Anomaly Detector

// Why not just use ChatGPT or Gemini directly

This tool is not a chatbot wrapper.

Any engineer can paste a log into ChatGPT or Gemini and get analysis. So what is the point of this tool? The answer is automation, integration, and consistency. This tool is built to run as part of a production NOC pipeline, not as a copy-paste chat session.

// Option A

Paste logs into ChatGPT/Gemini

Engineer must notice the problem first
Manual copy-paste every time
Different prompt each time, inconsistent output
No automation, no scheduled checks
Free-form text response, not structured data
Cannot integrate with tickets, Slack, alerts
Logs leave your environment in unpredictable ways
Context lost between conversations
No audit trail of what was analyzed when

// Option B
NetworkForAI Anomaly DetectorAutomated workflows run 24/7 without human input
Scheduled checks catch issues before outages happen
Consistent structured JSON output every time
Integrates into NOC pipelines via REST API
Specialized fields for environment, network type, focus
Direct integration with Slack, email, ticketing, PagerDuty
Alerts routed to right engineer based on severity
Full audit trail of every analysis with timestamps
Scales to thousands of logs per day automatically

// Production deployment

Integrate with n8n for autonomous NOC monitoring

Deploy the anomaly detector as part of an n8n workflow that runs continuously in the background. The agent pulls live data from your devices, syslog servers, or BGP feeds on a schedule, sends it through this analyzer, and alerts the right engineer the moment an anomaly is detected. Catch and troubleshoot issues before they become customer-impacting outages.

[ Schedule Trigger ] → every 5 minutes ↓ [ Pull live logs ] syslog, BGP updates, interface stats, CPU, memory ↓ [ NetworkForAI API ] POST /analyze with structured context ↓ [ Severity gate ] critical > 0 ? ↓ [ Route alert ] Slack, email, PagerDuty, ticket ↓ [ Log to audit ] timestamp, severity, action taken

Build multiple specialized workflows

Run parallel agents, each tuned to detect a specific category of anomaly. This mirrors how hyperscale NOCs structure their automated detection pipelines.

🔌

BGP & Routing Agent

Pulls BGP updates from RIPEstat and local devices. Detects route leaks, hijacks, unexpected AS path changes, prefix withdrawals.

🛡

Security Agent

Monitors firewall logs, IDS alerts, auth failures. Detects DDoS patterns, brute force attempts, lateral movement, exfiltration.

📡

Interface Health Agent

Watches interface counters, CRC errors, utilization, uptime. Flags degrading hardware before it fails completely.

🌐

Outage Detection Agent

Polls Cloudflare Radar and public outage feeds. Alerts on ISP outages, submarine cable cuts, government network shutdowns affecting your traffic.

📊

Capacity Agent

Analyzes traffic trends and port utilization over time. Predicts capacity exhaustion before it happens. Feeds into replacement planning.

🔨

Config Drift Agent

Compares running configs against intended state in NetBox. Detects unauthorized or undocumented changes across the fleet.

// Measurable impact

What this means for your NOC

24/7 Continuous monitoring without human attention

<5m Detection-to-alert latency on critical events

100% Consistent analysis format across all teams

0 Manual copy-paste required from engineers

Analysis results