🌐 Incident Triage: Multi-Agent NOC Log Analysis System

An agentic, modular Network Operations Center (NOC) triage system designed to analyze large-scale network telemetry and generate structured, production-grade incident reports.

This system implements a two-agent A2A (Agent-to-Agent) architecture using LangGraph:

• An Analyst Agent performs structured root-cause analysis from preprocessed telemetry.
• A Reporter Agent transforms validated findings into compliant, professional reports.

The design emphasizes:

• Separation of concerns
• Fail-fast evaluation
• Deterministic validation over LLM outputs

📑 Table of Contents

• Tech Stack
• Key Features
• System Architecture
• In-Depth Agent Workflow
• Evaluation & Retry Mechanism
• File Structure
• Screenshots
• Getting Started
• Contact & License

🛠️ Tech Stack

This project is built with a modern, robust AI + data processing stack:

• Core Runtime: Python 3.9+
• Workflow Orchestration: LangGraph (stateful multi-agent pipelines)
• LLM Layer: LangChain + Groq API (llama-3.3-70b-versatile)
• Schema Enforcement: Pydantic (strict typed outputs)
• Frontend: Streamlit (interactive operations dashboard)
• Synthetic Data Generation: Faker
• Report Rendering: Markdown + FPDF

🚀 Key Features

• Massive-Scale Log Simulation: Generate up to 10,000 realistic synthetic syslog events (BGP route flaps, hardware faults, DDoS-like congestion, etc.).
• Intelligent Preprocessing: Condense thousands of raw events into anomaly summaries to stay within LLM context constraints.
• Multi-Agent Orchestration: Pipeline nodes (Preprocessor, Analyst, Guardrails, Reporter, Evaluator) operate as specialized agents.
• Deterministic QA: Programmatically validate report grounding against extracted router entities.
• Interactive Triage UI: Live pipeline trace visibility in Streamlit ("AI Thinking Process").
• Export-Ready Reporting: Download validated Incident, Advisory, and Operational reports in PDF format.

📐 System Architecture

The architecture is organized into three phases:

1. Log Generation & Scenario Setup
2. Multi-Agent Triage Pipeline
3. Rendering & Export

🧠 In-Depth Agent Workflow

The core pipeline (NetOpsPipeline) passes a strictly typed TriageState through LangGraph nodes:

1. Preprocessor Node (Python)

   • Aggregates raw logs by router_id + status
   • Computes occurrence counts, average latency, affected protocols
   • Produces condensed anomaly summaries for LLM-efficient analysis

2. Analyst Node (LLM + Structured Output)

   • Uses with_structured_output(AnalystOutput)
   • Classifies system_status (CRITICAL, ADVISORY, OK)
   • Extracts critical_routers, warning_routers, and likely causes

3. Guardrails Node (Deterministic Validation)

   • Enforces logical consistency between status and router lists
   • Example: if critical routers exist, status cannot remain OK

4. Reporter Node (LLM + Structured Output)

   • Uses with_structured_output(ReporterOutput)
   • Produces one or more markdown outputs:
     • incident_report
     • advisory_report
     • operational_report
   • Supports regeneration with evaluator feedback if grounding fails

5. Evaluator Node + Conditional Routing

   • Scores output completeness and grounding
   • Routes back to Reporter if score < 1.0 and retry budget remains
   • Finalizes when score is acceptable or retry limit is reached

⚖️ Evaluation & Retry Mechanism

To reduce hallucination risk and improve output reliability, the pipeline uses deterministic post-generation checks:

• Validation Rule: Every router ID extracted by Analyst must appear in the corresponding final report.
• Scoring Logic: Starts at 1.0; penalties are applied for missing critical/warning entities.
• Feedback Loop: On failure, evaluator appends precise correction feedback.
• Retry Policy: Conditional re-route to Reporter (max retries configured as 2).
• Outcome: Either fully grounded output or bounded failure with explicit evaluation reason.

🗂️ File Structure

Incident-Triage/
├── Documentation/
│   ├── Incident Triage Architecture.pdf
│   └── Incident Triage Architecture.png
├── screenshots/
│   ├── agentic thinking and pipeline.png
│   ├── log generation.png
│   └── output_export.png
├── .env                  # Environment variables (Groq API Key)
├── .gitignore
├── app.py                # Main Streamlit + LangGraph application
├── LICENSE
├── README.md
└── requirements.txt

📸 Screenshots

Scenario Configuration & Log Generation

Agentic Thinking & Pipeline Execution

Reports & Output Export

🛠️ Getting Started

Prerequisites

• Python 3.9+
• A valid Groq API Key

Installation

1. Clone the repository

   git clone https://github.com/shib1111111/Incident-Triage.git
   cd Incident-Triage

2. Create and activate virtual environment

   python -m venv venv
   
   # Windows
   venv\Scripts\activate
   
   # macOS/Linux
   source venv/bin/activate

3. Install dependencies

   pip install -r requirements.txt

Environment Configuration

Create .env in the project root:

GROQ_API_KEY=your_groq_api_key_here

Run the Application

streamlit run app.py

App URL (default): http://localhost:8501

⚙️ Usage Guide

1. Configure scenario (log volume, error/warning injection, fault type)
2. Generate synthetic logs
3. Initialize AI triage pipeline
4. Review reports, evaluation score, and export PDFs

📬 Contact & License

Developed by Shib Kumar Saraf
For enterprise inquiries, feature requests, or contributions, reach out via GitHub or email.

📧 Email: shibkumarsaraf05@gmail.com
🐙 GitHub: github.com/shib1111111

License: MIT License
See LICENSE for details.