historical	Enterprise XL	read-only, artifact
get_wazuh_alert_exceptions	Configured Wazuh digest exceptions	Enterprise XL	read-only
get_wazuh_alert_rules	Configured Wazuh digest rules	Enterprise XL	read-only
get_wazuh_alerts	Security alerts ingested from Wazuh SIEM/HIDS	Enterprise XL	read-only
list_ai_policies	List configured AI security policies	Enterprise XL	read-only
list_protos	nDPI protocols/apps for a category	Enterprise XL	read-only
list_sites	Configured sites and their networks	Enterprise XL	read-only
list_snmp_devices	All SNMP-monitored devices	Enterprise XL	read-only
list_timeseries	Discover timeseries schemas, tags, metrics for an entity	Enterprise XL	read-only
resolve_proto	Batch-resolve protocol names ↔ IDs (l4/app/cat)	Enterprise XL	read-only
sankey	Render multi-hop flow-path Sankey diagram	Enterprise XL	read-only, artifact, clickhouse

The Tools Catalog

From Enterprise M upward, the nAnalyst chat page has a Tools button in its header (toolbox icon, top toolbar). Clicking it opens the Tools Catalog: a modal that enumerates every tool registered for the current session — the same list the AI agent itself sees.

The Tools Catalog modal, opened from the nAnalyst chat header

For each tool the catalog shows:

• Name — the human-readable tool name

• Description — what the tool does

• License — the minimum edition that unlocks it (Community, Enterprise M, Enterprise L, or Enterprise XL)

• Annotations — read-only / write, plus artifact and clickhouse where they apply

The table is searchable and sortable (by name or license), so an operator can quickly answer “what can this assistant actually do on this box?” and “what would upgrading unlock?”. Only tools your license includes are listed — a tool your edition does not unlock is never registered and therefore never appears, matching exactly what the agent can call.