NP4th

Sign in to your organization dashboard.

Includes 10 agent seats free for 30 days. Billing starts only after the trial (or when you purchase licenses).

End User License Agreement

Please review and accept to continue.

Master Service Agreement

An Owner or Admin must accept for your organization.

Add test

Creates a probe target agents will test on each run. Internal IPs and corp hostnames are supported.

NP4th

Internet check from the NP4th cloud — same targets and traceroute as agents. For path/MITM from your network use Run on my PC.

Identity
Web - Cloud
Ready.

Target results

TargetIPDNS msAvg msLoss % TCPTLSHopsOK

Traceroute hops

Select a target to view hops.

Path map

Paths draw as each target finishes.
Cloud test - results also appear in the Runs list when finished.

Probe alerts

Test

Edit probe settings. Save from the bar at the bottom of Config.
NP4th
User manual

Reports

Fleet status at the top: ALL CLEAR / ATTENTION / CRITICAL. Drill into degraded or critical tests, or open alerts, without hunting the table.

Signed in to -
Role -
Settings User manual

Path map

Live - every 5s Select targets from a run to plot paths.
Loading map…
Each selected target is a different color - numbered dots are hop order along that path Hop 1 = your PC (Windows location when allowed; otherwise public-IP estimate)

Test runs

Click a run to open its detail drawer; pick targets there to plot paths. Filter by destination to compare agents on the map. Run on my PC uses your Windows agent; Run cloud test probes from the NP4th cloud (not your home path / MITM view — use the Windows agent for that).

Loading runs…
Loading…

Test detail

Sites

Physical locations are suggested from shared public egress (/24). Rename a suggestion to activate it. Use sites to compare test health when one office fails and another does not.

Name Status Agents Cluster ISP Last seen
Loading…

Site

Installed agents

Download installer Download MSI package Download MSI

Each Windows machine is a billable agent (stable MachineGuid -- reinstall keeps the same id). Online = heartbeat or run upload in the last 15 minutes. Billable = scanned (seen or uploaded) in the last 30 days. Soft-delete hides a machine from this list; it remains billable for up to 30 days (use Show deleted to restore).

0 selected
Status Machine Source Tray / Service First seen Last seen Last run Runs Billable Device id
Loading...

Deleted (still billable)

Soft-deleted agents remain here while they have activity in the last 30 days (they still count toward billing). Restore puts them back on the active list. After 30 days without scans they drop off automatically.

Machine Deleted Last activity Runs Billable Device id
None

User management

The first user in a tenant is Owner. SSO users are JIT-provisioned; Admin/User follow Entra groups. Owner roles stay locked for break-glass. At least one active Owner is required.

Add user

Name Email Role SSO Status
Loading...

Edit user

Owner roles are locked. Admin/User follow Entra groups.

Tests

What your agents probe on each scheduled run. Click a test to edit; traceroute runs on every probe.

Spreadsheet view (advanced)

Inline editing for power users. Same data as the catalog above — changes sync both ways.

Id Display name Host Ping TCP TLS UDP Trace TCP UDP port Interval Groups Dest site
Unsaved changes to tests

Groups

Create a group, select it in the list, then assign agents and tests. New groups start with all tests selected — trim or use Select all / Clear as needed. Agents in multiple groups get the combined tests from every group they belong to, plus any ungrouped tests. Tests with no group run on everyone.

Loading groups…
Select a group to assign agents and tests.

Probe options

These settings apply to every agent that syncs this org's config. Interval controls how often the Windows service runs background tests.

Service packs

Check the tests you want. Uncheck to drop them from your list, then Save. Country chips bulk-select a region. Agents pick up the saved list on the next cycle.

Loading packs…
Select a pack to review its checks.

Reports

Endpoints

Sort
Loading…
Loading reports…
Loading...
No endpoints yet Add tests in Config so agents know what to probe.
Fleet status — Loading health…

Network technician insights

Correlates probe alerts, Wi‑Fi signal, and test health into actionable diagnoses — like a tier‑1 NOC tech summarizing what broke.

Test leaderboard

All probe targets for this range. One path per endpoint on the map. Click a test for agent detail.

Paths

Loading map…

Tests

Test▲ Host Avg Worst Loss Success Samples
Loading…

Endpoint

Paths to this endpoint

Loading map…

Agent leaderboard

Map Agent Last seen▼ Avg Worst Loss Success Samples Trend
Select an endpoint…

Latency over time

Recent failures

User profile

Name

Contact

Access

NP4th role

-

Set by Entra group mapping on SSO. Owner roles stay locked for break-glass access.

Role source

-

SSO identity

Entra groups

    Captured on your last SSO sign-in. Sign in with SSO again to refresh.

    Dashboard

    Organization

    Identity

    Slug

    -

    Used in agent installs and SSO URLs. Cannot be changed.

    Your role

    -

    Address

    Phone

    Only Admins and Owners can edit organization details.

    Manage people on the Users tab.

    Billing & licenses

    Agent licenses are $1 per agent per month, billed as a Stripe subscription. Minimum 10 seats. Billing starts on the day you subscribe and renews monthly. Cancel anytime in the Stripe portal — access continues until the end of the paid period.

    Subscription

    -

    Licensed seats

    -

    Agents using seats

    -

    Available

    -

    Current period ends

    -

    Billable agents

    Agents stay billable for 30 days after last scan/heartbeat. Soft-deleted agents remain listed until that date.

    Machine Status Last activity Billable until Device id
    Loading…

    Agent keys

    Use Download agent, extract the ZIP, then run Install-NP4th.cmd from that folder (not from inside the ZIP window). Devices that enroll with a key are added to that key’s default group on first contact (if set).

    Loading...

    Encryption

    Tenant data is encrypted with a per-tenant key. Optionally wrap it with your own customer master key (BYOK). Losing the CMK makes ciphertext unreadable.

    Status: - - fingerprint -

    -

    SAML SSO

    Optional Entra / SAML 2.0 IdP. Users sign in with email; match accounts by Entra object ID (user.objectid).

    Identity provider

    Domains & access

    Group mapping

    Map Entra groups to Admin or User (object IDs and/or names, one per line). Highest match wins.

    Entra group claim tips Prefer Group ID. For names, enable Emit group name for cloud-only groups. Do not use a regex replace with $1 unless the pattern has a capture group - a broken regex empties the claim.

    Break-glass (Owner password only): /dashboard/local.html

    Download SP metadata
    SSO claim test
    Claim type Value
    Use the profile menu (top right) to sign out.
    Copyright (c) Didur Labs LLC. All rights reserved. EULA ? MSA

    SIEM export

    Forward selected audit events from this organization to your SIEM or log collector. Choose an HTTPS webhook (JSON POST) or syslog, then pick which categories and syslog level to send.

    Destination

    UDP cannot confirm delivery. TCP connects and sends each JSON event followed by a newline. Most collectors expect BSD/RFC 3164.

    Checks DNS and whether the NP4th cloud can reach this host:port. Uses the values above — save is not required.

    What to send

    Choose which audited events to export. Probe runs are never exported.

    Level is written on the syslog PRI and in the JSON body. With raise-for-failures, “Send at or above” can drop successful informational events (e.g. Warning sends failures only).

    Test uses the saved destination (save first). Sends a synthetic siem.test event even if export is disabled. Enable export for live events.

    Use the profile menu (top right) to sign out.
    Copyright (c) Didur Labs LLC. All rights reserved. EULA · MSA

    Alert notifications

    Get email and/or webhook notifications when probe alerts open or resolve (including UniFi attachment changes). Quiet hours suppress delivery during the selected local window.

    Test uses the saved settings (save first). Sends a synthetic high-severity alert sample.

    Use the profile menu (top right) to sign out.
    Copyright (c) Didur Labs LLC. All rights reserved.

    SLA digests

    Schedule one or more daily emails comparing the last 7 days of probe loss and latency to the prior 7 days. Each digest can have its own recipients, send time, and scope (whole org or selected agent groups). Requires platform SMTP (ContactMail) to be configured.

    Loading…

    Digest

    Use the profile menu (top right) to sign out.
    Copyright (c) Didur Labs LLC. All rights reserved.

    Network integrations

    Pull UniFi APs, switches, and gateways so traceroute hops get names. When clients are available, runs also get an AP/SSID/switch card, Wi‑Fi blame hints, and attachment-change alerts.

    UniFi is configured per physical site — open Sites, select a site, and use the UniFi integration section there. Topology applies to agents assigned to that site.

    Sites overview

    Loading…