Optimizing Networking Performance with HPE OpsRamp

So, hello again. Uh, my name is Juden Sapo. I'm a solutions architect with Ops Ramp.

And what we will be demoing today is, um, optimizing networking performance using the HPE ops RAMP software. This is a dashboard. Now we're looking again at a dashboard, which is looking at the health of this, uh, mission critical ERP application, but we're looking at it now from not, um, you know, a server database perspective, but from a network observability perspective.

So we can see here the ERP network, again, it's green, it's up, it's up and running. Um, and if I drill into this service map, this service map, again, outlines all the infrastructure, which is supporting this mission critical ERP application. And we, again, we have our databases and we have our network devices here, and we further broken it down by, um, routers, uh, different network types.

So we can see here, uh, everything is green. This is the happy state. Okay?

So what we're gonna do as part of this demo is I'm gonna introduce, I'm gonna, I'm gonna, I'm gonna run a script which will cause excessive traffic on a server, and we're gonna see how we can identify that that could be a potential issue, right? It's gonna, it's gonna light up. Um, some of these switch, we're monitoring switch interfaces and we're, or, um, the, the, the switch interface status in status out, you can see everything is okay right now.

Uh, here's the utilization of the switch, okay? Um, and then we are also, um, getting the utilization. How much, uh, we're, we're monitoring a particular VM on a VM.

Here you can see the utilization is very low. Okay? You see some spikes here because when I ran this demo before, it, it, um, my, my demo is causing excessive, uh, reads and writes, which is why this utilization is up.

So right now, everything is in the good state. We're monitoring, um, network devices and interfaces. And so now I'm going to go in and cause a network issue here.

I can just simply toggle this, okay? And what this is doing, it's a script that's causing packet generation, okay? I'm gonna simulate an issue where we have, let's say, excessive flooding on the network.

Maybe a denial of a service denial service attack is, is, is starting, okay? Um, as I mentioned before, we're monitoring every one minute. So I have to wait at least one minute before the, uh, monitoring sees those changes in the network.

But while we, uh, while we wait for that, I'll just kind of show you, um, some of these dashboards. You can see that we currently have no alerts, there's no task associated. Um, and here, uh, we can actually back up the network configuration of network devices.

So a network device has a running config and a startup config, we can actually back those up. And in our demo here, we're actually gonna go in and change that config to block the traffic that this VM is generating, right? Kind of show you that we can detect an issue and we could kind of run automation to try to, to try to resolve the issue.

Okay? Let me do, let's, let's see if I hit refresh. Now, if we see any alerts pop up, okay, there's already one alert.

You see that? And now it looks like our ERP application is unavailable. Now, you can see under our network switch interface here, there is a big spike in traffic here, and it looks like it's on interface GI four.

This one right here, it's actually a warning, it's just coming in. But if I do another refresh real quick, these dashboards typically refresh every five minutes. I don't wanna wait five minutes, so that's why I'm doing a manual refresh.

And you can see now there are two alerts. I'm gonna go ahead and click on that alert. And this is what's, this is what it's saying here.

The, there's a critical resource here, this server, it's a, it's a hyper V vm, and it, it's telling me that, let me drill into it. Lemme drill into it like this. This is saying this, this, this resource, there's a critical value on the, the megabytes that we're ingesting here.

It's greater than our threshold. And we can kind of see, um, in our alert history here, you see that, that spike right there. Okay?

Again, when this, when we detected this alert, an email was again, sent to me. And again, there was a task request that was sent. Now, what is this?

What is this saying? Let me drill into this. I, this task request was created.

1 50, point 43 on Port GI four, we have identified a hive high volume of ingress originating from that ip. And it's saying here, um, you may, there may be a potential here for a flood attack, okay? Now, in order for me to kind of, um, maybe get more insights into what's going on, we are ingesting net flow data, right?

So not only are we monitoring these network devices for those time series metrics, but I can click here to show the net flow data. And based on the net flow data, we're gonna see that excessive traffic from that device. You see this here, that IP one 50 point 43, it's talking to SA demo ERP, and you see that spike right here.

So it looks like that's, that's, you know, out of the ordinary. So here we're combining the, you know, not just metric data, but NetFlow data as well, so you can get more insights into what's going on in your infrastructure. Okay?

Now, again, there was, in, in this email, it's telling me that, but it's also, I can click here, I can try to solve this issue because again, we have a process automation that could potentially resolve these types of issues. So I'm gonna click on that URL, and it's giving me all that information. Again, ingress traffic from that IP on port four.

So I'm gonna go ahead and say, yeah, I'm gonna approve this. Go ahead and try to address this issue. It's safe.

And then you're gonna see some pretty interesting things happen here. This automation, um, let me show you what this automated process does. It's a more complex process automation.

It, it can kind of demonstrate our capabilities here. This is the process automation that we are running. So when we detected this network issue, what did we do?

We ran a script to get the top talkers, because we're running, because we have net flow data. We're running a, uh, PowerShell script here to grab the top talkers who is causing all that traffic. After we parse that top, top talkers, we know the IP address of that top, top talker.

So we're actually calling, um, this task, we're, again, we're creating a task, and if I approve it, which I did, we're gonna run another script, which is gonna go into the switch and block that IP address on the switch, right? That top talker, we're gonna block its ip. And then after we've, um, updated it, we're gonna do a network backup, um, because we made a change and now we wanna back it up.

And so if I check here now, Can I, can I ask you something quick? Yeah. Um, because you said that, um, it's have a AI powered analytics.

Mm-hmm. So that, that AI powered analytics was more in that first use case where we had those six alerts and one inference. And in this example, it didn't do a correlate.

Okay? Okay. Yeah.

It doesn't, yeah. Do the correlate. Uh, yeah.

And, and so, um, and, and again, it's, it's still the machine learning. Sometimes it'll find, uh, a correlation, sometimes it doesn't. Mm-hmm.

Okay. But yeah, in, in this, in this particular use case, uh, a correlation, an inference was not, was not made, right? Okay?

And so I hit refresh here, I just have to give it a little bit more time. But notice now one of the alerts went away, and if I wait a little bit longer, this other alert will go away. But notice now there's a change.

What, what this change is telling me is that the automation logged into this switch and made a configuration change. That's why we get this running configuration, uh, alert. So now I know that there's been a configuration change on made on this device.

I can go into that device and I can, I can actually look at what were the configuration changes that were made. So let me do that. This is the switch that we logged into.

I'm gonna drill into it, okay? Now, this is the switch. I'm gonna go under related information, and I'm gonna look under configuration backup.

And so what time is it right now? It is 1139 local time. So you noticed about four 11, I'm sorry, it's 1133.

So at 11 29, 4 minutes ago, a backup change, a backup was, uh, was created. If I diff this one from the previous one, I can see what the, what was the changes in the configuration. Notice here, the, the, the latest one is here, it added this line.

0 1 50 43. So in order to stop that VM from, you know, flooding the network, we stopped, we blocked that IP address of that VM automatically by logging into the switch and adding it to the, the ACL to block that IP address. Does that make sense, guys?

Now again, if I hit update, that other alert should got have gone away by now. Takes a little bit more time. Alright, any questions or comments on that?

This is, again, we're, we're, um, observing things on the network, pulling, pulling in all these metrics also, you know, um, SSHing into the switch and changing some configurations around. That's what you can do on the ops ramp platform. I have kind of just a broad question, not really on, um, the demo, but, um, I don't just kind of looking towards future roadmap, where does this go from here?

Can you build, uh, you know, more AI into it to further automate things like that? Yeah. Is that where this is going?

Yeah. So, um, there's always new devices up there, different device types, new new, uh, networking devices, new servers. Um, right.

So we're, our, our integrations change like weekly, right? Um, like especially for the, the public cloud services, AWS Azure, GCP, every week it seems like there's a new cloud service. So, you know, we're, we're leveraging APIs to get that from the public cloud.

So we have to make updates to use those APIs. But, um, we're always trying to find, um, ways where we can use machine learning to, you know, assist people, right? So right now we're using machine learning to do that alert correlation, right?

Um, and so, um, we're using it there. We're, we're also doing, um, using more ai when we analyze the metrics, we can also, uh, for example, you know, how you can alert on a threshold? Like if the CPU goes above 80%, make it a warning above 90, that's, uh, critical.

Um, we can also do what's called change detection. We can get a baseline of what the metric is at, let's say it averages like 50%, but then if I see it spike to like 90%, I mean, or, or not even 90, let's say it spikes to 70%, it went from 50 to 70. I can potentially alert on that because it's kind of a sudden change, right?

So there, I don't set a static threshold. I can just set a sensitivity. How sensitive do you want to alert if there's a change in the metric, either the positive direction or negative direction, or both?

So we're, we are, we're applying machine learning at that level. Um, what we're also trying to apply AI at is at, um, when we're creating these dashboards, right now, when we create these dashboards, um, let me, let me bring up another environment here. Okay?

I can probably, let me demo this right here. Um, let me show you an example of where we're gonna use, um, more AI copilot demo. Okay?

Let, let me, let me show you this real quick. Um, so when, when we create a dashboard, um, we're leveraging what's called, um, uh, Prometheus Query Language. Are you guys familiar with Prompt, prompt, QL Pro or Prometheus platform?

The Prometheus is an open source monitoring platform that the industry has kind of embraced. So they have a query language that you can use when you generate, um, a dashboard. So let me show you real quickly a dash, uh, one of our dashboards here, it's the VMware one.

Okay? So when you want to create a dashboard, we're leveraging what's called the Prometheus query language. So here I wanna, uh, it's, I'm drawing the, uh, VMware CPU usage average, right?

I just type in what the metric name is, but using the Prometheus query language, I can say, what if I want to get the average of that metric? So the, the prom QL language allows me to put average and then, uh, put in the metric name. Now it's showing me the average of this metric, okay?

But I have to kind of know how to use Prometheus query language in order to do this. So what we're doing in our dashboard is that, um, we're, we're gonna have it so that, uh, you can just use, um, uh, a common language. Let's say, uh, let me show you a good one here.

Um, like you can say, show me alert statistics. I want to create a dashboard which, uh, you know, shows me alert statistics. Rather than having to come up with the Prometheus query language, I can just type here in natural text, natural language, show me alert stats, and there, it generates that dashboard for me, right?

So now I don't have to, I don't have to know how, you know, how to construct a dashboard using that query language. I can say, show me incidents by priority. I, I have no idea how to do that in, in the, using the prom ql.

So I'm just gonna use our, our ai, uh, this is called, uh, co-pilot, our AI dashboard co-pilot. I'm just gonna type in, show me incidents by priority and it, and it draws the appropriate, uh, dashboard for that, right? So that's one way.

So now I don't have to, I can just use natural language to visualize any dashboard that I want, I want develop. That's, uh, that's one, that's one enhancement that we're making. Um, and what else?

Um, we're having better support for containerized, um, environments. Um, a lot of people are using now containers and microservices, so we're expanding our capability there. Um, we've a, we've added an integration to, um, monitor Nvidia GPUs because a, people are running more AI workloads, but we wanna monitor, uh, those GPUs and making sure that, you know, they're, they're properly utilized and not underutilized, right?

Because those, those GPUs are very, very expensive. So we can monitor those GPUs now as well. So, new integrations are coming out every week, um, and, and every three months, every quarter we make an update to the ops ramp platform.

Like we add new features like, uh, the, the, this copilot dashboard and things like that. So If you're using machine learning to correlate these different things, and you have new integrations coming out, you know, consistently mm-hmm. How often are you retraining, uh, these machine learning models?

Is it every time there's new integration, or is it more quarterly, like you were saying with, uh, the Machine learning, um, is, is continuous. So, um, when we wanna enable, uh, machine learning, um, we have what's called, um, it's po. We have to create a policy.

So here I'm gonna create what's called an alert correlation policy. And so, um, now we have it policy based, because you can, you can tell, um, we have it policy based because you could potentially create a filter. Maybe there's some alerts that you don't want correlated, right?

Maybe you have like, um, a, um, a, an alert, which is very noisy, that gets, gets correlated everywhere. Maybe I wanna filter out that particular alert. You can do that.

I can filter things in or I can filter things out. That's why we have a policy. So that way now, um, there's, there's not gonna be a lot of noise alert noise in there, right?

So now we can do better correlations. Um, but these, these, um, this alert correlation policy, you see this continuous learning, it's always learning. It's always running now.

Um, so that's the advantage of having this continuous learning because a, as you add new infrastructure, as you add new applications, you're gonna get new alerts, right? But the machine learning will, will see these new alerts, will see this new infrastructure, and it'll, it'll use that as part of its learning. Right Now you do have the option to turn off the continuous learning.

Maybe you are doing some debugging in your infrastructure, you're changing things around, and I don't want those changes to affect the, what I've learned so far. I could disable this continuous learning for now, right? And then after I've made those changes, I can turn it back on because I don't wanna, you know, clutter what I've learned with, you know, with, with, uh, debug information or, or, or, you know, maybe you were the, the lab was, you know, your infrastructure was down or something like that, right?

Or going through some maintenance. Alright, so, so the ops ramp platform, kind of to summarize, um, it's, it's, it's the platform that HPE is using to monitor, you know, anything that, that HPE is offering. When we sell hardware, we include, um, ops ramp as far as like, uh, FlexCare, um, complete care.

Um, it's embedded with a lot of our offerings, but you can also, um, purchase the ops ramp platform as a standalone SaaS platform. But it, it is now being embedded with a lot of our, um, um, other, uh, bundles. Like if you get GreenLake ops ramp can be, is bundled with GreenLake as well.

Quick question. Yes. Um, all here, I may have missed it, but, uh, with the AI component and the learning that it does mm-hmm.

Will it like dynamically like, try to create alarms or suggest alarms that maybe you wanna create or something like that? Oh, great question. So it's not going to, it doesn't create new alarms, but it, it's looking at these, it's looking at alerts that have been generated, and we're gonna, we're gonna try to just group those alerts together, right?

Maybe those alerts are related because, you know, one alert caused these other ones mm-hmm. But we're not gonna, we're not gonna, um, the, the machine learning itself is not gonna create new alarms. No.

Okay. It'll just group these alerts together. And then, um, in terms of like an alarm getting triggered or anything like that, is there any kind of like anomaly detection type thing going on?

Oh, Great question. Um, this is, this is the anomaly detection here. It's called sudden change in behavior.

So in this example, this could be, um, like a CP utilization right here, right? 5, right? 5.

So that's a sudden change in this metric. So we could potentially alert on this sudden change. So the change could be in the positive direction.

The change could be in the negative direction if we saw a dip, or you can, you know, alert on positive or negative change. So this is, this is here, we're actually doing the, um, you know, an analytics at the metric level, right? So we can alert on that.

Now, we can also do what's called, um, alert on forecast time to breach. So in this example here, the metric is the, this gray squiggly line here, right? This is where the metric is at, but notice it's kind of creeping up.

So what we are doing is our algorithm will extrapolate where this metric is going, and then we can put a time to breach. So I can say, I wanna know when this metric hits 80%, right? So let me know in one month when this reaches 80%, let me know in two weeks when that, when that reaches, like 90%, for example.

So that's, um, you know, analytics at the metric level. So, uh, again, we're gonna try to apply more analytics, um, on, on the metric level. So right now we do time to breach and sudden change behavior.

Okay. And then is there any kind of like historical tracking or something like a graph or something you could look at, so that way maybe you need to, you know, go back and adjust your threshold? Yeah.

But, uh, so remember the very beginning I showed you that data retention, all these metrics, we keep one year of data for all the metrics we're collecting. Cool. And is there like a easy, like, quick way to just like, without having to dig into it, where just straight point blank says, Hey, Oh, do that analysis for me?

Yeah. Yeah, that would be awesome. That's, that would be a good, um, RFE, right?

Um, do the analysis. Um, yeah, we, we don't do, they don't have that yet, but that'd be a, that'd be a good RFE, right? Whatever I, um, I am, instead of having a person analyze it manually, um, apply the machine learning, just feed it the graph and say, what do you think about this?

What, what should we do? And maybe it could recommend a threshold. Exactly.

Yeah. Yeah. Because like for me, when I am having my DevOps hat on as an engineer, I, I don't like having to dig through logs and figure that out.

Yeah, yeah. Personally. So it'd be cool if That is a, that is a great, that is a great use case.

They Could just do it for me. That would be nice. Like, right, like right now with like, um, I, I, I use chat GPT, right?

So people are sending me a picture. Somebody sent me a picture of a, of an animal. I just put it in chat.

GPT, I didn't even say anything. I just put the picture in there and it said, oh, that looks like a rat, or whatever. Right?

So, so yeah, something like that where we just throw it a metric and say, tell me about this. Yes. Right?

And that, that story is funny because my parents randomly planted a tree once Yes. To go on a tangent, and they were eating the fruit from the tree. Yeah.

And they were like, oh, I think it's a lemon. Yeah. And I was like, this lemon looks weird, but it turned out to be a Meyer lemon.

Yeah. Yeah. Right.

But you take a picture. Yeah, just like put it in chat. That that would be, that that would be a great use case.

Um, I'm gonna take that from you and take metaphor. That Would help me out. That would make my better.

Yeah. Yeah. So, so yeah.

I mean, that's the kind of changes we we're looking for. Like, we like to get our customers feedback and say, what would you like to see? Right?

How can we be better? And I think that's a good one where I can analyze a, a, um, particular metric and it could make recommendations for me. What, what I wanna see, um, and I've seen this in other platforms, is what's called a trend matcher.

Uh, it's very, it's very CPU intensive. But what it want, what it could do is, let's say I have a graph, uh, of a partic of, of all the resources, right? Let's say I'm graphing CPU, memory disc, um, io everything.

But I wanna know, out of all the metrics I'm gathering, is there a correlation, like for example, typically like, um, on a storage array, um, where you're doing a lot of reads and writes, a lot of times the IO will drop if the host is running excessive, uh, workloads, if there's like a high CPU. So basically there's a, there's a correlation when CPU is too high, the disc IOPS drop. Yes.

So it's a negative correlation, right? Yes. With this goes up, this goes down.

Um, I wanna be able to do that trend match. I wanna know what metrics are, have a positive correlation. Like if, if CPU goes up, memory goes up, I wanna see those correlations, but do it across the board.

Yeah. And that's kind of digging into some stuff that I end up having to do every day, where for like certain applications, I have to sit there and try to play detective and do things like, yeah, okay. Is there a trend Yes.

Where like, But, But these, like five alarms always trigger together. Yeah. And this is, you know, normally the issue.

And then that way we put like a fix in. Yeah. But there's only, you know, we could only analyze like one or two or three metrics at a time.

Mm-hmm. I wanna look at hundreds of metrics and see Exactly. Right.

I don't wanna go fishing for it. Right. That's exactly, that's, that's Why, um, one of our, um, we're, we're, that's, that's, that's, um, that is in the pipe.

We're trying to develop that because that, that was a powerful tool that, you know, this some other platform had. It was an on-prem solution. Um, but that requires extensive CPU, right?

Mm-hmm. So we'd have to, 'cause remember, we're, we're gathering, um, we're, we're gathering metrics for compute, network storage, virtualization, containerization. So we're literally getting thousands of metrics, and sometimes we're monitoring those metrics every one minute.

Yeah. So you can imagine the data that you'd have to crunch. Right?

And that makes me think too, like what's, like the pricing looking like? Like do you kind of do a cost per pool type situation? Um, yeah.

So the licens the licensing, okay, so we, we, we already said that it is based on the number of resources that you're monitoring, right? Um, but also for each resource, you are allocated 50 metrics. Okay.

If you go beyond that, there is a little bit of overage you gotta pay, but typically 50 metrics is enough because a lot of these resources, you're not pulling 50 metrics. Okay. Um, but also because our platform has the ability to do log ingest, trace ingest, and we could also ingest alerts from other monitoring platforms.

Uh, we're we also, uh, ba price based on the number of the volume that we're ingesting. Okay. Okay.

We, we allocate you x number of gigabytes, but if you go above that per month, then there is an overage. Okay. And then what about, like, are there any kind of integrations?

I'm thinking in like AWS one now where, let's say if you wanna plug something into like Athena or Glue, and then just like go to town with all the different Yep. You know, metrics you got There. Yep.

Well, we have full support for, uh, AWS and Athena. So, uh, lemme refer you to our documentation site. Again, just search for AWS and then under AWS I'm just gonna click on here, um, under our public cloud, under AWS you're gonna see here supported services.

Mm-hmm. And if you click on that, you're gonna see the list of all the AWS, uh, uh, public cloud services that we, uh, we support. Gateway Is another interesting thing.

Yep. So like, what kind of things are you doing with like API gateway? Um, so it, it depends on what the API is returning.

So for the gateway, or is this API gateway? Yes. So let's click on that.

So, um, so it's telling you here kind of what that is and, um, what we're getting, here's the metrics that we're, we're, we're pulling from that. So we're getting the, um, API gateway errors, uh, client side errors captured. So these are all the metrics.

Again, it's typically based on we're just calling the AWS APIs. Yeah. So whatever they're exposing to us is what, what you're gonna see.

Okay. That's why there's, again, there, there's, there are updates almost like weekly for the cloud stuff. Nice.

And then I also imagine basically like if you're doing multi-cloud, this will help give you like a single Yes. Place to look at, you know, Google, AWS Azure together. So just like this dashboard here, uh, public cloud overview, and let me just change the timeframe here.

Here's a dashboard which is showing AWS Azure and Google Cloud metrics, CPU, memory and disk, all on a single platform. And like, what's kind of like that, um, the time looking like for, say, like, if you were to log into the actual cloud platform itself versus the numbers you see here? Uh, um, oh, so, uh, these, these metrics, um, the most granular we'll do is every one minute.

Okay. It's one minute polling intervals. But, um, if it's, if it's critical infrastructure, usually they'll monitor it every one minute.

Mm-hmm. But if not, they'll do like every five minutes. And Is there any pricing difference based on, um, They'll just, just, uh, as long as you don't exceed like the 50 metrics per, per resource per month.

Right. Cool. Let's see.

So I can show you, um, public cloud resources mixed in with on-prem resources, right? It's all in one data lake. And again, alerts that we're grabbing from AWS Azure and GCP, we can potentially correlate that with all the other alerts we see on-prem.

Nice. Okay. Everything is in one platform.

So that, that's really the, the secret sauce guys. We're not really doing anything different from a monitoring perspective. Right.

Everyone monitors VMware the same way. They talk to the vCenter server. V an API, everyone monitors networking devices via SNMP.

Right? Version one, version two, version three, or they ingest SNMP traps. Okay.

If they're running like SD WAN and stuff like that, there's usually a controller that you talk to. If an API. What, what makes us different is that we can get these metrics, this data, these, uh, from, from everywhere, right?

We we're, we're like a mile wide. Um, and grabbing all those signals. And then, um, again, it, it, this, um, this wheel diagram kind of just really emphasizes all the things that we do together.

Not just monitoring, right. Uh, event management, using machine learning, incident management and automation. All in a single unified platform.

That's what it is. So with our platform, you can potentially, uh, consolidate all those monitoring tools that you may have. Right?

I mean, just ask the network team, how many tools do they have? Ask the compute team how many tools they have and the storage team, right. Each of those silos are, are running, I'm gonna bet at least four to five separate monitoring tools.

Right. And then are you seeing, like, most often, like, are people seeking this out specifically, or is it, like you said, it just kind of comes with like another product and you know, these kind of, at that point, um, Usually customers will come to us and they're complaining about something. They have a pain point, like, I'm getting thousands of alerts per day and we don't know how to keep up with alert.

Yes. So alert fatigue. Alert fatigue.

Is it helping with that in kinda Way? Yes, definitely. So we have, we have, uh, white papers mm-hmm.

Which document how, um, how much alert reduction our customers are seeing. And typically they're seeing about a 90 to 95% alert reduction in their, in their alert noise because of our machine learning, because of ab our ability to, to suppress alerts. Okay.

Because of our ability to run automation. Okay. And sorry, and I'll stop talking and then, um, I, I appreciate, I appreciate the questions.

'cause now it's making me think about things. Okay. So like, what's the typical way that people get notified?

Like is it Slack integration, is it email? Uh, typically it's email. It's email.

But we do have integrations so that we can send notifications via Slack channel or a teams channel, or like I mentioned, we can send you a notification via email, text, or voice, and you can configure what the email looks like. You can configure what the text looks like and what the voice is. Right.

Because if you wanna, some people wanna put more detail in the message. Some people just wants to put less, you can customize that. All right.

And I, I'm joking. I have one more question mm-hmm. And then I'll be done.

Mm-hmm. Um, now I'm thinking about, so are you able to do like ex escalation points? So maybe it notifies like this group first or this person first, and then You're, you're just asking all the right questions.

So I deal with monitoring, like Yeah. Every Day. So you, you, you've, you've, you know how it works.

Yes. So we actually have this, we have what's called the alert to resolution pipeline. So this is how, this is the, the flow of all the alerts.

So, you know, we, we first, we, we generate the alert. Okay. Again, it could be an op shop alert or a third party.

Right. And then we ingest it, we do normalization, de-duplication of alerts, and then we go to alert prediction. As we ingest all of these alerts, we're gonna analyze them and see does this alert have seasonality?

Does it happen every 24 hours at midnight? 'cause of a backup. Right?

If there is seasonality, we can detect it and we could suppress it automatically. But I'm, I'm skipping a step. After we determine alert prediction, then we do alert correlation.

This is our machine learning to do that correlation. And then the next step is first response. First response.

That's two things. It either suppresses the alert, maybe you wanna suppress it for like X number of minutes. Yeah.

'cause sometimes, you know, you get those alert, you don't Wanna alert right away. Right? Yeah.

It's not really serious. Yeah. So let's just suppress it for 10 minutes.

Okay. So I suppress it for 10 minutes. Now if the alert goes away within 10 minutes, then great.

Awesome. The alert went away, no harm, no foul. Right.

But after 10 minutes, if the alert is still active, then it goes to the escalation phase, and we have a whole process to do alert escalation. Nice. So again, for alert escalation, you could have it send you email, text, or voice.

And then after we send out that first notification, if nobody acted on the alert, if nobody put like, acknowledged or did something, then it gets escalated again. And now you could have emails sent to the managers. Right?

Now, again, if nobody does anything to the alert, they don't acknowledge it, they don't do anything, then we could further escalate it, maybe create an incident automatically. Okay. So all of this stuff can be program programmed into our platform because we follow this pipeline so that no alerts gets dropped on the floor.

Right. It gets properly triaged and addressed in our platform. One more feature idea if it's not already there.

Mm-hmm. I, I'm definitely AWS focused. Mm-hmm.

But is there any like, tie in or integration with like, incident manager and so like, it just goes and, you know, once it figures out what the problem is and then just fix it, that would be cool. Um, yeah. That like, or Create a ticket.

Yeah. Um, so we, we can only detect like a particular problem. So, um, you know, we can, we can filter at the metric level.

Mm-hmm. So if I, for example, if I'm looking for a ping packet loss, I can look precisely for that alert and then act on it. Right?

But right now, we're not, right now we're not doing any kind of, um, you know, AI to say, oh look, this is Ping. Yeah. I recommend you do this, this, this.

Um, I believe Aruba Central has capabilities to do that because they're, they're better suited at that because they're networking experts. So they've seen all the network alerts. Yeah.

And they know how to handle it. Us, we, we don't have that level of expertise because we're very broad, right? We, we cover compute, network storage, virtualization, containerization, all that.

We're like, I hate to say it, um, uh, jack of all trades master at none. You kind of have to master that domain in order to make intelligent, um, recommendations. Right.

Cool. But I mean, that's Aruba Central, that's HPE, that's us. That's, that's still our, that's still our platform.

Right. Thank You. Ju we're at about time.

Do you have any closing words? Uh, anywhere? Call to action for our viewers.

Um, closing words. Um, yeah, so ops wrap is a platform. Okay.

So if you have a customer or client that's looking for another monitoring tool, you know, just to monitor, compute, just to monitor network, then SRA is not the platform. I mean, they already have like 10 tools. What are they looking for?

An 11th and a 12th? One, you think piling on more tools is gonna fix their problem. It's, it's the whole process.

It's their whole mindset. Remember, it's not just about, it's not just about the monitoring, right? Once you've monitored everything, then how do you handle the alerts, right?

How do you correlate it? How do you do incident management and automation? So it's just a, a, a better, more efficient way to do monitoring and observability.

Don't just buy more tools and stack 'em on, because if you're just buying more tools, you're just adding to your problem. Consolidate, using the ops app platform. That's, that's what it's all about.

Thanks.