Post-install setup

Configure NEURU, field by field.

You installed NEURU — now connect it to your tools. Every integration below is optional; turn on only what you use. All settings live in NEURU under Config → Integrations (net_mon_config.php?tab=integrations). Each section shows exactly what to type in every field, using the example lab below.

The example lab used throughout this guide

Every "what to type" table below uses these made-up addresses and tokens. Swap in your own — the shape is what matters.

NEURU server10.20.0.5 — the box you installed NEURU on. Web UI at http://10.20.0.5:8090. Also runs n8n, Portainer, Smokeping & the NetFlow collector.
Log host10.20.0.8 — a second Docker host running Graylog.
Pi-hole10.20.5.2 — HTTPS with a self-signed certificate.
Your LAN10.20.0.0/24
Sample tokensAnything like ntk_7f3c… or eyJhbGc… below is fake — yours will look different but sit in the same box.
Read this first — the #1 confusion

Which key goes where?

There are only two kinds of keys. Every field in this guide is tagged paste INTO NEURU or NEURU generates it so you never mix them up.

① Keys you PASTE INTO NEURU

You get these from the other tool and paste them into NEURU so NEURU can talk to it.

  • n8n API Keyfrom n8n → Settings → n8n API
  • Portainer API Keyfrom Portainer → My account → Access tokens
  • Graylog / LibreNMS token, Pi-hole password, SMTP app passwordfrom each tool's settings
② The ONE key NEURU generates

NEURU makes this one; you paste it into the other side so it can call back into NEURU securely.

  • Inbound Token (X-NetMon-Token)Generate it in Config → Integrations → n8n. Paste it into your n8n credential; it's also the token your NEURU cron jobs use. This is NOT the n8n API key and NOT your license key.
Rule of thumb: a password box you fill in → came from another tool. A Generate button → NEURU made it, copy it out. Your license key (from your portal Dashboard) is separate — it only goes in Site Configuration → Licensing.
Jump to an integration
1 · Logs (Syslog / Graylog) 2 · n8n (AI & automation) 3 · n8n Webhooks 4 · Portainer 5 · Pi-hole 6 · Grafana Alloy / node_exporter 7 · LibreNMS 8 · Smokeping 9 · Email / SMTP 10 · NetFlow 11 · Solution Commander 12 · SNMP Discovery 13 · Licensing

1 · Logs — Internal Syslog or Graylog

Recommended

NEURU can be your log server two ways. Most people use the built-in syslog — nothing extra to install. Graylog is optional.

Option A — Built-in NEURU Syslog (default, easiest) NEURU generates it

  1. In NEURU: Config → Integrations → NEURU Syslog Server, set Active log source = NEURU Syslog Server.
  2. Set the Listen port (514) and Retention (days), Save.
  3. Point every device / server to send syslog to your NEURU box.
Example — what to type in each field
Active log sourceNEURU Syslog Server (default)
Listen port514
Devices send here. If 514 is taken, use e.g. 5140 and map it.
Retention (days)30
TCPon
Leave on so long TCP messages aren't truncated.
# On a Linux box you want to collect — point rsyslog at NEURU (10.20.0.5) echo "*.* @10.20.0.5:514" | sudo tee /etc/rsyslog.d/90-neuru.conf sudo systemctl restart rsyslog

One @ = UDP, two @@ = TCP. On MikroTik: System → Logging → Actions, add a remote action to 10.20.0.5:514.

Option B — Point at an existing Graylog paste INTO NEURU

  1. Set Active log source = Graylog.
  2. Fill Graylog URL and API Token, toggle Enable, then Test.
  3. Get the token in Graylog: top-right avatar → Edit tokens → Create token, copy it.
Example — what to type in each field
Graylog URLhttp://10.20.0.8:9000
The log host in our lab.
API Token1a2b3c4d5e6f7g8h9i0jk1l2m3n4
From Graylog → your profile → Edit tokens. paste INTO NEURU
Enableon

2 · n8n — AI & automation

The important one

n8n runs the AI brains & automation (incident RCA, DB advisor, self-heal, deception analyst…). It talks to NEURU both ways, so there are 4 fields split into two blocks: Portal → n8n and n8n → Portal.

Block 1 — Portal → n8n

  1. n8n Base URL — where n8n lives.
  2. n8n API Key — in n8n: Settings → n8n API → Create an API key. Paste into NEURU. paste INTO NEURU
  3. Portal Base URL — how n8n reaches this NEURU for callbacks. Use NEURU's LAN URL, never localhost (inside the n8n container that means n8n itself).
Example — what to type in each field
n8n Base URLhttp://10.20.0.5:5678
n8n API KeyeyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhcGkifQ.fake-n8n-jwt-xxxxxxxx
A long JWT string from n8n → Settings → n8n API. paste INTO NEURU
Portal Base URLhttp://10.20.0.5:8090
Your NEURU's LAN address + port — so flows can POST results back.

Block 2 — n8n → Portal (Inbound Token)

  1. Click Generate — NEURU creates the token. NEURU generates it
  2. Copy it and paste it into your n8n credential as the X-NetMon-Token header.
  3. Same token your NEURU cron jobs use — generate once, reuse everywhere. Rotate replaces it (update n8n after).
Example — what to type in each field
Inbound Tokenntk_7f3c9a1e42b8d6058c1f0a9e2b4d7c63
Click Generate — do NOT type your own. NEURU generates it
Header name (in n8n)X-NetMon-Token
Add this header to your n8n HTTP-request credential, value = the token above.

Don't have n8n yet? Spin it up:

docker run -d --name n8n --restart unless-stopped \ -p 5678:5678 -v n8n_data:/home/node/.n8n \ docker.n8n.io/n8nio/n8n

Open http://10.20.0.5:5678, create your n8n account, then grab the ready-made flows from n8n Flows and import them. Each flow's webhook URL goes into the n8n Webhooks table (next section).

3 · n8n Webhooks registry

If you use AI flows

Each AI/automation flow you import registers one webhook here — a unique slug NEURU calls by name. In n8n, open the flow's Webhook node and copy its Production URL; the last path segment is the slug.

  1. In NEURU: Config → Integrations → n8n Webhooks → Add.
  2. Give it a friendly Name, the matching Slug, paste the Webhook URL, pick the method, Enable.
Example — what to type in each field
NameLog RCA
Sluglog-rca
Must match what your code/flow calls it by. Common slugs: log-rca, anomaly-baseline, netops-copilot, self-heal, db-advisor.
Webhook URLhttp://10.20.0.5:5678/webhook/log-rca
Copy the flow's Production URL from its Webhook node. paste INTO NEURU
MethodPOST
Enabledon

Add one row per flow you imported. If a feature says "no AI configured", it just means its slug isn't in this table yet.

4 · Portainer — container management

Optional

Connect Portainer so NEURU can see & manage your Docker containers (and auto-heal them).

  1. Portainer URL — e.g. https://host:9443 or http://host:9000.
  2. Portainer API Key — in Portainer: username (top-right) → My account → Access tokens → Add access token. Copy, paste into NEURU. paste INTO NEURU
  3. Verify SSL — turn OFF if Portainer uses a self-signed cert.
  4. Host map (optional) — friendly names for endpoints, one name=ip per line, so NEURU can match a container host to a node.
Example — what to type in each field
Portainer URLhttp://10.20.0.5:9000
Portainer API Keyptr_9d81f0c4a7e6b25390f8c1d4e2a6b8f0
From Portainer → My account → Access tokens. paste INTO NEURU
Verify SSLoff
Off for self-signed / plain HTTP.
Host mapedge=10.20.0.5 logs=10.20.0.8
One per line. Left = the label you'll see, right = that Docker host's IP.

5 · Pi-hole — DNS & ad-blocking

Optional

Monitor Pi-hole (queries, blocked %, live log) and let NEURU's Immunity block domains fleet-wide. You can add multiple Pi-holes — each is a row.

  1. Config → Integrations → Pi-hole → Add a Pi-hole.
  2. Name + Address (scheme + host[:port], no /admin or /api).
  3. Web/API password = your Pi-hole admin password (the web-UI one). NEURU stores it encrypted and gets its own session. paste INTO NEURU
  4. Verify TLS off for self-signed HTTPS. Save, then Test.
Example — what to type in each field
NamePi-hole 1
Addresshttps://10.20.5.2
Scheme + host only. Custom port? e.g. https://10.20.5.2:4443
Web/API passwordMyPiholeAdminPass!23
Pi-hole's own admin password. paste INTO NEURU
Enabledon
Verify TLSoff
Off because our Pi-hole uses a self-signed cert.

Pi-hole v6 uses password-based API sessions — no separate token, just the admin password.

6 · Grafana Alloy / node_exporter — server metrics

For Linux/Windows monitoring

To read CPU/RAM/disk/network on your Linux & Windows servers without SSH, run a tiny metrics agent on each box and tell NEURU the port. No key needed — just reachability.

  1. On each server, run node_exporter (or Grafana Alloy) — it exposes Prometheus node_* metrics, usually on port 9100.
  2. In NEURU: Config → Integrations → Grafana Alloy, set the default port and path. Save.
  3. Per host in Linux Monitor → Add/Edit, choose Live metrics source = Grafana Alloy / node_exporter; the URL pre-fills to http://<host-ip>:9100/metrics.
Example — what to type in each field
Alloy port9100
node_exporter's default.
Metrics path/metrics
# quickest: node_exporter on a Linux box (serves http://<ip>:9100/metrics) docker run -d --name node-exporter --restart unless-stopped \ --net host --pid host -v "/:/host:ro,rslave" \ quay.io/prometheus/node-exporter:latest --path.rootfs=/host

7 · LibreNMS

Optional

Already run LibreNMS? NEURU can pull device data from it.

  1. LibreNMS URL — the base URL of your LibreNMS.
  2. API Token — in LibreNMS: Settings → API → API Settings → Create API access token. Paste into NEURU. paste INTO NEURU
  3. Toggle Enabled.
Example — what to type in each field
LibreNMS URLhttp://10.20.0.8:8000
API Token0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c
From LibreNMS → Settings → API. paste INTO NEURU
Enabledon

8 · Smokeping — latency graphs

Optional

Embed your Smokeping latency grapher inside NEURU, and optionally add/remove targets remotely via an n8n SSH flow.

  1. Smokeping URL — the web-UI base of your Smokeping.
  2. Container name — so NEURU can reload it.
  3. Remote target management is optional — needs an n8n webhook + an SSH credential on the host.
Example — what to type in each field
Smokeping URLhttp://10.20.0.5:1010/smokeping
Enableon
Docker host IP10.20.0.5
Where the Smokeping container runs.
Container namesmokeping
Targets file/config/Targets
Path inside the container.
n8n manage webhookhttp://10.20.0.5:5678/webhook/smokeping-manage
Optional — leave blank to use the embed only. paste INTO NEURU

9 · Email / SMTP — notifications

Recommended

So NEURU can email alerts & reports. Any provider works (Gmail, Office365, SendGrid, your own server). Gmail example below.

  1. Fill host / port / security. Gmail = smtp.gmail.com, 587, STARTTLS.
  2. Username + From = your address.
  3. Password — for Gmail, turn on 2-Step Verification, then create a 16-char App Password and use that (not your login password). paste INTO NEURU
  4. Enter a test recipient and Send test.
Example — what to type in each field
SMTP hostsmtp.gmail.com
Port587
SecuritySTARTTLS (587)
Username[email protected]
Passwordabcd efgh ijkl mnop
A Google App Password (16 chars), NOT your Gmail login. paste INTO NEURU
From address[email protected]
From nameNEURU

10 · NetFlow — traffic analysis

Optional

Point your routers/switches to export NetFlow/IPFIX to NEURU for per-app bandwidth analysis. No key needed — just enable and point the exporter.

  1. In NEURU: enable NetFlow, keep the default port 2055/udp.
  2. On your router, configure a NetFlow/IPFIX exporter aimed at NEURU-IP:2055, version 9.
  3. Optional: an alert webhook fires when an app spikes above its baseline.
Example — what to type in each field
Enable NetFlowon
Listen port (UDP)2055
Must be published on the container as 2055:2055/udp.
Retention (days)7
Sampling rate1
1 = unsampled. If your router samples 1:N, put N.
Baseline anomaly ×4
Alert when an app exceeds 4× its 24h average.
Alert webhookhttp://10.20.0.5:5678/webhook/netflow-alert
Optional. paste INTO NEURU
# MikroTik: IP → Traffic Flow → aim at NEURU (10.20.0.5) /ip traffic-flow set enabled=yes /ip traffic-flow target add dst-address=10.20.0.5 port=2055 version=9 # Cisco IOS ip flow-export destination 10.20.0.5 2055 ip flow-export version 9

11 · Adv. Solution Commander — AI-over-SSH

Optional

AI troubleshooting for routers & Linux. Two webhooks: rc_suggest = the AI brain (routers + Linux); rc_execute = bash-over-SSH on Linux targets only (routers run over NEURU's built-in Python SSH, no webhook needed).

Example — what to type in each field
rc_suggest_urlhttp://10.20.0.5:5678/webhook/rc-suggest
AI analysis for routers + Linux. paste INTO NEURU
rc_execute_urlhttp://10.20.0.5:5678/webhook/rc-exec
Linux bash SSH only. paste INTO NEURU

12 · SNMP Discovery — auto-find devices

Recommended at setup

NEURU can scan a subnet over SNMP and auto-add whatever answers. Set this once when you first stand NEURU up. Found under Config → Discovery.

  1. Subnet(s) to scan (CIDR), one per line.
  2. SNMP community (v2c) — the read-only string your devices use.
  3. Version 2c, then Run discovery (or set a schedule).
Example — what to type in each field
Subnets10.20.0.0/24
One CIDR per line. Add more subnets on their own lines.
SNMP communitypublic
Your read-only community string. paste INTO NEURU
Version2c
Schedulemanual
Or pick an interval to re-scan automatically.

13 · Licensing — activate your NEURU

Required

This is separate from every integration above. Your license key comes from your customer portal Dashboard and activates this NEURU install. It lives under Site Configuration → Licensing, not Integrations.

  1. Copy your license key from the portal Dashboard (click the key to copy).
  2. In NEURU: Site Configuration → Licensing, paste the License key and Activate.
  3. The Portal URL is pre-filled to your portal; only change it if you host the portal elsewhere.
Example — what to type in each field
License keyNEURU-XXXX-XXXX-XXXX-XXXX
From your portal Dashboard — NOT the n8n token, NOT the API key.
Portal URLhttps://portal.yourcompany.com
Where your NEURU license portal lives. Pre-filled; usually leave as-is.

NEURU verifies the license offline with a built-in public key — if the portal is briefly down, your NOC keeps running.

That's every integration.

Turn on what you use, skip the rest. Remember the two key kinds: paste-in vs NEURU-generated, and you\'ll never mix them up.

Back to Support Get the n8n flows