Production AI system · one of the largest data center operators in the US
Agentic & Graph-Based Alarm Correlation
- Challenge
- Related alarms hide the originating issue behind downstream symptoms.
- My contribution
- Led architecture, delivery, and adoption; contributed hands-on to the agents and correlation services.
- Outcome
- In production: alarms grouped by infrastructure dependency, with a probable root cause to investigate first.
Read the full case studyHide the full case study
Combined agentic analysis with graph-based infrastructure relationships and telemetry context to correlate related alarms, support probable root-cause investigation, and help reduce incident triage time.
- Business challenge
- A single electrical fault can trigger alarms across many downstream devices. Operators had to work out by hand which alarm was the originating issue and which were symptoms, which slowed investigation and triage.
- My role
- Led the architecture, delivery, and adoption with reliability teams, and contributed hands-on to the engineering of the agents and correlation services.
- Key decisions and trade-offs
- Split the work across specialised agents: one detects new and cleared alarms, one correlates them, and one writes the investigation summary.
- Expose telemetry and device topology to agents as tools through an MCP server, so agents query live context rather than working from a static snapshot.
- Correlate through the infrastructure graph: when a parent device is already in alarm, related child alarms are grouped under it, and electrical rules classify the pattern.
- Keep the language model to reasoning over pre-correlated alarms, producing a plain-English report of the probable root cause for engineers to confirm, not a confirmed diagnosis.
- What was built or changed
- A multi-agent pipeline combining alarm monitoring, topology-aware correlation with electrical rules, and LLM-written root-cause reports.
- Telemetry (volts, amps, kW) and parent/child device relationships available to the agents during investigation.
- Outcome
- In production, giving operations teams related alarms grouped by infrastructure dependency and a probable root cause to investigate first. Measured triage-time results are not published here.



