Discovery & Registration M01

Find every device, host, VM and facility asset — agent & agentless. SNMP sweep, credentialed SSH probe, and cloud API pull. Credentials and ranges come from your org settings.

Discovered assets

—

SNMP responders

—

Cloud resources

—

Last job

—

Run a discovery job

Kind CIDR range

Connector credentials are configured in the Admin area — not entered here. Targets outside your allowed ranges are refused.

Discovery records

IP	Hostname	sysDescr / OS	Role	Source	Last seen
No records yet — run a discovery job.

Reachability probe availability · latency · loss

Host / IP Method Port

Method, port and timeouts default from your org Reachability settings.

Sub-component discovery M01 · interfaces + storage (SNMP)

Host / IP

Walks IF-MIB and HOST-RESOURCES into interface and storage sub-records. SNMP community comes from your org settings.

Auto-assignment rules M01 · role / site / tags

First rule (lowest priority number) whose match holds assigns the discovery record's role, site, tenant and tags. Edited by Admins.

Priority Match (JSON) Assign (JSON)

Prio	Match	Assign	Active
No rules yet.

Recent SNMP traps M02 · decoded + MIB-translated

The trap receiver is enabled in the Super area (SNMP trap settings). Incoming v2c traps are decoded, translated and stored tenant-scoped.

When	Source	Trap	OID	Varbinds
No traps received yet.

Unified Asset Inventory M02

One canonical record per asset — stable ID, site / rack / U-position, tenant-scoped. Assets are addressed by opaque tokens; no raw identifier ever appears in a link.

Inventory assets

—

Unpromoted discovery

—

Promote discovery → inventory

Each discovery record becomes one canonical asset with a stable NMS-###### ID. Idempotent — re-promoting never duplicates.

Assign rack position

Asset Site Rack U start U height

Assets

Asset ID	IP	Hostname	OS / role	Source	Rack
No assets yet — promote discovery records.

Collector & Polling M03

Interval SNMP polling with strict per-target isolation and host-agent heartbeats. Poll parameters come from your org settings; a failing target never stalls the others.

Poll jobs

—

Online

—

Unreachable

—

Agents online

—

Register a poll job

Name Host Port Interval (ms)

SNMP community + timeout are taken from org settings. Host must be inside your allowed ranges.

Poll jobs

Name	Host	Interval	Status	Cycles	Fails
No poll jobs yet.

Metric ingest U6 · OTLP / Prometheus / StatsD

Format

Enable OTLP/StatsD per-org in Admin/Super settings; targets scrape on the configured interval. The platform StatsD UDP listener binds when enabled.

Modbus register decode U6 · facility (Modbus-TCP)

Registers (comma, decimal) Type

Decodes polled holding-register values. Unit/port/register-map come from org Modbus settings.

Remote collectors & HA U6 · store-and-forward

Node	Site	Role	Buffered	Dropped	Heartbeat
No remote collectors reporting.

Jolokia / JMX collect U6 · JMX over HTTP

Live collect reads the MBean targets in your org Jolokia settings from the configured agent URL. Composite attributes flatten to numeric samples.

Database metric collection U6 · read-only SQL

Queries are forced read-only (SELECT/WITH only; DML/DDL and multi-statements rejected). DSN + queries come from org settings.

Prometheus remote-write U6 · snappy + protobuf

POST snappy-compressed protobuf WriteRequests to /v1/ingest/remote-write with Content-Type: application/x-protobuf, Content-Encoding: snappy, and your org ingest key in X-NMS-Ingest-Key. Enable per-org in Admin/Super settings. Samples land in the shared ingest store with the __name__ label as the metric name.

Agent plugins & container descriptor U6 · extensible agent

Manifests are validated before storage; the effective collector set merges base + matching plugins + org policy. Image is the self-hosted agent from your org registry.

Plugin	Ver	OS	Roles	Collectors	Enabled
No agent plugins registered.

Asset lifecycle, CMDB & L3 U6 · asset/host completion

Warranty / EoL / EoS status + risk, with org-configured warning windows. Classify derives OS family (AIX/Solaris/HP-UX/Linux/Windows) and server roles (AD/DNS/DHCP/web/db) from sys_descr + listening ports.

eBPF kernel visibility U11 · TCP flow health · retransmit / RTT / anomalies

The Nexus eBPF agent streams kernel network events; the platform decodes them into scored TCP flows (retransmit %, RTT p95, connection-failure %), rolls up per-process network footprint, and flags connection anomalies (fan-out scans, SYN storms, upstream failures). Thresholds are configured per-org in Admin / Super (ebpf scope); ingest is enabled by Super.

Flow health, process rollup and anomaly findings appear here.

Source → Dest	Proc	Status	Retx%	RTT p95	Fail%
No eBPF flows yet.

gNMI streaming telemetry U11 · OpenConfig model-driven · Cisco / Arista / Juniper / Nokia

The Nexus collector holds the gNMI/gRPC Subscribe session against modern NOS; the platform decodes its Notifications — OpenConfig paths → metric names, path keys → labels, the TypedValue union → numeric/string, monotonic counters → per-second rates — into the metric store (source=gnmi). Validate a subscription plan or preview a decode. Ingest is enabled per-org by Super; intervals from the gnmi scope.

Subscription JSON (for validate)

Decoded samples / validated plan appear here.

Platform self-test

Every engine proves itself against real inputs. Green-or-it-doesn't-ship — the same verdict gates every deploy.

Verdict

—

Units passed

—

Conformance

—

Engine results

Module	Unit	Test	Result	ms
Loading…

Network Device Monitoring M04

Vantage network U14 · fleet · segment blame

Per-vantage path runs — JSON [{"vantage","hops":[{"hop","loss_pct"}]}]

Corroborates a path across distributed vantage agents and blames the segment: all vantages losing at the same hop → shared ISP/destination; a single vantage → local to that vantage.

SD-WAN depth U13 · per-tunnel SLA · app-aware path · brownout

Tunnels — JSON [{"id":"mpls","loss_pct":0.1,"latency_ms":40,"jitter_ms":5}] App class

Scores each tunnel against your loss/latency/jitter SLA budget and picks the best path per application class (voice weights jitter/loss, interactive weights latency). Brownout detection available via the series API.

Wi-Fi coverage heat-map U12 · RF path-loss · channel plan

Access points — JSON [{"id":"ap1","x":5,"y":5,"tx_dbm":20,"channel":1}] (x,y in metres) Width m Height m

Predicts per-cell RSSI (log-distance path loss), shades a coverage grid (green strong → red dead), reports coverage % and dead zones, and recommends a non-overlapping 1/6/11 channel plan.

Interface utilization from live SNMP counters, NetFlow top-talkers, and wireless client counts. SNMP community comes from your org settings.

Poll an interface

Device host ifIndex

Samples

Asset	Metric	Value	Unit	When
No samples yet.

IPAM — subnets & utilization D3 · address management

Subnet CIDR VLAN Site

Subnet	VLAN	Used / usable	Util	Next free	Status
No managed subnets yet.

Switch-port locator D3 · MAC ↔ IP ↔ port

Find by MAC / IP / port

Correlates bridge FDB with ARP/ND to resolve where a host is physically attached. Feed FDB/ARP via POST /v1/switchport/correlate (persist:true).

Config compliance D3 · NCM · CIS/STIG-style

Device Paste device running-config

Scores the config against your org's policy ruleset and records violations.

Flow analytics D3 · NetFlow v9 / IPFIX / sFlow

Paste decoded flows JSON [{srcaddr,dstaddr,srcport,dstport,prot,dOctets,dPkts}]

Ranks top conversations, protocols and applications. The platform flow listener (udp/2055, v5/v9/IPFIX/sFlow auto-detect) feeds the live feed automatically.

Routing adjacency D3-B · BGP / OSPF

BGP peers JSON {device, peers:[{peer,remoteAs,state(1-6),uptime_s}]}

Parses BGP4-MIB peer state; flags down and flapping sessions.

OSPF neighbors JSON {device, neighbors:[{nbrIp,state(1-8)}]}

Parses OSPF-MIB neighbour state; flags non-full / stuck adjacencies.

SD-WAN overlay path quality D3-B · R-factor scoring

Overlay paths JSON [{id,loss_pct,latency_ms,jitter_ms,active}]

Scores each path against the org SD-WAN SLA and recommends the best path (brownout-aware).

Who-had-this-IP D3-B · user ↔ IP

IP At (epoch ms, blank=now)

Resolves the user behind an IP at a point in time from auth + DHCP identity bindings. Ingest via POST /v1/identity/bind (persist:true).

Call quality & IP-SLA U8 · ITU G.107 MOS

Latency ms Jitter ms Loss % Codec

Voice-quality (MOS) score from measured latency, jitter and packet loss.

Device depth analyzer U8 · EIGRP / VPN / firewall / CBQoS / hop-path

Analysis

Pastes collected device state; detects feasible successors, rekey-overdue tunnels, shadowed/redundant firewall rules, class drops, and the bottleneck hop.

Path ladder U11 · per-hop loss / RTT / jitter · route-flap · multi-vantage

Target Vantage

Parses raw traceroute into a scored per-hop ladder (loss %, RTT min/avg/max, jitter, latency jumps), flags the bottleneck hop, and — on Run & track — compares against the previous run to this target to detect a reroute. Thresholds come from your org Path-depth settings.

Multi-vantage corroboration — paste runs as JSON [{"vantage":"mumbai","traceroute":"..."},{"vantage":"london","traceroute":"..."}]

Config compliance U11 · CIS / DISA STIG / PCI-DSS packs

Framework Device

Evaluates a running-config against a whole benchmark — each control mapped to its framework reference, severity-weighted score, posture band, and an ordered remediation plan. Pass a device name to track posture over time and roll it up across the fleet. Thresholds come from your org Compliance settings.

Flow intelligence U8 · app-ID / DDoS / cloud flow logs

Action

NBAR/nDPI-style identification from payload signatures (HTTP/TLS/SSH/DNS) over ports; SYN-flood/amplification/distributed DDoS detection; AWS VPC / Azure NSG / GCP flow-log normalization. Packet capture: POST a base64 .pcap to /v1/flow/pcap.

Server & OS Monitoring M05

Database & queue depth U13 · plan regression · consumer lag

Mode

Flags execution-plan regressions (cost blowups, sequential scans introduced, indexes lost), attributes consumer-group lag to the worst partition, and fingerprints SQL so literal-only variants group together.

Agentless CPU/memory/disk over SSH (Linux) or WinRM (Windows), plus service-state changes. Credentials come from your org settings.

Poll a host

Host OS

Check a service

Host Service

Host metrics

Host	Metric	Value	When
No metrics yet.

Out-of-band hardware Redfish · fans / PSU / temps / drives

BMC base URL Drives path

Reads chassis thermal + power (and drives) over Redfish. TLS is verified by default (VA-04) — for a self-signed BMC cert, use “Get cert fingerprint” and pin it in connector.redfish settings. Credentials come from your org settings.

SMART / RAID diagnostics smartctl · storcli

Paste smartctl -a or storcli output

Parses disk/array health from the tool output.

Application monitoring U9 · app templates / DB / MQ

Check

Templates for PostgreSQL/MySQL/Oracle/SQL Server/Exchange/Apache/NGINX/IIS/SAP with per-metric health rules; DB wait-class + slow-query + cache-hit analysis; Kafka lag and queue backlog detection.

App	Type	Status	Updated
No app instances evaluated.

Virtualization & Cloud M06

Per-VM and per-instance metrics with tag propagation into inventory. Hypervisor and cloud endpoints come from your org settings.

Poll

Tag search (key:value)

Instances / samples

Asset	Metric	Value	When
No data yet.

Host overcommit & HA headroom D4-B · virt

pCPU vCPU alloc pMem GB vMem alloc

CPU and memory overcommit assessment against your organization's thresholds.

Cloud right-sizing & commitment D4-B · FinOps

CPU p95 % Mem p95 %

Right-sizing recommendation from observed utilization.

APM — Apdex & percentiles D4-B · apps

Response times ms (comma-sep) T (ms)

Apdex satisfaction score with latency percentiles.

Storage risk D4-B · thin / RAID / IOPS

Alloc GB Physical GB Used GB Growth GB/day

Thin-provisioning oversubscription and projected days-to-full.

Kubernetes workload health U7 · kube-state-metrics

Parses kube-state-metrics into workloads and scores each healthy/degraded/unavailable from desired vs ready replicas. Works for EKS/AKS/GKE/OpenShift — tag the provider in settings.

Namespace	Kind	Workload	Ready/Desired	Status
No workloads ingested.

Container stats U7 · Docker / containerd

Uses the real Docker CPU formula (cpu-delta ÷ system-delta × online-CPUs × 100) and working-set memory (usage − cache).

Cloud cost & FinOps U7 · billing → right-sizing

Provider

Billing rows normalize across AWS/Azure/GCP/OCI field names, aggregate by service, and feed the D4 FinOps right-sizing & waste engine with dollar impact.

Storage & backup U8 · SAN/NAS / FC / LUN / backup

Analysis

Normalizes NetApp/Dell/Pure/HPE/Hitachi arrays (feeding the thin-provision oversubscription engine), FC port CRC/congestion, per-LUN latency + IOPS saturation hotspots, and backup-job RPO compliance.

Array	Vendor	Capacity TB	Used %	Oversub	Health
No arrays ingested.

Environmental & Power M07

Floor thermal map U12 · IDW interpolation · hotspots

Temperature sensors — JSON [{"x":0,"y":0,"temp_c":20},{"x":10,"y":8,"temp_c":31}] Width m Depth m

Interpolates a temperature field across the floor from discrete sensors (inverse-distance weighting), bands cells to the ASHRAE envelope (cold/ok/hot), and lists the hottest spots. 3D rack overlay is available via the floor model API.

PDU power draw, UPS battery state, and rack temperature/humidity on the same cadence as IT telemetry — the facility layer pure IT tools leave out.

Power samples

—

Open facility events

—

Poll a facility device

Host Kind Outlet / sensor Rack

Readings & events

Asset	Metric	Value	Unit	Flags	When
No readings yet.

Energy efficiency PUE · DCiE · cost · carbon

Facility power (kW) IT power (kW) Site

Power-usage effectiveness with energy cost and carbon, using your organization's sustainability settings; snapshotted for trend.

ASHRAE envelope rack inlet assessment

Temp (°C) RH (%)

Classifies inlet conditions against the ASHRAE recommended/allowable envelopes, with dew point.

Power train generator · ATS · UPS battery

Source Battery charge (%) Runtime (min)

Flags running-on-generator, low charge/runtime, and battery-string voltage drift.

Thermal hot-spots rack sensor grid

Rack temps (comma-separated °C)

Threshold °C

Finds rack cells over the configured temperature threshold.

Liquid cooling (CDU) U10 · ΔT · approach · redundancy

Supply °C Return °C Facility water °C Flow L/min leak

Supply/return temperature, condensation-risk, flow and pump-redundancy checks.

Barcode / RFID audit U10 · reconcile

Expected (JSON) Scanned (JSON)

—

Renewable energy & WUE U10 · CFE% · Scope-2 · water

Sources (JSON) IT kWh Water L

—

Topology & Dependency M08

L2 neighbour edges, VM→hypervisor→physical dependency chains, and downstream impact preview over the network and power graph.

Dependency graph live

Loading topology…

Node size reflects how many links it carries. Hover a node to trace its blast radius — its dependencies light up and everything else dims.

Add an edge

From To Type

Impact preview

Node ref

Edges

From	To	Type
No edges yet.

Business services U10 · service health & impact

Model a business service as a weighted set of components (mark the critical ones). Health rolls up from live open alerts — a failed critical component forces the service critical. Impact analysis maps a component failure to the services it degrades, ranked by tier.

Service name Components (JSON)

Failed refs (comma)

—

NOC & Rack Views M09

Per-user dashboards and a live rack elevation where each U-position is coloured by the asset's current alert state.

My dashboards

Name

Set alert state (NOC)

Asset ID Severity

Rack elevation

Site Rack

Threshold & Anomaly Rules M10

Static threshold rules (fire on N consecutive breaches), rolling-baseline anomaly detection, and maintenance-window suppression. A real breach raises a correlated alert, colours the NOC, and notifies.

Create a threshold rule

Name Metric Op Threshold Consecutive Severity

Evaluate a sample

Asset Metric Value

Rules

Name	Metric	Condition	Severity
No rules yet.

Alert Inbox M11

Correlated alerts — flapping conditions collapse into one open alert with an occurrence count; unacknowledged alerts escalate to the next tier on a timeout.

Open

—

Acknowledged

—

Alerts

Asset	Metric	Severity	Status	Count	Tier
No alerts.

Notification channels & templates U10 · Slack / Teams / Webex / PagerDuty / Opsgenie / ServiceNow / SMS / voice / push

Preview the exact provider-correct payload Nexus sends for an alert, the rendered template, and which channels it routes to. Severity maps to each provider's native scale (PD severity · Opsgenie P1–P5 · ServiceNow impact/urgency). Channel endpoints & keys are configured per-org in Admin / Super.

Channel Severity Title Source

Choose a channel and press Preview to see the delivered payload, rendered template and routing decision.

On-call schedule rotation · follow-the-sun · overrides

Resolve who is on call for a schedule (rotation layers, follow-the-sun by timezone, and override windows), with the escalation tier chain. Edit the definition to preview any schedule before saving it.

Schedule name At (ISO or blank = now)

Definition (JSON)

On-call resolution appears here.

Application & Synthetic Monitoring M12

Transaction depth U12 · step waterfall · global locations

Transaction run (or multi-location results) — JSON

Breaks a multi-step transaction into a timed waterfall (slowest step + its share), and rolls the same transaction across global check locations into pass-rate, p50/p95 and SLA attainment.

RUM depth U12 · sessions · error attribution · CWV

Mode

Session duration/bounce/error-rate rollup, error clustering by normalized signature (top page/browser), and per-page Core-Web-Vitals attribution ranking the worst pages.

Real HTTP(S) checks and multi-step transactions run on an interval, recording status, response time and pass/fail. Rolling uptime is computed from stored results. Checks are addressed by opaque token — no internal id is exposed.

Create a check

Name Kind Target URL

Checks

Name	Kind	Target	Uptime
No checks yet.

APM, cert & DNS synthetics U9 · tracing / TLS / DNS / RUM

Analysis

OTLP trace assembly with critical-path + per-service latency/Apdex; TLS cert expiry & SAN-match; DNS rcode/answer/latency; fleet Core Web Vitals p75 rollup.

Trace flame depth U11 · self-time · icicle · N+1 · root-cause

Trace — raw spans[] or OTLP resourceSpans JSON

Assembles the span tree into a flame/icicle chart, computes overlap-aware self time (exclusive time, so async children don't double-count), ranks self-time hotspots, flags N+1 repeated-sibling calls, and names the likely error root-cause span. Threshold from your org APM settings.

Log Management M13

Syslog is ingested over UDP/TCP and indexed for full-text search with source, severity and time filters. The same store feeds incident timelines and the security signal.

Search

Query Source Severity

Query DSL & pattern clustering U11 · field:value AND/OR/NOT · similarity clusters

DSL query Limit

A real query language over the log store: field:value, quoted "phrases", severity>=warn / numeric > < >= <=, wildcards val*, and AND/OR/NOT with parentheses. Fields: severity, source, asset, message, ts.

Time	Source	Severity	Message
Validate or run a DSL query.

Pattern clustering — paste log lines (one per line); variables are masked and alike lines cluster into templates Similarity %

Post a log line

Asset Source Severity Text

Results

Time	Source	Severity	Message
Run a search.

Grok field extraction D4-B

Grok template

Log line

Pulls named fields from a log line using a grok template.

Log pattern mining D4-B · Drain-lite

Log lines (one per line)

Collapses variable tokens into templates with occurrence counts.

Log pipeline U9 · parse / grok / tiers / alerts

Operation

Structured JSON + grok field extraction, CloudWatch/Stackdriver normalization, hot/warm/cold retention tiering, sliding-window log alerts, and count/rate/sum/avg derived metrics. Raw syslog ingest + full-text search remain on the M13 pipeline.

Root-Cause Workspace M14

Open an incident, then assemble a unified timeline of metric breaches, correlated events and log lines, surface upstream config changes as candidate causes, and scan for an auth-failure security signal.

Open an incident

Title Asset

Incidents

Title	Asset	Started	Status
No incidents yet.

AIOps — anomaly / forecast D4 · robust MAD · EWMA · seasonal · Holt

Value Recent samples (comma-sep)

Robust median+MAD z-score (outlier-resistant); method + sensitivity come from your org AIOps settings.

Forecast series (comma-sep) Threshold

Holt double-exponential capacity projection + threshold-crossing (exhaustion) estimate.

Alert storm JSON [{ts,entity,signal}]

Groups an alert storm into incidents and dedups exact repeats.

Time	Kind	Severity	Detail
Load a timeline.

Remediation, Runbooks & Config M15

Agentic remediation U12 · decide → execute → verify → rollback

A closed loop with guardrails: the decision engine gates on match, rate-limit, blast-radius and approval; execution runs only when enabled for your org (ops.agentic_execute_enabled), and the loop rolls back automatically if post-remediation verification fails.

Scenario — JSON {condition, policy, state, action, rollback, verify}

Plan is always safe (decision + blast-radius, nothing executed). Run performs the real closed loop when agentic execution is enabled for the org.

Runbooks execute real remediation actions and record the result; device configs are versioned on change with an exact line diff; every config push writes an immutable audit entry.

Create a runbook

Name Kind Command / URL

Actions run in the platform's execution context. Automatic-on-fire is off unless enabled in settings.

Runbooks

Name	Kind
No runbooks yet.

Config backup & diff

Asset Running config

AIOps & operations U9 · MCP / remediation / SMART / firmware / DHCP-DNS-rogue

Operation

Agentic remediation decisioning with rate-limit/blast-radius/approval guardrails; Backblaze-style SMART failure prediction; firmware CVE/PSIRT version-range matching; config rollback & approval (separation of duties); DHCP exhaustion, DNS drift, and rogue-device detection with port-shutdown recommendation. The Aria MCP interface exposes read-only tools to AI agents by default.

Automation runners U10 · Ansible · Terraform · Rundeck

Plan and analyse automation runs — Ansible playbooks (host×task), Terraform plans (terraform show -json), and Rundeck jobs — with destructive-change guardrails (approval on destroy, blast-radius cap). Planning only; execution stays behind approval.

Runner

Plan + guardrail decision appears here.

Template inheritance & bulk edit U10 · M22

Templates (JSON map) Resolve

—

Targets (JSON) Changes (JSON)

—

Cooling, Thermal & Capacity M16

CRAC/CRAH units are polled over SNMP and flagged out_of_spec above their supply-temp max; power and rack-U headroom per site is provisioned minus drawn; the what-if simulator projects headroom before you add load.

Provision a site

Site Provisioned power (kW) Rack U provisioned

Record asset draw

Asset Watts Rack U

What-if: add load

New assets (count) kW each

Reporting, SLA & Compliance M17

Per-site uptime + incident reports, SLA compliance against your target, and an immutable, checksummed export of the full audit trail.

Generate a report

Site (blank = all) From To

SLA compliance

Stored uptime (%)

Audit export

Report builder U10 · drag-drop sections · white-label

Compose a report from ordered sections (cover · kpi · chart · table · text · sla · sustainability) and apply white-label branding. The builder validates required options per section type before render.

Sections (JSON) Branding (JSON)

Report model appears here.

SLO & error budget U10 · multi-window burn

Per-service error-budget attainment with Google-SRE multi-window burn-rate alerting (fast burn ≥14.4× → page, slow burn ≥6× → ticket).

Services (JSON)

—

Sustainability U10 · PUE · Scope-2 carbon · WUE

Per-site PUE/DCiE, Scope-2 carbon, water-usage effectiveness and energy cost, with an energy-weighted fleet rollup against the PUE target.

Sites (JSON)

—

Recent reports

Generated	Site	Uptime	Incidents	Checksum
No reports yet.

Service-level management D5 · maintenance-excluded SLA

Service Window (hours) Downtime (min) Maintenance (min) Target %

Service-level attainment with planned maintenance excluded.

Digital experience (RUM) D5 · Core Web Vitals

LCP p75 ms INP p75 ms CLS p75

Rates page experience against Core Web Vitals thresholds.

Scheduled reports D5 · cron

Name Cron Kind

Name	Cron	Kind	Format	Next run
No scheduled reports.

API, Integration & Keys M18

The documented versioned API surface, API-key management (keys carry a tenant + role and are shown once), and the external-ITSM ticket integration. Every endpoint is tenant-scoped.

Documented endpoints

—

Issue an API key

Name Role

Keys

Name	Role	Status	Last used
No keys yet.

Payload transform D5-B · integrations

Template {{dotted.path}} from the event

Event JSON

Renders an outbound payload from an event using a template.

Delivery backoff schedule D5-B · exponential + breaker

Exponential backoff with a circuit breaker that trips a dead endpoint open. Base/cap/threshold come from your org integration settings.

Security posture audit D5-B · NFR

Response headers JSON

Scores HSTS/CSP/XFO/nosniff/Referrer-Policy against the baseline.

Apex Depth U15

Depth-lift surfaces delivered in the Apex program — each engine below is live, self-tested, and driven by per-org settings configured in the Admin and Super User areas. These labs exercise the real algorithms directly.

Windows WMI/WinRM U15-A · agentless depth

Class→metric collection plan and the full WMI class catalog. Credentials + poll interval are set per-org under the WinRM connector scope.

Role

Agent fleet U15-B · desired-state · auto-update

Heartbeat/version convergence across the host & container agent fleet. Interval, channel and staleness come from the agent scope.

Threshold policy U15-C · static/dynamic/anomaly/forecast

One evaluator over the AIOps engine. Defaults (mode, band sensitivity) are set per-org under thresholds.

Mode Value Threshold

Retention tiering U15-D · hot/warm/cold

Lifecycle plan with real storage-saving arithmetic. Tier windows come from the per-org tiering scope.

Service map & suppression U15-E · rollup · root-cause

Dependency rollup with parent-child alarm suppression and geo projection for the NOC map.

Flow anomaly U15-F · entropy · flood/scan

Entropy-based flow-anomaly scoring. Baseline packet rate is set per-org under flow.

Scenario

Sustainability & reporting U15-G · PUE · Scope-2

Energy/carbon report from facility figures. White-label branding (report scope) keeps Nexus powered-by self-branding.

IT load (kW) Total (kW)

SSO / directory U15-H · SAML · LDAP/AD

OIDC alongside SAML + LDAP/AD group→role mapping. Provider config lives in the Super User sso scope.

Backup & data protection U15-I · RPO/RTO · coverage

Backup/restore jobs as monitored objects. RPO/RTO targets default from the per-org backup scope.

Observability & AIOps depth U16

Phase 2 — the observability/AIOps home turf of Datadog, Dynatrace, New Relic, Splunk and LogicMonitor. Each engine below is live, self-tested, and per-org configurable.

APM tracing U16-A · tail-sampling · service map

Tail-based sampling + a service map built from spans. Slow/SLO thresholds from the apm scope.

Database performance U16-B · waits · blocking

Wait-event decomposition and blocking-chain resolution (DPA/DBM-class).

Synthetic browser U16-C · multi-step · SLO

Scripted multi-step transaction with step timing + assertions. Availability target from synthetic.

SSL & DNS depth U16-D · chain · DNSSEC

Certificate-chain validation and DNSSEC chain-of-trust.

RUM depth U16-E · sessions · Apdex

Session timeline, error clustering, Apdex. Threshold from the rum scope.

Kubernetes U16-F · control-plane · crashloop

Control-plane health + cluster rollup with crashloop and workload status.

Cloud cost / FinOps U16-G · rightsizing · waste

Multi-cloud cost aggregation, rightsizing $, idle-waste. Floors from finops.

AIOps maturity U16-H · causal RCA · forecast

Causal root-cause over a dependency graph + predictive failure. Grounded-answer floor from aiops.

Network depth U16-I · BGP/OSPF · VoIP MOS

Routing adjacency + flap, and ITU E-model VoIP MOS. Flap thresholds from netdepth.

DCIM, storage & platform scale U17

Phase 3 — facility depth (Schneider EcoStruxure / Sunbird), storage (SolarWinds SRM) and SaaS-scale. These are depth-lifts on the live facility/storage/scale engines; each is self-tested and per-org configurable.

Outlet power & A/B U17-A · phase · redundancy

Per-outlet load, phase balance, and the blast radius of losing one feed.

Cooling & N+1 U17-B · CRAC · liquid

CRAC/CRAH ΔT health and N+1 cooling redundancy.

Rack & floor U17-C · elevation · collision

U-slot collision and weight/power budget per rack; floor footprint overlap.

Capacity what-if U17-D · stranded

Does a proposed addition fit, and which dimension binds first? Plus stranded capacity.

Cabling U17-E · ports · redundant path

Patch-panel exhaustion and diverse-path verification.

Asset lifecycle U17-F · EoL/EoS risk

Warranty / EoL / EoS horizon risk + work-order SLA aging.

Storage arrays U17-G · LUN IOPS · capacity ETA

LUN IOPS/latency hotspots and capacity-to-full forecasting.

Platform scale U17-H · rebalance · merge

Consistent-hash rebalance (minimal movement) and federated partial-aggregate merge.

Sustainability U17-I · CUE · PUE trend

Carbon usage effectiveness and PUE trend over metered feeds.

External-validation readiness U18

Phase 4 — the code side of the final 1%. These engines prove readiness (KAT set, WCAG criticals, scale math, billing, feed SLA, store build); the certificate, audit signature, published benchmark and live listing are issued by outside bodies and are not produced by a build.

FIPS & air-gap U18-A · CMVP readiness

Full KAT set + sealed offline bundle. The CMVP certificate # is issued by an accredited lab.

Accessibility U18-B · WCAG 2.1 AA

Static WCAG checks gate criticals before a signed third-party VPAT audit.

Scale proof U18-C · 100k projection

Ingest/shard sizing + a scaled simulation. The published benchmark runs on real infra.

SaaS billing U18-D · invoices

GA invoice generation from metered usage. Payment-processor settlement is external.

Intel feeds U18-E · SLA · signing

Productised feed catalog with SLA + signing. Commercial licensing is external.

Adoption U18-F · marketplace · store

Catalog entries signed/reviewed + mobile store-build readiness. The live listing is external.

MSP Portfolio MSSP

Your managed customer tenants — status, licensed modules, asset usage vs cap, and open alerts. Provision customers, issue per-tenant licences, and operate inside a customer with assume-tenant. Isolation is strict: you only ever see your own portfolio.

Provision a customer

Tenant (slug) Name

Issue a licence

Customer tenant Modules (comma) Mode Asset cap (0=∞)

Portfolio

Customer	Status	Modules	Mode	Assets	Open alerts
No managed customers yet.

PSA & delivery M-4

Per-customer managed-services contract, usage-metered invoicing, SLA attainment with service credits, and the QBR pack — all measured from the platform's own data. Pick a customer and operate.

Customer tenant MRR Plan JSON SLA % Cost to serve

Bulk & integrations M-5

Provision many customers in one admission-ordered batch, wire a tenant's IdP via SCIM 2.0, and subscribe signed outbound webhooks. All isolated to your portfolio.

Bulk tenants (one per line: slug,name,priority,dep1|dep2) Slots

SCIM tenant

Webhook URL Events

Command Center —

Capacity headroom by site

Site	Provisioned	Drawn	Headroom
—

Noisiest assets (open alerts)

Asset	Open alerts
—

Role	Count
—

Site	Count
—

Command Center —

LIVE STREAMING

0Monitored assets

0Signals evaluated

0Open alerts

0Resolved

Fleet composition by role

Live telemetry streaming

Capacity headroom by site · power

Site	Provisioned	Drawn	Headroom
—

Noisiest assets open alerts

Asset	Open alerts
—

Capability engines backend-verified

Aria AI Copilot

Grounded assistant for Nexus NMS. Every answer is drawn from Aria's knowledge base and your tenant's own live data, with citations — Aria never guesses. Shared engine, common to all TekFusionX platforms.

Ask Aria

Knowledge base —

Aria learned this platform's baseline diagnostics + the 18-module catalog automatically. A super-user can re-learn or teach more.

Search the KB

Answer quality evaluation U12 · grounded-RAG · faithfulness / precision

Runs the live Aria brain over your fixtures and scores it objectively — retrieval precision/recall/nDCG, answer faithfulness (hallucination rate), citation accuracy — with a PASS/FAIL verdict against your org thresholds. Deterministic, because Aria is grounded.

Fixtures — JSON array of {"query":"…","gold":{"relevant":["slug"],"answer":"…"}} (set "unanswerable":true for a must-refuse case)

Scores Aria on your fixtures and reports a verdict.

Admin Area

Intel feeds U14 · CVE/firmware freshness · fleet match-rate

Devices — JSON [{"id","vendor","model","firmware_version"}] Feed — JSON {"source","published","entries":[...]}

Checks each CVE/firmware/EoL feed against its freshness SLA and computes what share of the device fleet the feed actually covers (matched to ≥1 advisory).

Plugin marketplace U13 · Ed25519-signed · sandboxed

Plugins install only when the package signature verifies against your trusted publisher key (set in Settings → marketplace), the automated review passes, and every requested capability is on your allowlist.

Package — JSON {"manifest":{...},"signature":"base64"}

No raw install without a verified signature.

Security assurance U13 · FIPS 140-3 KAT · air-gap · VPAT

Air-gap bundle — JSON {"files":[{"path","sha256"}],"manifest_sha256"}

Approved-mode known-answer tests (SHA-256 / HMAC / AES-GCM), offline bundle integrity, and a WCAG 2.1 AA / Section-508 conformance rollup.

Entity behaviour (UEBA) U13 · baseline · anomaly · risk timeline

Entity History + events — JSON {"history":[{"value":10}],"events":[{"ts":1,"value":30}]}

Builds the entity's behavioural baseline and flags activity that deviates beyond the z-score threshold, with a per-event risk timeline.

ITSM sync & BI export U13 · round-trip reconcile · semantic model

Mode

Classifies records into push / pull / conflict by update time, derives dimensions + measures from a table schema, and materializes an aggregated dataset.

Mobile app U12 · PWA/TWA manifest · push · offline

App name Theme

Generates and validates the installable Web App Manifest, the Android TWA asset-links statement, a web-push payload, and a service-worker offline cache plan (opaque /o/ links stay network-only).

Organization settings for —. Live-connector credentials you enter here are stored encrypted and drive discovery and polling. Secrets are never shown back.

Security & compliance U10 · MFA/TOTP · FIPS 140-3 · SIEM-lite

RFC 6238 TOTP enrolment/verification (secrets are handed to the authenticator, never stored here), FIPS 140-3 approved-algorithm attestation with known-answer self-tests, and MFA step-up policy evaluation.

Code

—

Integration & export U10 · ITSM · monitoring-as-code · CEF/LEEF/JSONL

ITSM target SIEM format

—

Roles & privileges

The built-in role model — each role's privileges, scope and constraints. Custom roles can only narrow a base role.

Role	Rank	Scope	Privileges
Loading…

Access & custom roles

Custom roles inherit a base role (admin, operator, viewer) and can only narrow it — read-only, and/or an allow-list of modules. They never grant platform power. Assign one to a user by their sign-in subject.

Name Base role Read-only Module scope (blank = all)

Key	Name	Base	Read-only	Modules	Active
Loading…

Assign to subject Role

Subject	Role	Assigned
—

Super User Area

Scale & federation U14 · consistent-hash ring · failover

Shard nodes (comma) Keys to route Fail node

Assigns tenants/series to TSDB shards on a virtual-node hash ring (even spread, minimal movement) and shows how a node failure reassigns only that node's keys to survivors.

Retention & downsampling U14 · raw → 5m → 1h tiers

Metric points — JSON [{"ts":ms,"value":n}] (or leave blank for a generated day)

Classifies points by age into raw / 5-minute / 1-hour rollups (dropping the oldest) and estimates the storage saved.

SaaS metering & isolation U14 · usage · rating · tenant isolation

Usage events — JSON [{"tenant","metric","qty"}]

Rolls metered usage up per tenant, rates it against a price card, and proves tenant isolation (any cross-tenant access without an explicit grant is a violation).

Platform-wide controls: global defaults, organization provisioning, and platform-level connector defaults that every org inherits unless they override.

Platform command center

Platform vitality

Loading…

What needs attention

Loading…

Tenants by status

Loading…

Licences by status

Loading…

Platform growth · 30 days

Loading…

Activity heatmap · top tenants × weekday

Loading…

Live activity · all tenants

Loading…

System status

Tenant directory

Tenant	Kind	Assets	Open alerts	Modules	Status
Loading…

Platform identity directory

SCIM-provisioned users, custom-role assignments, and scoped platform operators across every tenant.

Filter by tenant (blank = all)

Tenant	Subject	Kind	Role / areas	Active
Load to view.

Licence management (per tenant)

Issue or edit a tenant's licence directly — modules, mode, caps (0 = unlimited) and expiry. The effective entitlement is shown live.

Tenant Modules (comma, blank = none) Mode Asset cap User cap

#	Modules	Mode	Asset cap	User cap	Status
Load a tenant.

Organizations

New tenant (slug) Name

Tenant	Name	Status	Created
Loading…

Signed-licence integrity

Anti-piracy: when enforced, only vendor-signed (Ed25519) licences grant entitlement — editing a DB row grants nothing. The private signing key never ships; the deployment holds only the public key. Mint licences offline with tools/sign-license.js.

Loading…

Per-tenant feature flags

Force a module on (beyond licence), off, or leave it to follow the licence. A flag changes what the tenant's console and server allow — the overlay is applied inside the entitlement resolver.

Tenant

Module	Licensed	Flag	Effective	Set
Enter a tenant and Load.

Scoped platform-operator grants

Grant a normal user elevation to a subset of platform areas (orgs, licensing, tenants, observability). They are elevated to super only for requests inside a granted area; grant management itself is never delegated.

Subject Areas Read-only

Subject	Areas	Read-only	Active
Loading…

Scale, HA & federation U10 · sharding · quorum · multi-site

Horizontal-scale sharding (rendezvous/HRW — minimal movement on rebalance), HA control-plane quorum, and federated multi-site query merge. Compute/preview — the live topology is driven by the scale settings above.

HA nodes healthy/total

—

Nexus NMS

Discovery & Registration M01

Run a discovery job

Discovery records Refresh

Reachability probe availability · latency · loss

Sub-component discovery M01 · interfaces + storage (SNMP)

Auto-assignment rules M01 · role / site / tags Refresh

Recent SNMP traps M02 · decoded + MIB-translated Refresh

Unified Asset Inventory M02

Promote discovery → inventory Promote all discovered

Assign rack position

Assets Refresh

Collector & Polling M03

Register a poll job

Poll jobs Refresh

Metric ingest U6 · OTLP / Prometheus / StatsD

Modbus register decode U6 · facility (Modbus-TCP)

Remote collectors & HA U6 · store-and-forward Refresh

Jolokia / JMX collect U6 · JMX over HTTP

Database metric collection U6 · read-only SQL

Prometheus remote-write U6 · snappy + protobuf

Agent plugins & container descriptor U6 · extensible agent Refresh

Asset lifecycle, CMDB & L3 U6 · asset/host completion

eBPF kernel visibility U11 · TCP flow health · retransmit / RTT / anomalies

gNMI streaming telemetry U11 · OpenConfig model-driven · Cisco / Arista / Juniper / Nokia

Platform self-test

Engine results Re-run

Network Device Monitoring M04

Vantage network U14 · fleet · segment blame

SD-WAN depth U13 · per-tunnel SLA · app-aware path · brownout

Wi-Fi coverage heat-map U12 · RF path-loss · channel plan

Poll an interface

Samples Refresh

IPAM — subnets & utilization D3 · address management Refresh

Switch-port locator D3 · MAC ↔ IP ↔ port

Config compliance D3 · NCM · CIS/STIG-style View policies

Flow analytics D3 · NetFlow v9 / IPFIX / sFlow Live feed

Routing adjacency D3-B · BGP / OSPF Fabric health

SD-WAN overlay path quality D3-B · R-factor scoring

Who-had-this-IP D3-B · user ↔ IP

Call quality & IP-SLA U8 · ITU G.107 MOS

Device depth analyzer U8 · EIGRP / VPN / firewall / CBQoS / hop-path

Path ladder U11 · per-hop loss / RTT / jitter · route-flap · multi-vantage

Config compliance U11 · CIS / DISA STIG / PCI-DSS packs

Flow intelligence U8 · app-ID / DDoS / cloud flow logs

Server & OS Monitoring M05

Database & queue depth U13 · plan regression · consumer lag

Poll a host

Check a service

Host metrics Refresh

Out-of-band hardware Redfish · fans / PSU / temps / drives

SMART / RAID diagnostics smartctl · storcli

Application monitoring U9 · app templates / DB / MQ Refresh

Virtualization & Cloud M06

Poll

Instances / samples Refresh

Host overcommit & HA headroom D4-B · virt

Cloud right-sizing & commitment D4-B · FinOps

APM — Apdex & percentiles D4-B · apps

Storage risk D4-B · thin / RAID / IOPS

Kubernetes workload health U7 · kube-state-metrics Refresh

Container stats U7 · Docker / containerd

Cloud cost & FinOps U7 · billing → right-sizing

Storage & backup U8 · SAN/NAS / FC / LUN / backup Refresh

Environmental & Power M07

Floor thermal map U12 · IDW interpolation · hotspots

Poll a facility device

Readings & events Refresh

Energy efficiency PUE · DCiE · cost · carbon

ASHRAE envelope rack inlet assessment

Power train generator · ATS · UPS battery

Thermal hot-spots rack sensor grid

Liquid cooling (CDU) U10 · ΔT · approach · redundancy

Barcode / RFID audit U10 · reconcile

Renewable energy & WUE U10 · CFE% · Scope-2 · water

Topology & Dependency M08

Dependency graph live Refresh

Add an edge

Impact preview

Edges Refresh

Discovery records

Auto-assignment rules M01 · role / site / tags

Recent SNMP traps M02 · decoded + MIB-translated

Promote discovery → inventory

Assets

Poll jobs

Remote collectors & HA U6 · store-and-forward

Agent plugins & container descriptor U6 · extensible agent

Engine results

Samples

IPAM — subnets & utilization D3 · address management

Config compliance D3 · NCM · CIS/STIG-style

Flow analytics D3 · NetFlow v9 / IPFIX / sFlow

Routing adjacency D3-B · BGP / OSPF

Host metrics

Application monitoring U9 · app templates / DB / MQ

Instances / samples

Kubernetes workload health U7 · kube-state-metrics

Storage & backup U8 · SAN/NAS / FC / LUN / backup

Readings & events

Dependency graph live

Edges

Rules

Alerts

Checks

Incidents

Runbooks

Recent reports

Scheduled reports D5 · cron

Keys

Delivery backoff schedule D5-B · exponential + breaker