When something breaks on a large network, the alerts arrive from every direction. Routers, firewalls, cloud gateways, and applications each report their own symptoms. The evidence that explains the incident is scattered across anomalies, configuration changes, topology, and past incidents, and an engineer has to piece it together by hand.
Loom is the correlation and root cause agent in Selector Foundry, the agentic NetOps platform built on Selector’s existing AIOps and Observability platform. Loom gathers that scattered evidence into one connected incident, shows what changed, what it touched, which signals belong together, and what to investigate next.
How Loom works
Loom builds on the correlation work Selector’s data platform already performs. Selector collects telemetry from more than 300 sources and normalizes it into one model. Self-supervised models score every time series for anomalies, and small language models read what each log line means. Loom works from that refined signal.
Loom then connects the evidence in a deliberate order:
- Correlate. Anomalies are grouped by real overlap in time and topology, so related signals across domains collapse into one incident. Correlation runs before any cause is assigned.
- Separate cause from symptom. A causation hierarchy informed by topology distinguishes the causal fault from the downstream effects it produced.
- Reconstruct the incident. Loom builds the timeline, maps the blast radius, and assembles the evidence trail behind each finding.
- Recommend the next step. Loom suggests remediation and flags emerging risks before they escalate.
Every finding links back to its source, whether that is a telemetry series, a configuration diff, or a topology relationship. Engineers can check every conclusion against the data behind it.
Background mode and handoffs
Loom works in two modes. An engineer can ask Rosetta to deep-dive an incident, and Rosetta brings Loom in. Loom also runs in the background: when an incident fires, it starts correlating immediately, with no prompt and no page.
Its findings become the starting context for the rest of Selector Foundry. TicketMaster opens the ticket with Loom’s root cause attached. Herald writes the update from Loom’s verified record. Rosetta answers questions from the incident story Loom has already built.
An overnight incident with Loom
Here is how an incident might unfold when a configuration push takes down 10 routers overnight.
| Time | What happens |
| 02:37 | An anomaly fires. Loom opens the case without a prompt. |
| 02:41 | Loom resolves the full path and topology and pulls in change history. |
| 02:42 | Loom identifies the root cause: a configuration push six minutes before the first anomaly, correlated across telemetry, configuration, and topology. |
| 02:48 | A rollback is prepared, and TicketMaster updates the incident record. |
| 06:15 | The on-call engineer arrives. The root cause, the evidence, and the drafted rollback are waiting for approval. |
Nothing executes without a human. The rollback runs only when the engineer approves it.
The foundation for every agent
Loom turns an alert storm into one incident with a named cause, a mapped blast radius, and evidence an engineer can check. Because the rest of Selector Foundry starts from that work, every downstream action, ticket, and report rests on the same verified story.
To try Loom for yourself, check out our interactive demo.
Stay Connected
Selector is helping organizations move beyond legacy complexity toward clarity, intelligence, and control. Stay ahead of what’s next in observability and AI for network operations:
- Subscribe to our newsletter for the latest insights, product updates, and industry perspectives.
- Follow us on YouTube for demos, expert discussions, and event recaps.
- Connect with us on LinkedIn for thought leadership and community updates.
- Join the conversation on X for real-time commentary and product news.
