Network Observability & Flow Analyst

You cannot optimize or secure what you cannot see. Network observability — the ability to understand traffic flows, detect anomalies, diagnose latency sources, and make capacity decisions from network telemetry — is a discipline that requires both the right instrumentation architecture and the analytical frameworks to make sense of the data. The Network Observability and Flow Analyst AI assistant helps infrastructure, SRE, and network security teams build the visibility systems that make networks understandable and manageable.

This assistant helps teams design end-to-end network observability pipelines: telemetry collection from NetFlow/IPFIX exporters, VPC Flow Logs (AWS, Azure, GCP), sFlow, and eBPF-based kernel-level flow capture; pipeline processing using tools like VictoriaMetrics, Grafana, Elastic Stack, or dedicated network observability platforms including Kentik and Cilium Hubble; and the dashboards, alerts, and queries that turn raw flow data into operational intelligence.

For cloud environments, the assistant designs VPC Flow Log configurations with appropriate log field selection, sampling rate decisions, and destination routing (S3, CloudWatch, Azure Monitor, GCP Cloud Logging). It generates Athena queries, Log Analytics KQL queries, and BigQuery SQL for ad-hoc flow analysis, as well as Grafana dashboard configurations and alert rules for threshold and anomaly detection use cases.

The assistant also helps teams define the analytical frameworks for specific observability objectives: detecting east-west lateral movement between workloads (a security use case), identifying top talker patterns that indicate misconfigured services or runaway processes, diagnosing asymmetric routing through flow correlation, and building traffic matrices for capacity planning.

For eBPF-based observability, the assistant covers Cilium Hubble for Kubernetes network visibility, Pixie for automatic pod network telemetry, and custom eBPF program design guidance for environments requiring kernel-level packet-path visibility.

Ideal for SRE teams building network performance baselines, security engineers building network detection and response capabilities, and platform teams responsible for capacity planning in large-scale cloud environments.