nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

OpsBot – Multi-Agent AIOps for SolarWinds & Enterprise Observability

rajasekar

🚀 OpsBot – Multi-Agent AIOps for SolarWinds & Enterprise Observability

OpsBot is a Multi-Agent, MCP & RAG-powered AIOps platform that brings SolarWinds and multiple enterprise observability/IT platforms into a single intelligent operations interface.

🤖 Multi-Agent AIOps

Specialized AI agents work together based on the request:

SolarWinds – SWQL/SWIS, NPM, NCM, SAM, nodes, interfaces, alerts, health and inventory
AppDynamics – application performance, agents, health rules, databases and policies
ThousandEyes – tests, alerts, network and external-path visibility
Cisco Catalyst Center/DNAC – devices, APs, PnP, health and issues
NetBox – DCIM/IPAM and source-of-truth validation
ServiceNow – incidents, events and CMDB correlation
Splunk – operational data and forwarder workflows
NetTools – DNS, Ping, TCP and Traceroute
Knowledge & Analysis Agents – knowledge retrieval, analysis and correlation
Commander & Orchestrator – dynamically select and coordinate the required agents and tools

🔴 Live Agent Mission Control

Live Agent Flow provides real-time visibility into how each request is being handled:

User → Commander → Orchestrator → Agents → Tools/APIs → AI/LLM → Analysis → Response

Users can see:

Agent-to-agent communication • Active/Idle status • Current tasks • API/tool calls • Execution time • AI/LLM provider & model • Request tracking • Execution history

🔌 MCP + 📚 RAG

MCP (Model Context Protocol) provides an extensible approach for connecting agents with tools and operational capabilities.

RAG (Retrieval-Augmented Generation) provides context-aware knowledge using operational documentation, troubleshooting knowledge, runbooks, SWQL knowledge and other relevant information.

This allows OpsBot to combine:

RAG Knowledge + Live Monitoring Data + Multi-Agent Analysis

rather than depending only on an LLM.

🧠 Intelligent Multi-LLM Routing

OpsBot can choose the most appropriate execution path:

Deterministic Tools/SWQL → RAG/Knowledge → Enterprise LLM → Local LLM

Not every request needs AI. Simple queries can be handled directly through tools/APIs, while AI can be used for more complex analysis and correlation.

🔎 Cross-Platform Investigation & RCA

Multiple agents can investigate the same issue together.

For example:

“Investigate why Application X is slow.”

OpsBot can correlate information from:

SolarWinds + AppDynamics + ThousandEyes + DNAC + NetTools + RAG

to analyze application, infrastructure, network and external-path conditions together and assist with root-cause analysis.

🛠️ SolarWinds Intelligence

Capabilities include:

SWQL/SWIS • Node/Interface/Volume Monitoring • Alerts • Health Analysis • Interface Utilization • Anomaly Detection • NCM Configuration • Config Comparison • Backup Visibility • Topology • CI Comparison • Maintenance Operations • Inventory • Cross-Platform Search • Runtime SWIS Schema Discovery

🔗 Multi-Source Infrastructure Correlation

Infrastructure information can be correlated across:

SolarWinds ↔ Cisco Catalyst Center ↔ NetBox ↔ ServiceNow CMDB

helping identify inventory mismatches, missing CIs, retired devices still being monitored and source-of-truth differences.

⚡ Key Highlights

✅ Multi-Agent architecture
✅ MCP integration/extensibility
✅ RAG-powered knowledge intelligence
✅ Multi-LLM support and intelligent routing
✅ Live Agent Mission Control
✅ Cross-platform investigation & correlation
✅ SolarWinds SWIS/SWQL intelligence
✅ Zero installation
✅ Zero external runtime dependencies
✅ No administrator access required to run
✅ Portable

💡 Looking for Feedback

I’m continuing to enhance OpsBot and would love to hear ideas from the THWACK community.

If anyone is interested in AI OpsBot or would like to know more, please feel free to ping/message me. Suggestions and real-world use cases are very welcome! 🚀

Find more posts tagged with

AI Ops

orion

npm

report

AI Agent

Comments

rajasekar

🔥 This is the part I’m finding most interesting while building this.

The UI is becoming less like a traditional chatbot and more like a live AI operations control plane.

What you're seeing here is a Mediated Blackboard / shared OpsContext — a request-scoped state layer where the agents don't need to directly “chat” with each other.

For a single request, the context tracks things like:

Request → Intent → Agent Plan → RAG → Evidence → RCA → Guardrails → Remediation state

In this example, the orchestrator planned work across SolarWinds, AppDynamics, ThousandEyes, DNAC, NetBox, ServiceNow and Analysis agents, while the shared context records what each stage has actually done.

The interesting part is watching the system make decisions in real time:

🧠 Agent orchestration — which specialist should work on the request
📚 RAG — what knowledge was retrieved and how confident the retrieval was
🔎 Evidence — what was actually collected from monitoring systems
🛡️ Guardrails — whether the request/action is allowed
⚙️ Remediation — recommendation/playbook/approval/execution state
📊 Mission Control — live visibility into the entire request lifecycle

And importantly, the LLM isn't the authority.

The model can reason and propose, but the platform controls tool authorization, evidence collection, guardrails and action boundaries.

That separation is becoming one of the most important design principles in my AIOps architecture.

Still evolving, but honestly it's becoming much more interesting to watch the agents assign work, retrieve evidence, update shared state and converge on an answer than simply watching an LLM generate text. 🚀

Next step: making the same control plane handle autonomous monitoring → correlation → RCA → ticketing → Teams interaction → playbook execution, while keeping the safety boundary outside the LLM.

rajasekar

@ecklerwr1 Absolutely — that’s exactly the kind of environment I’d like to test against. 👍
OpsBot supports local Ollama and OpenAI-compatible LLM endpoints, so your GPT-OSS/Nemotron deployments should be testable without sending inference to an external LLM, provided their serving API is compatible.
SolarWinds, Splunk and Catalyst Center/DNAC are already covered in the current framework. ISE would be a new agent.
Your 3 isolated networks + local LLMs + Observability + Splunk would be a great real-world validation environment. I’d be happy to test it with you once I have a sanitized evaluation build ready. 🚀

rajasekar

@javan Thanks for the detailed feedback - these are valid enterprise security considerations.
OpsBot is a portable PowerShell/.NET WinForms application and doesn't require local Windows Administrator privileges. It uses a Commander/Orchestrator with cooperative specialized sub-agents, rather than giving one LLM unrestricted access to every platform.
MCP is used as the tool/context integration layer. The LLM determines the required structured tool/action, while OpsBot's deterministic tool layer performs the actual SWIS/SWQL, REST API, NCM or PowerShell operations. The LLM doesn't directly execute commands or API calls. This separation is important for both security and auditability.
For RAG, I'm using semantic text matching against the local knowledge base containing SOPs, runbooks, troubleshooting procedures and operational documentation. Relevant knowledge is retrieved and combined with live monitoring evidence before the reasoning step, helping reduce unsupported/hallucinated recommendations.
Local/private LLMs are supported as well, so organizations can keep inference within their own network.
I'm also working on controlled remediation:
RCA → Evidence → Recommendation → Validated Playbook → Policy Check → NCM/SSH → Validation
Depending on policy, predefined low-risk playbooks could be automated, while higher-risk actions can require approval. The LLM itself will not directly execute arbitrary production commands.
Appreciate the feedback! Security, governance and explainability are important parts of the next stage of OpsBot. 👍

javan

The primary risks in this AIOps architecture center on data privacy, access control bypass, and prompt injection. Connecting multiple enterprise monitoring tools to an LLM creates an attractive target for attackers.

RBAC bypass: "No admin access required" might let low-privilege users see sensitive data.
Credential exposure: Agents need credentials for multiple platforms (ServiceNow, Splunk, SolarWinds).
Data leakage: Proprietary network topologies and configurations may stream to external LLMs.
API throttling: Cross-platform investigations could overload system APIs

The concept is excellent and addresses true enterprise visibility gaps. However, marketing "zero installation" and "no admin access" raises immediate security red flags for enterprise compliance teams.

ecklerwr1

You're right @m_roberts. This is even more interesting then…

ecklerwr1

@rajasekar that's great news as we have multiple locally hosted LLMs including GPT OSS 120b (Now Laguna M1) and NVIDIA Nemotron3-120b. I'm really excited about this then now! I wonder if it could work with our local LLM's? We have them hosted on 3 isolated networks now running Observability Advanced. We do have splunk hosted on the networks too. I have Cisco ISE running and soon a Catalyst Center as well.

vinay.by

Thank you @rajasekar

rajasekar

@ecklerwr1 I think you may be referring to the SolarWinds World Tour demo in Phoenix. My project is actually separate from that.

One of the design goals for OpsBot is AI provider flexibility. It isn't tied to a single model or cloud endpoint. It can work with enterprise-managed AI, local/private LLMs (such as Ollama), or deterministic workflows when AI isn't required.

I also designed it so the AI layer is independent from the tool execution layer. The agents retrieve live data through SolarWinds SWIS, REST APIs and other platform integrations, while the selected AI provider is used only for reasoning and orchestration when needed.

My aim is to give organizations the flexibility to use the AI platform that aligns with their own security and governance requirements.

rajasekar

Thanks! I completely agree with your perspective.

My goal isn't to replace the capabilities already available in Observability Self-Hosted. Instead, I'm trying to build an orchestration layer that can leverage SolarWinds together with AppDynamics, ThousandEyes, DNAC, ServiceNow, NetBox and Splunk through a single conversational workflow.

One thing I wanted to keep flexible was the AI layer. OpsBot isn't tied to a single provider—it currently supports Power Automate, Azure OpenAI, OpenAI, Anthropic and local Ollama models (see attached screenshot).

For enterprise environments, my default choice is Power Automate because it allows organizations already using Microsoft 365 to integrate approved LLMs through Power Platform governance, rather than hardcoding a public AI endpoint into the application. Microsoft has a good overview of the architecture here:

https://learn.microsoft.com/en-us/ai-builder/ai-builder-architecture

Another area I've been focusing on is reducing hallucinations. Instead of relying only on the LLM, OpsBot has a Knowledge Agent that uses a simple RAG approach. Administrators can place SOPs, runbooks, troubleshooting guides, SWQL examples or other operational documents into the local /Knowledge folder. During request processing, the Knowledge Agent searches for relevant content and provides that context alongside live platform data before AI reasoning takes place.

The idea is to combine:

Live SolarWinds and platform data
Runtime SWIS schema discovery
Knowledge retrieved from local documentation (RAG)
Multi-agent correlation

so the AI is reasoning over real operational evidence, not just its pretrained knowledge.

If they dont have LLM access still they can do lot of analysis & task between the various tools using the direct options

I'd really appreciate any suggestions from the THWACK community on areas where this approach could complement the capabilities already available in Observability Self-Hosted.

rajasekar

Thanks @vinay.by

Security was one of my primary design considerations.

OpsBot doesn't allow the LLM to directly communicate with SolarWinds or any enterprise platform. Instead, the LLM acts only as a planner/orchestrator.

Based on the user's request, it returns a structured JSON action plan indicating which tool should be used and what operation needs to be performed (for example, SWQL, AppDynamics REST, DNAC REST, Splunk SPL, NetBox, or ServiceNow).

OpsBot then validates that request and executes it locally through its own tool layer using the authenticated session and credentials already configured by the user. The LLM never receives or stores platform credentials, and it never makes direct API calls to the environment.

To reduce hallucinations, OpsBot doesn't rely on the LLM to invent operational data. It retrieves live data directly from SolarWinds and other platforms, performs runtime SWIS schema discovery, uses RAG to retrieve relevant operational knowledge, and then correlates the evidence before presenting a response.

The attached Mission Control screenshot shows that execution path in real time—from Commander → Orchestrator → Agents → Platform APIs → AI provider → Analysis → Response so users can see exactly which agent, tool and platform participated in the request.

vinay.by

Nice post @rajasekar thanks for sharing, but how safe is this? Would major enterprises even allow this - keeping in mind the cyber security angle.

m_roberts

This is not what I believe you would have been shown in the Phoenix World Tour. That would have been the SolarWinds native version of this kind of solution, that would have been the SW1 platform.

i_like_eggs

Really interesting. The SolarWinds side stood out to me because there is already so much capability within Observability Self-Hosted.

These are some of the capabilities I use today, rather than future ideas. With a different operating model, I use Observability Self-Hosted to correlate related observations across alerts, metrics and monitored entities, identify repeating time patterns, and retain those patterns as structured memory.

The platform can also create anomaly-based alerting, build regression models to forecast almost any consistently sampled numeric metric, from NPM and SAM metrics through to hardware sensor values, apply recurrence and freshness rules to reduce noise, and present the resulting context through views, dashboards, reports and ticket payloads.

I can definitely see the value of AI as a conversational and orchestration layer. Ideally, an approach like this would work across both Self-Hosted and SaaS, with local, private or external models depending on the organisation’s security requirements.

Observability Self-Hosted is an incredibly powerful piece of software and genuinely deserves to be recognised as one of the very best observability platforms available.

The real constraint is usually the time, engineering effort and perspective applied to its data. That is often where I see the real gap, but that is just my perspective ✌️

ecklerwr1

I saw the preview of this live in Phoenix and it's pretty legit. I wish I could run it against our locally hosted LLM but it seems you have to have an outside connection to the SW model on the internet for it to work.

Quick Links

Dynamic Interface Dashboard; HTML/JS
I wanted to share a new dashboard a co-worker ( @mblackburn ) came up with to help us better view groups of interfaces and various metrics for each. Using a single HTML widget, we are able to visually compare numerous different interfaces by populating each interface dataset onto its own graph. We are able to view…
PALO-ALG - Logging
PALO-ALG - Logging.xmlPalo Alto Networks ALG Security Technical Implementation Guide :: Version 2, Release: 3 Benchmark Date: 27 Oct 2022
Alert HTML Content
Alert Cleared.htmlHello, I would like to share the HTML template details we have prepared so that Solarwinds alarms can become more meaningful. It can list alarm object details and connected device details separately in HTML template. Except for object and device details, you can easily add custom property information…
Cisco ASR Devices
Cisco ASR Devices.pollerCisco ASR Devices