Network Event Correlation. Stories to keep you awake#

Javier Antich

• Why: A refreshingly blunt "why event correlation mostly doesn't work" talk, with a taxonomy of where rules end and ML/neuro-symbolic approaches begin — relevant to anyone drowning in NOC alert noise.
• What: An honest dissection of operational noise-reduction approaches — what correlation can and cannot do today, war stories, and a proposal for doing better.
• How: The slides frame correlation as static rules (e.g., link_down + OSPF_Down on same device/interface → correlated) over normalized inventory data, and lay out a two-column map of automation vs. autonomy across operations: static thresholds → ML goal-deviation tracking, rules-based correlation → neuro-symbolic AI, rules-based closed-loop and compliance → goal-driven autonomous agents.
• Where applicable: Tool-agnostic and broadly relevant; the AI/autonomy roadmap is a vendor-independent framework, though the neuro-symbolic claims are forward-looking rather than shipped.