Investigation tooling
NOC Insight
Network troubleshooting and investigation platform for NOC teams, bringing monitoring evidence, diagnostic checks, and incident context into one workflow.
This is an internal system, so the source code is not public. Screenshots on this page use sample data or are redacted: customer names, addresses and other internal details are removed.
Context
NOC troubleshooting often requires checking multiple monitoring, network, and operational sources before an incident can be understood.
NOC Insight was created to bring investigation evidence into a structured workflow so NOC engineers can move from incident context to testing, correlation, diagnosis, action, and verification in one place.
- Used by
- Designed for NOC engineers and supervisors
- How often
- During incident investigation and troubleshooting
Problem
Investigating a network incident often requires switching between monitoring systems, connectivity tests, logs, configuration information, and historical data before the actual problem can be understood.
This makes investigations harder to follow, especially when multiple sources provide partial or conflicting evidence.
Constraints
- Evidence comes from multiple monitoring and operational sources.
- Different investigations require different diagnostic tests.
- Internal infrastructure information must remain private and sanitized.
- Diagnosis must remain grounded in observable evidence rather than relying only on AI-generated conclusions.
- The workflow must support multi-vendor network environments.
Approach
NOC Insight follows an evidence-first investigation workflow:
Collect → Test → Correlate → Diagnose → Recommend → NOC Action → Verify
The platform gathers available incident context, runs or records diagnostic checks, correlates relevant evidence, produces a structured diagnosis, recommends an operational action, and allows the result to be verified after the action is taken.
Key decisions & trade-offs
- Use a structured investigation workflow instead of making AI the primary interface.
- NOC engineers need to see the underlying evidence and investigation steps instead of receiving an unexplained conclusion.
- Keep AI assistance read-only and evidence-driven.
- AI can help summarize or correlate investigation evidence, but operational decisions must remain visible and under NOC control.
Trade-offs
- A structured workflow requires more explicit investigation steps than a simple chat interface.
- Evidence-first investigation can produce more detailed reports, but requires more context to be collected before a diagnosis can be formed.
- Supporting multiple network vendors increases integration complexity.
- Private infrastructure data requires additional sanitization before screenshots or architecture diagrams can be published.
Architecture
NOC Insight combines incident context, monitoring data, diagnostic tests, correlation logic, investigation evidence, and reporting into a single troubleshooting workflow.
The architecture is designed around separate collection, testing, correlation, diagnosis, recommendation, and verification stages so each step can be inspected independently.
- Collect Collect incident context and available monitoring evidence relevant to the affected device, interface, service, or customer scope.
- Test Run or record connectivity and diagnostic checks to validate the current network condition.
- Checks Standard checks run against the affected path.
- Diagnose Convert the collected evidence into a structured diagnosis with supporting findings and identified contradictions.
- Recommend Generate a recommended operational action based on the available evidence and diagnosed condition.
- Verify Re-check the affected condition after the action to determine whether the incident has improved or been resolved.
Key features
Incident Investigation
Combines network connectivity tests and diagnostic evidence to validate the condition observed during an incident.
Connectivity & Diagnostic Analysis
Combines network connectivity tests and diagnostic evidence to validate the condition observed during an incident.
Evidence Correlation
Brings relevant monitoring events, logs, configuration information, and historical evidence together to support the investigation.
Configuration & Change Context
Provides configuration snapshot or change context to help determine whether a recent configuration change is related to the incident.
Investigation Timeline
Records investigation events, tests, findings, actions, and verification steps in chronological order.
AI-Assisted Analysis
Uses AI as an analysis and summarization aid while keeping the underlying evidence visible to the NOC operator.
My role
Sole developer · System designer · NOC workflow designer
Designed the investigation workflow and system architecture.
Designed and implemented the backend investigation logic and API layer.
Designed the frontend workflow for presenting incidents, evidence, diagnostics, and investigation results.
Integrated monitoring and network diagnostic sources required by the investigation workflow.
Designed the reporting structure so technical findings can be understood and acted on by NOC operators.
- Defined the Collect → Test → Correlate → Diagnose → Recommend → Verify workflow.
- Designed the evidence-first investigation model.
- Implemented the application backend and API components.
- Designed the investigation and reporting interface.
- Integrated operational network and monitoring data into the investigation workflow.
Result
- Before
- Investigation required checking multiple monitoring, diagnostic, log, and configuration sources separately.
- After
- Investigation evidence is presented through a structured workflow in one place, from initial context through verification.
A unified investigation workflow that brings incident context, diagnostic evidence, correlation, diagnosis, recommendation, and verification into one operational workflow.
What I'd improve
- Expand vendor integrations and investigation adapters.
- Improve historical baseline and anomaly detection capabilities.
- Expand correlation between monitoring events, logs, configuration changes, and traffic conditions.
- Improve investigation result validation and post-incident verification.
- Expand reporting and incident timeline capabilities.
Gallery
