lanc3lee

NOC Copilot — AI skill for Claude Code

AI community

NOC-Copilot: an AI agent that ingests Prometheus/Alertmanager alerts and drafts a plain-language root-cause narrative for human review — not autonomous remediation.

How to install NOC Copilot

This entry records only its repository, not the path inside it, so there is no exact command to give. Open lanc3lee/NOC-copilot and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What NOC Copilot does

NOC-Copilot: an AI agent that ingests Prometheus/Alertmanager alerts and drafts a plain-language root-cause narrative for human review — not autonomous remediation. Built with Claude Code, exploring how AI assists (not replaces) NOC/SOC operators in exchange and trading infrastructure environments.

Alternatives in AI

AIHawk — Open-source AI browser agent: describe any task in plain language and it autonomously browses, clicks, types a 30.3k ★
Engineering Notebook — A Bun CLI that ingests Claude Code and Codex session transcripts, generates LLM-powered daily summaries, and s 320 ★
NotebookLM Research Agent — A fully autonomous AI research agent that ingests sources into Google NotebookLM, runs deep web research, synt 168 ★

README

NOC-Copilot

An AI agent that ingests Prometheus/Alertmanager alerts and drafts a plain-language root-cause narrative for human review — not autonomous remediation.

Built end-to-end with [Claude Code](https://claude.com/claude-code), this project explores a specific question: **where does an AI agent genuinely help a NOC/SOC operator, versus where does it just add noise?** The answer this repo argues for is narrow and deliberate — draft, don't act; narrate, don't decide.

Status

🚧 **Early build.** Repo scaffolded, MVP scope defined, first real data source (Prometheus/Alertmanager) being wired in. Not yet handling live production traffic. See [Roadmap](#roadmap) below for what's shipped vs. planned.

Why this exists

Most "AI agent" portfolio projects are generic chatbot wrappers — a UI in front of an LLM call, disconnected from any real operational context. That's not scarce anymore, and it doesn't demonstrate much.

What *is* scarce is an agent solving a real problem in a domain the builder actually has standing in. This project sits at the intersection of two things I have hands-on depth in:

Network/infrastructure operations — CCIE-level networking, enterprise WAN/BGP/DDI experience, hands-on multicast (PIM-SM/IGMP) lab work
Security engineering — offensive and defensive security background, volunteer SIEM/detection-engineering work for a nonprofit SOC (CyberStorm)

NOC-Copilot is deliberately framed as *"a network/security engineer who uses AI,"* not *"an AI engineer who knows a bit of networking."* The agent is the interesting part, but the domain judgment underneath it is the actual differentiator.

What it does (MVP)

The current scope is intentionally narrow:

Prometheus alert fires
        │
        ▼
Alertmanager webhook → FastAPI ingestion endpoint
        │
        ▼
Agent assembles context (metric, threshold, recent rate() history)
        │
        ▼
Claude API drafts a plain-language root-cause hypothesis
        │