← Back to Work
Case Study · Astrix Platform

Full Stack Observability & Security Platform

An enterprise-grade system combining agent-based data collection, a live digital twin, a single source of truth (SSOT), intelligent NetOps automation, and an agentic support layer — built to make complex networks transparent, secure, and self-healing.

Digital Twin SSOT NetOps AI Agent Tooling RAG Pipeline CVE Remediation Observability Security
ASTRIX
Observability · Security · Intelligence
50+ Stakeholders interviewed
1 yr+ Build journey
6 Agent tools shipped
~80% Ticket automation rate

Why this platform exists

Enterprise networks are a mess of siloed dashboards, disconnected logs, vendor-locked CLIs, and static spreadsheets that nobody trusts. Operations teams lose hours chasing conflicting data across five different tools, while security teams can't correlate CVEs with live topology in real time.

Astrix was conceived after speaking with 50+ operators, NOC engineers, and security leads who all described the same root problem: there is no single place that reflects what the network actually looks like right now. Everything is stale, scattered, or manually maintained.

"We have 12 dashboards and none of them agree with each other. I always end up calling someone to confirm what's actually running." — Network Ops Lead, Telecom Sector

The answer was a unified platform with three interlocking pillars: a live digital twin that mirrors the physical network, a source of truth (SSOT) that every team and tool pulls from, and an agentic layer that automates workflows agents can reason over.


How the system is layered

Astrix is built as a multi-layer intelligence stack. Each layer has a clear responsibility and clean interfaces upward and downward, making it possible to swap or upgrade components independently.

System Architecture — Layer View
Devices
Routers Switches Firewalls Endpoints IoT / Edge
Collectors
SNMP Agent sFlow Tap gNMI Stream Syslog Parser NETCONF Poller
SSOT Core
Graph DB (topology) Time-Series Store Config Vault Event Bus
Digital Twin
Topology Mirror State Simulator Impact Predictor Change Sandbox
Agent Layer
Triage Agent Remediation Agent CVE Agent Change Agent Report Agent
UI / API
Operator Dashboard REST API Webhook Sink Ticket Integrations

A live mirror of the physical network

The digital twin is the most technically ambitious part of Astrix. It maintains a real-time executable model of every device, interface, routing table, and policy on the network. Every 30 seconds, collector agents reconcile the twin state with observed telemetry and flag drift events.

This is not just a visual map. The twin is a functional simulation layer — you can run "what-if" scenarios (e.g., "what happens if this link fails?"), validate config changes in a sandboxed copy before pushing to production, and predict blast radius for any planned change.

Physical Network
Core router · AS65001
Edge switch · VLAN 10/20/30
Firewall cluster · HA active-passive
72 endpoints · 3 subnets
BGP peers · 4 upstreams
Live Sync
Digital Twin
Graph model · 847 nodes
State snapshot · every 30s
Drift detection · 12ms p99
Sandbox copy · on demand
Impact predictor · path-aware

What the twin enables

  • Pre-flight config validation in a safe clone
  • Blast-radius prediction for planned changes
  • Link-failure simulation for resilience testing
  • Historical state replay for root cause analysis
  • Auto-detection of topology drift vs. CMDB

Implementation details

  • Graph DB (Neo4j-compatible schema) for topology
  • Event-sourced state machine for device status
  • Reconciliation loop with SNMP + gNMI collectors
  • WebSocket push for real-time UI updates
  • Versioned snapshots for historical comparison

One place every tool trusts

The SSOT is the canonical data layer of Astrix. Every collector, every agent, every UI panel, and every external integration reads from and writes back to the SSOT. No more stale spreadsheets or conflicting CMDBs.

It is structured as a versioned, event-sourced graph with a time-series sidecar. Every mutation is journaled, attributed, and reversible. A full audit trail is available for compliance workflows out of the box.

SSOT Core
Collector Agents
Digital Twin
NetOps Agents
Security / CVE
Operator UI
Ticket System
CMDB Sync
Report Agent

The SSOT enforces a strict schema with semantic versioning. Breaking changes go through a migration pipeline. Consumer agents get schema-validation hooks at subscription time, so stale readers fail fast instead of silently diverging.

Data consistency across consumers 99.7%
CMDB reconciliation accuracy 97.2%
Audit trail coverage 100%
Schema migration success rate 98.5%

Versatile tools the agents call

Agents in Astrix are tool-calling LLMs backed by a curated library of deterministic tools. Each tool has a typed schema, a guaranteed side-effect contract, and a dry-run mode. Agents compose tool calls to solve multi-step problems without hallucinating intermediate state.

🔍
topology_query
Graph traversal over live SSOT. Returns device neighbors, paths, VLAN memberships, and link states.
🌐
device_snapshot
Pulls a point-in-time config and telemetry snapshot for any device from the digital twin registry.
🛡️
cve_lookup
RAG-based retrieval over enriched CVE database. Returns scored vulnerability entries with patch paths.
⚙️
config_push
Validated config push with pre-flight twin sandbox check, rollback anchor, and approval gate.
📊
metrics_fetch
Time-series query over interface utilization, error rates, latency, and packet-loss histograms.
🎫
ticket_create
Structured ticket creation with context attachment, severity tagging, and auto-routing to the right queue.
🔮
impact_predict
Runs a what-if simulation on the twin to score blast radius before any live change is approved.
📋
report_gen
Generates structured ops reports: SLA summaries, anomaly digests, and change window recaps.

From raw alert to resolved ticket — automatically

The NetOps pipeline is the operational core of Astrix. When an anomaly fires — whether it's a link flap, a BGP withdraw, an interface error spike, or a CVE match — the system runs a multi-step agentic workflow to triage, diagnose, propose a fix, validate it in the twin, and either auto-remediate or hand off to a human with full context.

01
Ingest
SNMP trap, sFlow, gNMI stream, or syslog event arrives
02
Enrich
SSOT lookup adds topology context and device history
03
Triage
Triage agent classifies severity, root-cause hypothesis
04
Simulate
Proposed fix is validated in the digital twin sandbox
05
Act or Escalate
Auto-remediate if confidence ≥ threshold, else hand off
Alert fired Context fetch (SSOT) Triage Agent Twin Sandbox
Confidence ≥ 0.85? → yes → Auto-remediate + log
Confidence < 0.85? → no → Human review packet Ticket + recommendations

Vulnerability context meets live topology

Traditional CVE scanners dump a list of scores. Astrix goes further: the CVE agent cross-references each finding against the live SSOT to answer "which devices on my network are actually exposed, what's the patch path, and what's the blast radius of patching vs. not patching?"

The pipeline ingests NVD feeds, vendor advisories, and exploit-db entries into an enriched vector store. At query time, a RAG chain retrieves relevant vulnerability records, maps them to live device firmware versions in the SSOT, and ranks them by exploitability weighted by network exposure.

CVE Pipeline stages

  • NVD + vendor advisory ingestion (daily sync)
  • Embedding + vector store indexing
  • Device firmware × CVE matrix generation
  • Exposure scoring via topology graph
  • Patch path resolution with change simulation
  • Operator-grade remediation report

Outputs for the operator

  • Ranked list: exposed devices × CVE severity
  • Blast radius of patching each device cluster
  • Recommended maintenance window timing
  • Pre-staged rollback config in twin vault
  • Auto-drafted change ticket with evidence
  • Compliance attestation export (PDF/JSON)

AI-assisted support for operations teams

Astrix ships an embedded support system for operations and customer success teams. When a ticket arrives, an agent retrieves context from the SSOT and digital twin, drafts a response grounded in live network state, and routes the ticket based on device ownership and severity.

01
Ticket in
Case arrives from helpdesk, API, or email
02
RAG Retrieve
Docs, ticket history, SSOT state fetched
03
Draft
Agent writes response with citations
04
Score
Confidence + faithfulness check
05
Route
Auto-send or human review queue

The key design challenge was retrieval quality at scale. With thousands of tickets, docs, and config snippets, a naive dense retrieval collapses under ambiguity. The solution was a hybrid retrieval stack (BM25 + dense vectors) with a cross-encoder reranker and a hard citation requirement — every agent response must ground every claim to a retrieved passage or SSOT fact.


Measuring what actually matters

Every agent capability in Astrix has an eval harness. Evals run on golden datasets built from real operator cases (anonymized), and gate every deploy. A regression on answer faithfulness or citation recall blocks the release.

94%
Answer Faithfulness
91%
Citation Recall
96%
Triage Accuracy
88%
CVE Match Rate
2.1s
P95 Agent Latency
~80%
Ticket Auto-resolve
Hallucination rate (< 2% target) 1.4%
Human review escalation rate 21%
Twin drift detection coverage 99.1%

What I built and owned

  1. 01 Designed the SSOT schema — graph topology layer, time-series sidecar, event journal, and versioned config vault — and built the reconciliation loop against live SNMP/gNMI collectors.
  2. 02 Architected the digital twin simulation engine: device state machine, link-failure simulator, impact predictor, and sandboxed change preview environment.
  3. 03 Built the agent tool library (8 tools, typed schemas, dry-run modes) and the multi-step agentic NetOps pipeline with confidence-gated auto-remediation.
  4. 04 Implemented the CVE remediation pipeline: NVD ingestion, vector store indexing, firmware × CVE matrix, topology-weighted exposure scoring, and patch path simulation.
  5. 05 Designed the hybrid RAG stack (BM25 + dense vectors + cross-encoder reranker) for the agentic support layer with hard citation requirements and faithfulness evals.
  6. 06 Built the eval harness: golden datasets from 50+ real operator cases, automated faithfulness scoring, citation recall measurement, and regression gates on every deploy.
  7. 07 Instrumented the full stack: token cost tracking, agent latency histograms, resolution rate dashboards, and escalation funnel analytics for continuous improvement.
  8. 08 Conducted 50+ stakeholder interviews with NOC engineers, security leads, and product managers to shape the product requirements and prioritize the roadmap.