Components

Lightweight portal with two responsibilities:

Terminal-based interface for operators who prefer CLI workflows. Query the AI engine, inspect alerts, trigger actions — all from the command line. Suitable for SSH-only environments and automation scripts.

Multi-source correlation engine — the cognitive core. Ingests alerts from Keep, searches historical patterns in Qdrant, queries topology from active-inventory, and reasons about root causes using a dual AI approach:

Live network topology graph. Discovers and tracks devices, links, interfaces, and services. Provides topological context to correlation-engine — enabling questions like "what else is affected by this fiber cut?" and blast radius estimation for remediation actions.

Unified observability platform for logs, metrics, and traces. Rust-based, 140x lower storage cost than Elasticsearch. Stores all raw telemetry and provides SQL + PromQL query interfaces. Also serves as the verification layer — re-queried after remediation to confirm recovery.

High-performance data pipeline. Ingests logs via syslog (TCP :9000) and Vector protocol (:6514), parses and enriches with VRL transforms, then routes to OpenObserve. Handles free5GC, perfSONAR, and network device logs with source-specific transforms.

AIOps platform for alert lifecycle management. Aggregates alerts from 110+ sources, deduplicates, correlates related alerts, and executes remediation via YAML-based declarative workflows. Serves as both the alert correlation layer (Orient) and the action execution layer (Act).

Vector database for similarity search. Stores embeddings of past incidents, runbooks, network states, and documentation. Enables "have we seen this pattern before?" queries — the memory of the system. Powers RAG for correlation-engine.

Cloud-native messaging backbone. Connects all components via pub/sub and request/reply. JetStream provides persistent streaming for alert events and topology changes. Sub-millisecond latency, under 20 MB RAM — the nervous system of a10y.