How Selector Cuts Alert Noise

In this demo, Selector takes 1,647 anomalies from a network’s logs, metrics, traps, and events and reduces them to four actionable incidents. The walkthrough covers each stage of the process:

• Anomalies: Selector records every unusual metric value, device event, and hyper event with its type, labels, description, correlation status, and timestamp.
• Correlated events: Machine learning groups anomalies that occur close together and share the same labels into a single event, complete with probable root cause, impact level, and event score.
• Incidents: Selector links related events by cause and effect, using device relationships and timing, and sends each incident to the ticketing system with its root cause attached.

The demo narrows to a five-minute window containing 98 anomalies across Ashburn Hub, Ashburn-DMVPN, and SJC-edge. A search for the device Ash-Hub-01 shows 88 of them sharing the same device, VRF, and BGP session, and Selector groups those into one event covering BGP peer flaps and VRF status changes. The demo then follows three events from nine hours earlier: two circuit availability drops between New York and Houston, and IS-IS and RSVP changes on the Houston core routers. The circuit dropped at 2:13:52 and the routing changes followed nine seconds later, so Selector marks the circuit drop as the probable root cause and the routing changes as its effects. The resulting incident lands in the ticketing system with the circuit, severity, grouped events, and root cause already recorded. The same logic produces the other three incidents, leaving the team with four tickets to investigate out of 1,647 anomalies.