Full Stack Observability & Security Platform
An enterprise-grade system combining agent-based data collection, a live digital twin, a single source of truth (SSOT), intelligent NetOps automation, and an agentic support layer — built to make complex networks transparent, secure, and self-healing.
01 · Background
Why this platform exists
Enterprise networks are a mess of siloed dashboards, disconnected logs, vendor-locked CLIs, and static spreadsheets that nobody trusts. Operations teams lose hours chasing conflicting data across five different tools, while security teams can't correlate CVEs with live topology in real time.
Astrix was conceived after speaking with 50+ operators, NOC engineers, and security leads who all described the same root problem: there is no single place that reflects what the network actually looks like right now. Everything is stale, scattered, or manually maintained.
"We have 12 dashboards and none of them agree with each other. I always end up calling someone to confirm what's actually running." — Network Ops Lead, Telecom Sector
The answer was a unified platform with three interlocking pillars: a live digital twin that mirrors the physical network, a source of truth (SSOT) that every team and tool pulls from, and an agentic layer that automates workflows agents can reason over.
02 · Architecture
How the system is layered
Astrix is built as a multi-layer intelligence stack. Each layer has a clear responsibility and clean interfaces upward and downward, making it possible to swap or upgrade components independently.
03 · Digital Twin
A live mirror of the physical network
The digital twin is the most technically ambitious part of Astrix. It maintains a real-time executable model of every device, interface, routing table, and policy on the network. Every 30 seconds, collector agents reconcile the twin state with observed telemetry and flag drift events.
This is not just a visual map. The twin is a functional simulation layer — you can run "what-if" scenarios (e.g., "what happens if this link fails?"), validate config changes in a sandboxed copy before pushing to production, and predict blast radius for any planned change.
What the twin enables
- Pre-flight config validation in a safe clone
- Blast-radius prediction for planned changes
- Link-failure simulation for resilience testing
- Historical state replay for root cause analysis
- Auto-detection of topology drift vs. CMDB
Implementation details
- Graph DB (Neo4j-compatible schema) for topology
- Event-sourced state machine for device status
- Reconciliation loop with SNMP + gNMI collectors
- WebSocket push for real-time UI updates
- Versioned snapshots for historical comparison
04 · Source of Truth
One place every tool trusts
The SSOT is the canonical data layer of Astrix. Every collector, every agent, every UI panel, and every external integration reads from and writes back to the SSOT. No more stale spreadsheets or conflicting CMDBs.
It is structured as a versioned, event-sourced graph with a time-series sidecar. Every mutation is journaled, attributed, and reversible. A full audit trail is available for compliance workflows out of the box.
The SSOT enforces a strict schema with semantic versioning. Breaking changes go through a migration pipeline. Consumer agents get schema-validation hooks at subscription time, so stale readers fail fast instead of silently diverging.
05 · Agent Tooling
Versatile tools the agents call
Agents in Astrix are tool-calling LLMs backed by a curated library of deterministic tools. Each tool has a typed schema, a guaranteed side-effect contract, and a dry-run mode. Agents compose tool calls to solve multi-step problems without hallucinating intermediate state.
06 · NetOps Automation
From raw alert to resolved ticket — automatically
The NetOps pipeline is the operational core of Astrix. When an anomaly fires — whether it's a link flap, a BGP withdraw, an interface error spike, or a CVE match — the system runs a multi-step agentic workflow to triage, diagnose, propose a fix, validate it in the twin, and either auto-remediate or hand off to a human with full context.
07 · Security & CVE Remediation
Vulnerability context meets live topology
Traditional CVE scanners dump a list of scores. Astrix goes further: the CVE agent cross-references each finding against the live SSOT to answer "which devices on my network are actually exposed, what's the patch path, and what's the blast radius of patching vs. not patching?"
The pipeline ingests NVD feeds, vendor advisories, and exploit-db entries into an enriched vector store. At query time, a RAG chain retrieves relevant vulnerability records, maps them to live device firmware versions in the SSOT, and ranks them by exploitability weighted by network exposure.
CVE Pipeline stages
- NVD + vendor advisory ingestion (daily sync)
- Embedding + vector store indexing
- Device firmware × CVE matrix generation
- Exposure scoring via topology graph
- Patch path resolution with change simulation
- Operator-grade remediation report
Outputs for the operator
- Ranked list: exposed devices × CVE severity
- Blast radius of patching each device cluster
- Recommended maintenance window timing
- Pre-staged rollback config in twin vault
- Auto-drafted change ticket with evidence
- Compliance attestation export (PDF/JSON)
08 · Agentic Support Layer
AI-assisted support for operations teams
Astrix ships an embedded support system for operations and customer success teams. When a ticket arrives, an agent retrieves context from the SSOT and digital twin, drafts a response grounded in live network state, and routes the ticket based on device ownership and severity.
The key design challenge was retrieval quality at scale. With thousands of tickets, docs, and config snippets, a naive dense retrieval collapses under ambiguity. The solution was a hybrid retrieval stack (BM25 + dense vectors) with a cross-encoder reranker and a hard citation requirement — every agent response must ground every claim to a retrieved passage or SSOT fact.
09 · Evaluation & Quality
Measuring what actually matters
Every agent capability in Astrix has an eval harness. Evals run on golden datasets built from real operator cases (anonymized), and gate every deploy. A regression on answer faithfulness or citation recall blocks the release.
10 · My Contributions as AI Engineer
What I built and owned
- 01 Designed the SSOT schema — graph topology layer, time-series sidecar, event journal, and versioned config vault — and built the reconciliation loop against live SNMP/gNMI collectors.
- 02 Architected the digital twin simulation engine: device state machine, link-failure simulator, impact predictor, and sandboxed change preview environment.
- 03 Built the agent tool library (8 tools, typed schemas, dry-run modes) and the multi-step agentic NetOps pipeline with confidence-gated auto-remediation.
- 04 Implemented the CVE remediation pipeline: NVD ingestion, vector store indexing, firmware × CVE matrix, topology-weighted exposure scoring, and patch path simulation.
- 05 Designed the hybrid RAG stack (BM25 + dense vectors + cross-encoder reranker) for the agentic support layer with hard citation requirements and faithfulness evals.
- 06 Built the eval harness: golden datasets from 50+ real operator cases, automated faithfulness scoring, citation recall measurement, and regression gates on every deploy.
- 07 Instrumented the full stack: token cost tracking, agent latency histograms, resolution rate dashboards, and escalation funnel analytics for continuous improvement.
- 08 Conducted 50+ stakeholder interviews with NOC engineers, security leads, and product managers to shape the product requirements and prioritize the roadmap.