NOC Copilot

NOC-Copilot

An AI agent that ingests Prometheus/Alertmanager alerts and drafts a plain-language root-cause narrative for human review — not autonomous remediation.

Built end-to-end with [Claude Code](https://claude.com/claude-code), this project explores a specific question: **where does an AI agent genuinely help a NOC/SOC operator, versus where does it just add noise?** The answer this repo argues for is narrow and deliberate — draft, don't act; narrate, don't decide.

Status

🚧 **Early build.** Repo scaffolded, MVP scope defined, first real data source (Prometheus/Alertmanager) being wired in. Not yet handling live production traffic. See [Roadmap](#roadmap) below for what's shipped vs. planned.

Why this exists

Most "AI agent" portfolio projects are generic chatbot wrappers — a UI in front of an LLM call, disconnected from any real operational context. That's not scarce anymore, and it doesn't demonstrate much.

What *is* scarce is an agent solving a real problem in a domain the builder actually has standing in. This project sits at the intersection of two things I have hands-on depth in:

• Network/infrastructure operations — CCIE-level networking, enterprise WAN/BGP/DDI experience, hands-on multicast (PIM-SM/IGMP) lab work
• Security engineering — offensive and defensive security background, volunteer SIEM/detection-engineering work for a nonprofit SOC (CyberStorm)

NOC-Copilot is deliberately framed as *"a network/security engineer who uses AI,"* not *"an AI engineer who knows a bit of networking."* The agent is the interesting part, but the domain judgment underneath it is the actual differentiator.

What it does (MVP)

The current scope is intentionally narrow:

Prometheus alert fires
        │
        ▼
Alertmanager webhook → FastAPI ingestion endpoint
        │
        ▼
Agent assembles context (metric, threshold, recent rate() history)
        │
        ▼
Claude API drafts a plain-language root-cause hypothesis
        │