NOC, Observability and ITOM
Purpose and map of the area
Section titled “Purpose and map of the area”This area covers infrastructure operations: the NOC (monitoring and event management), Observability (metrics, traces, logs, synthetics, RUM, topology) and ITOM (IT Operations Management: discovery, DNS, IPAM, certificates, maintenance, automation, SLO, policy, governance, optimisation). Tickets belong to the NOC-* family. You reach the pages from the IT Hub, the Observability Hub and the ITOM Hub.
NOC L1 and On-Call
Section titled “NOC L1 and On-Call”What it is for. It is the NOC operational console: it collects monitoring alerts (NOC-EVENT, via webhook from Zabbix/Nagios/Datadog) and log analysis alerts (NOC-LOG-ALERT), correlates them into NOC-INCIDENT and manages on-call shifts. It uses the same layout engine as the IT console, described in detail in L1/L2/L3 operational console (NOC and Service Desk).
When to use it. It is the NOC operator’s workstation for monitoring, triage and infrastructure incident management.
How to open it. From the IT Hub (NOC tile) or from the Observability Hub.
What it shows. The three-panel layout (queue · detail · tools) with 60s auto-refresh. L1 KPIs: Open tickets, Active P1/P2, SLA breaches, MTTR (min), Resolved today. L1 actions: Take ownership, Escalate L2/L3, Resolve, Open Major Incident. Tools: linked CIs (CMDB explorer), Runbook (NOC KB, incident playbook), Monitoring (Grafana, Alertmanager), SLA timer, Dashboard. At tier L2: KPIs Open incidents, P1/P2, Change window, MTTR, Root-cause pending and actions Take ownership, Escalate L3, Start RCA, Open Change, Escalate MIM.
On-Call management. The page includes on-call shift management: it shows the shift active «now» and the calendar for the next 4 weeks, with the + Add shift button that opens the shift creation modal (IT-ONCALL: date, assignee, rotation, backup, escalation policy, contact). The source of truth for shifts is the Contract.
How to use it. You monitor the queue, triage events, correlate them into incidents and manage shifts; from an event you can escalate to ITSM (IT-NOC-ESC) or open a Major Incident.
What happens next. Correlating N events on the same CI generates a NOC-INCIDENT; shift assignments feed offline/on-call routing.
Notes. Direct links to Service Topology and ITOM Health.
Observability Hub
Section titled “Observability Hub”What it is for. It is the entry point to the observability tools.
When to use it. To choose the right observability tool (metrics, traces, synthetics, topology…).
How to open it. From the Home/IT Hub (Observability tile).
What it shows. The tiles for: Observability, Health, Traces, RUM, Synthetic, Topology, Net Observability, DB Observability, AIOps, Events & AIOps, NOC L1.
How to use it. You open the tool you want.
What happens next. You reach the chosen page.
Notes. Functional coverage is evolving.
Observability / Metrics
Section titled “Observability / Metrics”What it is for. It shows observability metrics and dashboards for infrastructure and services.
When to use it. To analyse metric trends and spot degradation.
How to open it. From the Observability Hub, Observability tile.
What it shows and how to use it. Metric charts with time filters and filters by service/CI; from an anomaly you generate an event or open a NOC ticket.
What happens next. Deviations feed AIOps events/insights.
Notes. Complements Health (ITOM Health).
ITOM Health
Section titled “ITOM Health”What it is for. It shows the health status of services and CIs.
When to use it. For a summary health view (green/yellow/red) during monitoring or an incident.
How to open it. From the Observability Hub (or from the NOC console links).
What it shows and how to use it. Health status per service/CI with the key indicators.
What happens next. A service in critical status drives the opening/escalation of incidents.
Notes. Linked to the topology (Service Topology).
Distributed Tracing
Section titled “Distributed Tracing”What it is for. It shows distributed tracing of transactions across services.
When to use it. To find the bottleneck in a multi-service transaction.
How to open it. From the Observability Hub, Traces tile.
What it shows and how to use it. Traces with spans, latencies and dependencies; you select a trace to analyse its path.
What happens next. The analysis guides RCA and optimisation.
Notes. Complements RUM and Synthetic.
Digital Experience / RUM
Section titled “Digital Experience / RUM”What it is for. It measures Real User Monitoring (the real experience of users).
When to use it. To assess the performance end users perceive.
How to open it. From the Observability Hub, RUM tile.
What it shows and how to use it. Experience metrics (load times, client-side errors) per page/path.
What happens next. Experience degradation feeds events/tickets.
Notes. Complements Synthetic Monitoring (Synthetic Monitoring).
Synthetic Monitoring
Section titled “Synthetic Monitoring”What it is for. It runs synthetic tests (probes) to check service availability and performance.
When to use it. For proactive end-to-end monitoring of critical endpoints and paths.
How to open it. From the Observability Hub, Synthetic tile.
What it shows and how to use it. Synthetic tests with result and latency; you configure and run the probes.
What happens next. A failed test generates an alert.
Notes. Complements RUM.
Service Topology
Section titled “Service Topology”What it is for. It shows the topology map of services and dependencies between CIs.
When to use it. To understand the impact of a CI on a service or to navigate dependencies during an incident.
How to open it. From the Observability Hub or from the NOC links.
What it shows and how to use it. The service↔CI graph with status; you navigate it to explore dependencies.
What happens next. It feeds impact analysis (CMDB) and RCA.
Notes. Also populated by discovery and service mapping (Discovery & CMDB, Asset Management and CMDB).
Network Observability
Section titled “Network Observability”What it is for. Network observability (flows, latencies, network errors).
When to use it. To diagnose network problems.
How to open it. From the Observability Hub, Net Observability tile.
What it shows and how to use it. Network metrics per segment/device.
What happens next. Network anomalies feed NOC events/tickets.
Notes. Complements DB Observability.
Database Observability
Section titled “Database Observability”What it is for. Database observability (slow queries, load, locks).
When to use it. To diagnose database performance problems.
How to open it. From the Observability Hub, DB Observability tile.
What it shows and how to use it. Database metrics and problem queries.
What happens next. Anomalies feed events/tickets.
Notes. Complements Net Observability.
ITOM AIOps
Section titled “ITOM AIOps”What it is for. It is the ITOM AIOps engine: ML-based anomaly detection, capacity prediction and correlation.
When to use it. To use automatic insights on the infrastructure.
How to open it. From the Observability Hub / ITOM.
What it shows and how to use it. The operational insights (NOC-OI-INSIGHT: type, confidence, affected CIs, recommendation, estimated impact) generated by the models.
What happens next. The insights guide preventive actions (capacity, maintenance).
Notes. See also Events & AIOps (Events & AIOps) for the event engine.
Events & AIOps
Section titled “Events & AIOps”What it is for. It is ITOM event intelligence: rules, deduplication, correlation, noise reduction, advanced RCA, forecasts and autonomous runbooks.
When to use it. To configure and govern automatic event handling and predictions.
How to open it. From the IT Hub / Observability Hub, Events & AIOps tile.
What it shows. A console in tabs:
| Tab | Content |
|---|---|
| Rules | Event rules |
| Correlate | Correlation of open alerts |
| RCA | Advanced Root Cause Analysis |
| Predict | Event-rate forecast, anomaly detection, capacity risk |
| Models | The ML models |
| Golden | Golden signals / baseline |
| Defaults | Default settings (noise profile, dynamic thresholds) |
| GenAI | GenAI functions |
| Bizservice | Business-service SLA |
| Runbook | Autonomous runbooks (canary + rollback) |
How to use it. You define rules and thresholds, correlate alerts, analyse root causes, and set up forecasts and autonomous runbooks.
What happens next. Rules reduce noise and generate insights/incidents; autonomous runbooks run responses with canary and rollback.
Notes. Multi-domain Bayesian RCA; deduplication and noise reduction.
Telemetry Health
Section titled “Telemetry Health”What it is for. It monitors the status of the telemetry itself (metric/log pipelines).
When to use it. To check that data collection is healthy (no telemetry gaps).
How to open it. From the Observability/ITOM area.
What it shows and how to use it. The status of telemetry sources and any gaps.
What happens next. A telemetry gap is itself a signal to handle.
Notes. It ensures the reliability of observability data.
ITOM Hub and ITOM console
Section titled “ITOM Hub and ITOM console”What it is for. The ITOM Hub is the entry point to IT Operations Management; the ITOM console is its operational dashboard.
When to use it. For day-to-day ITOM operations (logs, insights, runbooks, self-healing).
How to open it. From the IT Hub (ITOM tile) or from the ITOM Hub.
What it shows. The ITOM console is organised in tabs: Logs (log analytics), OI (operational insight/AIOps), Runbooks (automated procedures), Self-heal (auto-remediation) and Config (configuration, drift detection vs baseline).
How to use it. You analyse logs, review insights, run runbooks and self-healing actions, and check configuration compliance (drift).
What happens next. Self-healing remediates automatically; configuration drifts generate reports.
Notes. The ITOM Hub also opens the following specialist pages.
Discovery & CMDB
Section titled “Discovery & CMDB”What it is for. It runs automatic discovery of the infrastructure and populates the CMDB.
When to use it. To discover and update CIs automatically.
How to open it. From the ITOM Hub, Discovery tile.
What it shows and how to use it. Discovery runs (CMDB-DISCOVERY-RUN) with source, scope, schedule and results (new/updated/removed CIs, duration, errors).
What happens next. The discovered CIs update the CMDB and the topology.
Notes. Complements Service Mapping (Asset Management and CMDB).
DNS Management
Section titled “DNS Management”What it is for. It manages the infrastructure’s DNS records.
When to use it. To view/manage DNS zones and records.
How to open it. From the ITOM Hub, DNS tile.
What it shows and how to use it. Zones and records with their actions.
What happens next. DNS changes are reflected on the infrastructure.
Notes. Linked to IPAM and certificates.
IP Address Management
Section titled “IP Address Management”What it is for. It manages the IP address space (IPAM).
When to use it. To allocate/view subnets and IP addresses.
How to open it. From the ITOM Hub, IPAM tile.
What it shows and how to use it. Subnets, allocated and free addresses; allocation.
What happens next. Allocations update the network inventory.
Notes. Complements DNS.
Certificate Management
Section titled “Certificate Management”What it is for. It manages the inventory of SSL/TLS certificates (IT-CERT).
When to use it. To monitor certificate expiry and renewals.
How to open it. From the ITOM Hub, Certificates tile.
What it shows and how to use it. Certificates with domain, expiry, issuer, SAN, auto-renew; automatic alerts at 60/30 days and on expiry.
What happens next. Expiring certificates generate alerts and renewal tasks.
Notes. Linked to DNS and the CMDB.
Maintenance Windows
Section titled “Maintenance Windows”What it is for. It manages planned maintenance windows (IT-MAINTENANCE).
When to use it. To plan work and suppress alerts for the affected CIs during the period.
How to open it. From the ITOM Hub, Maintenance tile.
What it shows and how to use it. Windows with CIs in scope, start/end and alert suppression; they can be linked to changes and deployments.
What happens next. During the window, NOC alerts for the CIs are suppressed automatically.
Notes. Avoids false alarms during planned work.
Automation
Section titled “Automation”What it is for. It manages ITOM operational automations.
When to use it. To define and run infrastructure automations.
How to open it. From the ITOM Hub, Automation tile.
What it shows and how to use it. The available automations with execution and result.
What happens next. Automations produce their operational effects.
Notes. Complements the ITOM console’s Runbooks and Self-heal (ITOM Hub and ITOM console).
SLO & Error Budget
Section titled “SLO & Error Budget”What it is for. It manages Service Level Objectives and the error budget.
When to use it. To define and monitor service objectives and the error budget.
How to open it. From the ITOM Hub, SLO tile.
What it shows and how to use it. SLOs with error budget consumption and burn-rate alerts.
What happens next. Running out of budget drives decisions (freeze, priorities).
Notes. Linked to the golden signals (Events & AIOps).
Policy Enforcement
Section titled “Policy Enforcement”What it is for. It applies operational policies to the infrastructure (enforcement).
When to use it. To define and enforce operational/configuration rules.
How to open it. From the ITOM Hub, Policy tile.
What it shows and how to use it. Policies with compliance status and violations.
What happens next. Violations generate reports/actions.
Notes. Complements Governance (Governance) and configuration compliance.
Governance
Section titled “Governance”What it is for. It governs ITOM processes and standards.
When to use it. To oversee operational governance.
How to open it. From the ITOM Hub, Governance tile.
What it shows and how to use it. Governance indicators and compliance with standards.
What happens next. It feeds improvement decisions.
Notes. Linked to Policy and Optimization.
Optimization
Section titled “Optimization”What it is for. It optimises infrastructure capacity and costs.
When to use it. To find under/over-used resources and savings opportunities.
How to open it. From the ITOM Hub, Optimization tile.
What it shows and how to use it. Optimisation recommendations (rightsizing, decommissioning) with estimated impact.
What happens next. The recommendations drive changes and optimisation tasks.
Notes. Linked to FinOps (Asset Management and CMDB) and capacity prediction (AIOps).