New · Release 2026.04, Multi-tenant audit exports & SLA dashboards now liveSee changelog →
Network operations
Network telemetry hub: SNMP, incidents and playbooks
Poll devices over SNMP, ingest metrics and syslog over HTTP, and turn signals into incidents with RCA reports and remediation playbooks — deeper network operations in one hub.
Product illustration · sample data
Infrastructure / Live
142/142 healthy
CPU avg
34%
Memory avg
62%
api-prod-01.acme.io98ms
db-primary.acme.io12ms
worker-eu-03.acme.ioSSL expires 14d
Product proof
Already live in the product
Backed by app modules
Running in production today: SNMP polling on schedule, incidents, RCA reports, and remediation playbooks.
Protected app route: /network-telemetry
How it works
Built around real workflows
Highlights below describe capabilities already present in the protected app behind this page.
SNMP v2c polling with samples
Metrics and syslog HTTP ingest
Incidents with RCA reports
Remediation playbooks
Workflow
What teams can do here
Step 1
Add SNMP targets
Step 2
Collect metrics and syslog
Step 3
Raise incidents from signals
Step 4
Run remediation playbooks
How it works
How it works
01
Collect from SNMP and pushed sources
Poll devices over SNMP for standard MIB-II data and, alongside it, accept pushed metrics and syslog over HTTP. Metric and syslog ingest is authenticated with an org-scoped API key that is hashed at rest, and every batch is recorded in an ingest log.
02
Correlate signals into incidents
A scheduled correlation task groups related server alerts inside a deduplicated window into a single incident, so a cluster of symptoms becomes one investigable event. An incident can be linked to a ticket to drive the response.
03
Write the root-cause analysis
Each incident can carry an RCA report with a timeline of what happened, a root-cause hypothesis and the corrective actions taken. That turns a resolved incident into a durable record the team can learn from and audit later.
04
Remediate with approved playbooks
Remediation playbooks hold an approved shell snippet that runs over SSH against a chosen server, with an allowlist enforced in the executor and an optional two-person approval. Every run is captured as an execution record with its output and success state.
05
Project trends as estimates
From the retained poll history the hub can fit a simple linear projection to forecast where a counter is heading. The result is explicitly labelled an estimate rather than a guarantee, so it informs capacity planning without pretending to be an SLA.
Example
A worked example
A typical hospital network team pushes syslog from 60 devices and metrics from its own scripts into the hub using a hashed, org-scoped API key. Overnight, eight servers behind one core switch raise CPU alerts; the correlation window folds them into a single incident linked to one ticket instead of eight pages. The engineer records the timeline and a root-cause hypothesis — a stuck backup job — then runs the approved restart playbook over SSH, its output captured in the execution log. A linear projection over the switch's poll history, labelled clearly as an estimate, feeds the next capacity review.
FAQ
Frequently asked questions
How do I push metrics or syslog into the hub?
Generate an organization-scoped telemetry API key, whose secret is stored only as a hash, and post JSON batches of metrics or syslog lines over HTTP. Each batch is written to an ingest log, and syslog entries keep facility, severity and app name for filtering.
What does incident correlation actually do?
Rather than alerting on every symptom, a scheduled task links related server alerts that fall inside a deduplication window into one incident. That single incident can be attached to a ticket, so the team works one event instead of chasing a dozen notifications.
What goes into a root-cause report?
An RCA report attached to an incident holds a timeline of notes, a root-cause hypothesis and the corrective actions taken, along with who created it. It gives every significant incident a written, reviewable record instead of tribal memory.
Are remediation playbooks safe to run?
A playbook stores an approved shell snippet that executes over SSH on a selected server, with an allowlist enforced in the executor and an optional two-person approval before it runs. Each execution is logged with its output, success flag and any error.
Does the forecast give me a guaranteed number?
No. Forecasting fits a simple linear trend to recent poll values and returns a projected next value that is explicitly marked as an estimate, not an SLA. It is meant to hint at where a metric is heading, not to promise a threshold.
How are SNMP community strings protected here?
SNMP target community strings are encrypted per organization at rest and decrypted only when a poll runs. Combined with the hashed push API keys, both the pull and push paths keep their secrets out of plain text and scoped to your tenant.