Telecom AI agent · NOC incident
NOC Incident & Root-Cause Copilot AI Agent
Correlate alarms and telemetry into one incident, rank the hypotheses that could explain it with the evidence behind each, and leave the declaration of cause to the named duty engineer.
- Typical delivery
- 4–6 weeks
- Deployment
- Your stack
- Engineer sign-off
- Hypothesis-only
- After launch
- Agent Care
What this agent does
Assembles the case, not the conclusion
In
- 01
Ingesting alarms, counters, topology and change records from supported assurance or ticketing sources.
- 02
Normalising element names, timestamps and severities, and carrying each signal forward with its source.
Reason
- 03
Grouping related alarms into one incident, and stating what the grouping is based on.
- 04
Applying the correlation, topology and maintenance-window rules configured for the network.
- 05
Assembling the evidence pack behind each hypothesis — topology, dependency and timing.
Decide
- 06
Ranking hypotheses with what would falsify each one, rather than naming a single cause.
- 07
Surfacing the reportability question, planned maintenance included, to the duty engineer.
Out
- 08
Retaining the correlation, the signals it set aside, the evidence and the engineer's decision.
- 09
Executing write actions only inside the approval boundaries agreed during implementation.
Product statement
The notification clock runs from discovery, not from diagnosis; the copilot proposes and a duty engineer decides.
Example workflow
One incident, alarm to declaration
- 1Alarm burst receivedFault management, performance telemetry, change record or trouble ticket
- 2Evidence assembledTopology, dependency, timing and recent changes, each with its named source
- 3Hypotheses rankedCauses, evidence, falsifiers and confidence
- 4Controls appliedGrouping limits, 911 and 988 path exclusions, maintenance-window checks and confidence threshold
No human action required
Stages 1 to 4 run unaided, and nothing is declared or closed at any of them — the copilot is assembling, and the engineer's lane opens at the confidence gate.
Goes to the duty engineer to accept.
Adds a senior NOC read first.
Engineer review
The incident is held with its evidence, its ranked hypotheses and the confidence.
Accept · Revise · Send to senior review
Accepted — cause declared
- 6Incident record updatedOnly where write access and approval policy allow it
- 7Outcome evaluatedRank at acceptance, revisions, set-aside-signal outcomes and post-incident corrections
Revisions
Every engineer revision is counted.
What should not run autonomously
Human approval stays in control
Outside the boundary — human approval required
8 items
- Declaring the root cause of an incident as a finding.
- Closing an incident or declaring service restored.
- Deciding whether an outage or event is reportable.
- Notifying a PSAP, the FCC or any other regulator.
Automation boundary
Agent acts unaided
- ✓Correlate alarms and telemetry into a single incident view.
- ✓Assemble the evidence pack behind each candidate hypothesis.
- ✓Rank the hypotheses, and state what would falsify each one.
- ✓Surface the reportability question and its clock to an engineer.
Writes stay inside the agreed boundaries and never reach a network element — that belongs to remediation.
- Changing any network element or its configuration.
- Suppressing any signal on a 911 or 988 call path.
- Writing the best-known cause into a notification.
- Changes to correlation, suppression or escalation rules.
Example output
One incident, annotated
Everything the copilot proposes is attached to the signals it was drawn from.
Root-cause output · single incident
Illustrative example- Incident
- Regional transport
- Leading hypothesis
- Protection switch on a shared fibre span, not the access nodes that alarmed
- Alarm group
- One transport ring
- Evidence class
- Topology and timing
- Confidence
- 71%
- Escalation
- Duty engineer, clock shown
As received
Taken from fault management and the change record — nothing on this side is inferred by the copilot.
Evidence used
- Topology dependency
- Change record
- Timing sequence
Why this hypothesis
The loudest element is the most instrumented one, not the cause.
What the score decides
Below the configured threshold the incident picks up a senior read before.
Action
AcceptReviseSend to senior reviewValue
Where AI adds value
The same four claims, placed at the point in the workflow where each one applies.
Where the value lands
Value 01 – 04
Every incident
From the alarm stream
Correlate and evidence
Draw on topology, dependency, timing and the change record for the domains in scope.
A cause is a hypothesis
Related alarms arrive already grouped, with the basis of the grouping stated.
Send the read to the ranked few
Ranked hypotheses and their falsifiers are marked, and nothing that would delay a statutory notification is held back for tidiness.
Build an evidence trail
The correlation, the evidence it rests on and the engineer who accepted it stay on the incident.
Integrations
Typical integrations
Five system groups connect to the same agent. Which of them are in scope is decided in discovery.
Fault and alarm management
- IBM Netcool
- Nokia NSP
- Ericsson OSS
- Huawei U2000
Performance and telemetry
- Prometheus
- Kafka streams
- Splunk
- Elastic
- gNMI
Topology and inventory
- NetCracker
- Amdocs
- Blue Planet
- Cisco Crosswork
Agent
NOC incident & root-cause
- Reads the signals
- Ranks the hypotheses
- Holds for the engineer
Incident and change
- ServiceNow
- Jira
- PagerDuty
- change records
Observability & evaluation
- OpenTelemetry
- Langfuse
- Supported monitoring/evaluation sources
Integration availability depends on the client's existing systems and API access.
Agent controls
Six layers between the model and the incident
The layers sit one inside the next. What none of them catches is in the map below.
L6 · Outermost — last line of defence
Inward → L1 · closest to the model
- L1 – L2
- Test whether a hypothesis may stand
- L3
- Puts the declaration in an engineer's hands
- L4 – L5
- Hold the evidence the hypothesis rests on
- L6
- Falls back to alarm listing when signals degrade
How Nestack evaluates it
Evaluate the whole triage path — not only the cause that was accepted.
Coverage runs the whole depth of the workflow, and every layer is cut by slice.
Surface — the cause the incident record carries
- E1Final-output evaluationDid the accepted cause survive the post-incident review?
- E2Step-level evaluationDid the copilot use the right topology, change record and correlation rules?
- E3Tool evaluationDid it read the correct domain and write the correct incident?
- E4Confidence calibrationDo low-confidence rankings actually attract more engineer revisions?
- E5Slice evaluationHow does performance change across specific incident classes?
- E6Business outcomeHow many incidents needed a revision or a correction after closure?
Floor — the outcome the carrier answers for
Failure modes
Where each failure originates in the agent
Seven failure modes, placed at the stage each one originates.
Agent lifecycle
Direction of processing →
01 · Retrieval
1 mode
- GK-03
Stale topology view
Dependency read from a superseded topology record.
Stage gathers
Alarms, telemetry, topology , with the source each came from
02 · Reasoning
2 modes
- GK-04
Correlation read as causation
The most instrumented element is ranked as the cause.
- GK-06
Cascade masks the trigger
A loud downstream storm outranks the quiet change behind it.
Stage proposes
Candidate causes, evidence, falsifiers and confidence
03 · Tool / write
2 modes
- GK-02
Grouping on a 911 path
A signal touching an emergency path is grouped away.
- GK-05
Reportability left unraised
The clock runs while no one is asked the question.
Stage writes
Only where write access and approval policy allow it
04 · Output
1 mode
- GK-01
Cause stated as finding
A ranked hypothesis is recorded as a settled cause.
Stage returns
The cause the engineer accepts and the record carries
05 · Change / Version
1 mode
- GK-07
Silent correlation regression
A model or rule change widens what the copilot will assert.
Stage tracks
Model, prompt, correlation rules and topology config
- Sev-1 · acts outside the boundary
- Sev-2 · a wrong cause reaches the record
- Sev-3 · signal degrades, incident routes to review
Affected slices
Overall quality can hide one bad class
Do not read the revision rate whole — break it out by incident class. No audited production figure exists for automated root-cause analysis in live networks, so Nestack reports what your engineers revise, by slice.
Slice performance — reported separately, not only in aggregate
Illustrative example| Slice | Failure rate | Lift | Lift vs. threshold | Status |
|---|---|---|---|---|
| Alarm-storm incidents | 9.9% | 3.9× | Review | |
| Shared-infrastructure faults | 6.9% | 2.7× | Review | |
| Post-change incidents | 4.6% | 1.8× | Watch | |
| Single-element faults | 1.5% | 0.6× | Normal |
Bar: engineer-revision-rate lift vs. single-element baseline · scale 0–4.0× · tick marks the 2.0× review threshold
2 of 4 slices over threshold
Evidence-linked improvement
A post-mortem is not the end of the loop
The cycle ends in a regression case, not in a meeting about what happened. That suite is what the next incident into the NOC is measured against.
Improvement cycle · five stages
Switchback — the path turns at Improve and returns at Learn
- 01
Detect
Engineer-revision rate rises in an incident class.
- 02
Diagnose
The evidence pack behind each disputed hypothesis is pulled and read until the miss narrows to one.
- 03
Improve
Every change is versioned against the incidents that exposed it.
- 04
Verify
A failing case holds the release back.
- 05
Learn
The case joins the suite for good, and the correlation rules are revisited.
Learn → Detect
The return edge. The next detection runs against a suite one case longer.
Typical build scope
Twelve workstreams across six weeks
The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, triage workflow, evaluation, integration, then production validation and handover.
Workstream
Week 1Week 2Week 3Week 4Week 5Week 6
- 01NOC workflow discovery and automation-boundary definition.Week 1
- 02Assurance and telemetry source assessment.Week 1, Week 2
- 03Topology, dependency and correlation-rule mapping.Week 1, Week 2
- 04Alarm ingestion and normalisation.Week 2
- 05Correlation and hypothesis ranking.Week 2, Week 3
- 06Confidence scoring and escalation routing.Week 3
- 07Duty-engineer review workflow.Week 3, Week 4
- 08Assurance and ticketing integration.Week 5
- 09Causal-claim regression cases.Week 4, Week 5
- 10Guardrails and escalation controls.Week 4
- 11Incident-trail instrumentation.Week 5, Week 6
- 12Deployment, documentation and Agent Care handover.Week 6
12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallel
Final scope and sequence confirmed in discovery
Engagement tiers
What each tier includes
Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.
| Capability✓ in scope · — not at this tier | PilotOne domain, one NOC | ProductionProduction assurance stack | AdvancedMultiple domains / regions |
|---|---|---|---|
| Introduced at Pilot | |||
| Correlation to your topology | ✓ | ✓ | ✓ |
| Engineer sign-off | ✓ | ✓ | ✓ |
| Hypothesis-quality baseline | ✓ | ✓ | ✓ |
| Introduced at Production | |||
| Reporting by incident class | — | ✓ | ✓ |
| Review workflow in your systems | — | ✓ | ✓ |
| Approved incident write-back | — | ✓ | ✓ |
| Assurance-stack integration | — | ✓ | ✓ |
| Introduced at Advanced | |||
| Multi-vendor correlation rules | — | — | ✓ |
| Multi-stage NOC escalation | — | — | ✓ |
| High alarm volume | — | — | ✓ |
| Multi-domain incident controls | — | — | ✓ |
| Build price | From $5,000 | From $8,000 | Custom quote |
- Final build price
- Confirmed after discovery based on integrations, workflow complexity, transaction volume, approval controls and deployment requirements.
- Separate from build
- Build pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.
What we need from you
What you bring, and what we build with it
Each input maps to a piece of build scope and a week in the delivery timeline.
You bring
We build with it
01Your alarm sources and topology model
→Alarm ingestion and topology mapping
Week 102Representative past incidents
→Correlation baseline and hypothesis ranking
Week 203Your correlation and suppression rules
→Correlation-rule mapping and automation-boundary definition
Week 104Access to relevant APIs, feeds or exports
→Assurance and telemetry assessment, then integration setup
Week 205Causes you would not want acted on
→Causal cases and the evaluation suite
Week 406What must reach an engineer before anything is touched
→Confidence scoring, escalation routing, guardrails and review controls
Week 307Named duty engineers to review incidents
→Duty-engineer review workflow, then pilot and production validation
Weeks 5–6
Nothing else is required
Deployment, documentation and Agent Care handover are ours.
Delivery timeline
Four phases across six weeks
The bands follow the real work, which is why evaluation and pilot share the fifth week.
Phase
W1
W2
W3
W4
W5
W6
- DiscoveryW1
- BuildW2 – W3
- EvaluateW4 – W5
- Pilot & LaunchW5 – W6
Week focus
W1NOC workflow discovery, rule mapping and the automation boundary
W2Assurance integration and the correlation baseline
W3Triage workflow, confidence logic and escalation controls
W4Evaluation suite, exclusion checks and failure-mode testing
W5Ticketing integration, pilot incidents and targeted corrections
W6One incident cycle triaged under the NOC, then handover
- Reading the band
- A bar covers the weeks its work is named in, and nothing else. The week 5 overlap is real, not padding.
- At the end of W6
- The cycle closes validation and Agent Care assumes monitoring.
- Duration
- Six-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.
Next step · Telecom AI agent
Build a NOC copilot around the engineers who declare cause.
Show us your alarm sources, your topology and who declares cause. Being wrong costs twice: the fault stays live and the clock keeps running.
- Typical delivery
- 4–6 weeks
- Deployment
- Your assurance stack
- Engineer sign-off
- Hypothesis-only
- After launch
- Agent Care available
Nestack Agents · NOC incident & root-cause
AGT-TL-08 · Agent Care available after launch