From Metrics to Investigation: How Agentic SRE Could Change Network Operations#

Mohibul Mahmud, Shamir Abdul Aziz, Karthik Srinivas Muthuramakrishnan – Microsoft

• Why: A working — not aspirational — agentic investigation system for network incidents, with an honest list of what still doesn't work; for anyone thinking about agentic identity and trust boundaries, this is the ground truth from an early deployment.
• What: An LLM-driven investigation agent on Azure (Claude Opus-based, configurable) that handles the unknown-failure case runbooks can't: hop-by-hop topology discovery, protocol-level diagnostics across BGP, IKE Phase ½, and ExpressRoute, and a production case where it detected a blackhole route from a deallocated firewall in under 35 seconds. Four scenarios covered: live NL troubleshooting, scheduled monitoring with alert integration, topology discovery from minimal input, hybrid-connectivity analysis.
• How: LLM reasoning + structured tools (Azure CLI, Resource Graph, Network Watcher) + operator-authored skills written in Markdown + governance (RBAC, isolated compute, safety hooks, human approval). The stated non-negotiables: read-only as the enterprise default, human approval required before any write action, and on-prem coverage only via telemetry forwarding to Log Analytics.
• Where applicable: Demoed on Azure, but the pattern (reasoning layer + read-only tools + knowledge base + safety harness) is explicitly presented as generic. Azure-centric in tooling; the write-action approval gate is the identity/trust boundary worth watching as these systems mature.