Predictive Event Monitoring

A real-time backbone

We built a fault-tolerant streaming pipeline to ingest events via REST APIs at high throughput, with a rule engine for fast, deterministic handling alongside the ML layer.

ML for prioritization and root cause

Models score and prioritize events, cluster related signals, and surface the most probable root cause — collapsing thousands of raw alerts into a handful of actionable incidents.

From reactive to predictive

Outage-prediction models learn from historical patterns to flag conditions that precede failures, shifting operations teams from firefighting to prevention.

A full UI rebuild

We re-engineered the front end and migrated it off the legacy stack, giving operators a faster, clearer console without breaking continuity for existing users.

A streaming pipeline that can keep up with event volume

IT operations environments generate a high-velocity stream of events — far more than any team can review individually, and far more than would be economical to send to a frontier model for analysis one by one. The ingestion layer is a real-time streaming pipeline that can absorb this volume, doing initial normalisation and deduplication (the same underlying issue often generates many near-duplicate events across systems) before anything reaches the modelling layer.

A two-tier model architecture: cheap triage, expensive reasoning only when warranted

This is the architectural decision that makes the economics work. A lightweight classifier — cheap enough to run on every event — does initial triage: is this event likely part of a developing issue, or routine noise. Only the subset flagged by triage goes to a more capable model for root-cause analysis and natural-language summarisation. Running every event through a frontier model would have made the unit economics simply not work at this volume; the two-tier architecture is what makes real-time analysis at this scale affordable.

Root-cause analysis and outage prediction, not just alert prioritisation

For events that pass triage, the frontier-model layer does what an experienced on-call engineer would do when they see a cluster of related events: reasons about likely root cause given the pattern of events, their timing, and the systems involved, and — where the pattern matches known precursors — predicts that an outage is developing before it actually occurs. The output is a prioritised, root-caused, and where applicable predictive alert, with a natural-language summary an on-call engineer can act on immediately rather than starting investigation from raw event data.