See Selector in action

See Selector in Action

Technical comparison

Selector vs. Amazon CloudWatch

Observability and Event Intelligence Use Cases

October 2026

Article content

How each platform builds operational context

Selector collects raw telemetry and operational context together from every vendor, normalizes and enriches it before any model runs, and establishes causation with purpose-built ML before agents act. Amazon CloudWatch is AWS’s native monitoring service for AWS resources and applications, with metrics, logs, alarms, Application Signals, and network monitoring features, plus AI-assisted investigations for AWS environments.

Foundry agents

Rosetta, Loom, TicketMaster, Artist, Herald, Sculptor; MCP and A2A.

Collaboration

Natural language, dashboards, ChatOps, ITSM workflows, query-backed APIs.

Knowledge

Anomaly detection, correlation, causation, forecasting, knowledge graph.

Data Hypervisor

ML schema inference, enrichment, ELT raw preservation, routing.

Collection

Horizontal engines near the source; push and pull; independent scaling.

Sources

Any vendor’s devices, cloud, CMDB, IPAM, ITSM, tools, and files.

AI investigations

AI-assisted operational investigations for AWS resources.

Alarms and insights

Alarms, composite alarms, anomaly detection, Contributor Insights.

Application Signals

Application performance and SLOs for AWS workloads.

Metrics and logs

CloudWatch Metrics and Logs; Logs Insights queries.

Network monitoring

Internet Monitor, Network Monitor, Network Flow Monitor; VPC Flow Logs.

Sources

AWS services, CloudWatch agent, and OpenTelemetry.

Where CloudWatch falls short architecturally:

AWS-scoped: CloudWatch is built for AWS resources. On-premises networks, other clouds, and non-AWS devices sit outside its native scope. Selector correlates every vendor and environment.

Alarm-based correlation: Composite alarms and AI investigations work over AWS signals. Selector determines cause across hybrid network, cloud, and application data.

No device-level network telemetry: CloudWatch does not collect SNMP, gNMI, BMP, or configuration from customer network devices. Selector does.

Use case 1: Observability

Multivendor data collection

CloudWatch has deep, native AWS coverage. Selector adds the on-premises, multivendor network and other clouds, correlated with AWS in one model.
Data type
Metrics
AWS service metrics; CloudWatch agent for hosts. SNMP and gNMI from network devices not described.
SNMP, gNMI and model-driven streaming telemetry, Prometheus-compatible sources, REST APIs.
Logs
CloudWatch Logs and Logs Insights.
Syslog from any device, infrastructure, or application, structured by ML; Splunk, Logstash, TACACS.
Flow
VPC Flow Logs and Network Flow Monitor for AWS. On-premises flow not described.
NetFlow, sFlow, IPFIX from devices or collectors, enriched with application, owner, and criticality.
Routing
BGP, BMP, and IGP from customer devices not described.
BGP, BMP/OBMP, and IGP state ingested from customer devices.
Configuration
AWS Config for AWS resources. Network device configuration not described.
Running and intended config via NETCONF and CLI; drift correlated with impact.
Topology
Application Signals and AWS resource maps.
From SNMP, CDP/LLDP, configuration, and telemetry, across all vendors; digital twin.
Context
AWS tags and resource groups.
ServiceNow CMDB, NetBox, Nautobot, Infoblox; owner, site, circuit, criticality.
Hybrid & multicloud
AWS native. Azure, Google Cloud, and on-premises correlation not described.
AWS, Azure, Google Cloud APIs, flow logs, transit gateways, VPCs, correlated with on-prem.
Digital experience
Synthetics canaries, RUM, Internet Monitor.
ICMP and UDP probes, ThousandEyes, traceroute, custom tests.
Files / streams
Log and metric ingestion APIs.
Kafka, CSV, Excel, Google Sheets.

CloudWatch gaps

Device-level telemetry from on-premises networks not collected.

Other clouds and on-premises environments outside native scope.

Routing protocol analytics not available.

Selector value

Streaming telemetry, flow, routing, configuration, and context from any vendor in one pipeline.

Routing changes tied to the services they affect, from BMP and IGP state on the customer’s own devices.

Ingestion from files and streams for data with no API.

Use case 1: Observability

Data normalization and enrichment

Selector normalizes and enriches every signal from every environment. CloudWatch structures AWS data around AWS resources and tags.
Capability
Schema inference
Logs Insights field discovery for structured logs. ML schema inference for network device logs not described.
ML infers structure from free-form logs, syslog, traps, and CLI output; no parsing templates.
Entity resolution
AWS resources and services.
Named-entity and clustering models group events across vendor and format variations.
Enrichment
AWS tags and resource metadata.
Topology, dependency, owner, site, maintenance state, and criticality added before analysis.
Data fidelity
Retention per metric resolution and log group. Network state replay not described.
ELT: raw data lands with original timestamps; transformation follows.
Noise suppression
Composite alarms and alarm suppression.
Duplicate, flapping, and irrelevant signals removed before the intelligence layer.
Business logic
Alarm actions and suppression windows.
Maintenance windows, provider notices, suppression, and criticality in YAML via DevOps workflows.
Customization
Custom metrics, metric math, and dashboards.
S2ML tunes enrichment, labeling, noise rules, prioritization, and LLM output.
Data access
APIs and Logs Insights.
Every view is a query and can be exposed as an API endpoint; MCP server.

CloudWatch gaps

Context limited to AWS tags and resources.

Log parsing relies on authored queries.

Network state replay not described.

Selector value

Learned normalization: no parsing templates or rules to maintain.

Raw records retained with original timestamps for replay and re-analysis.

One enrichment layer applies topology, ownership, maintenance, and criticality to every signal.

Use case 1: Observability

AI-powered operational analytics

Both apply machine learning to metrics. CloudWatch is scoped to AWS; Selector correlates AWS with the rest of the estate.

Capability
Anomaly detection
CloudWatch anomaly detection bands on metrics.
Self-supervised, statistical, and regression models. A model per time series, retrained every 30 minutes, with seasonality.
Log analysis
Logs Insights and log anomaly detection.
Small language models. Log semantics interpreted, clustered across vendors, and turned into structured events.
Prediction
Anomaly bands and forecasting on AWS metrics. Optical failure prediction not applicable.
Forecasting and predictive models. Capacity forecasting and optical transceiver failure prediction.
Cross-domain analysis
Across AWS services.
One model across domains. Correlation runs automatically across network, cloud, and application signals.
Natural language
Natural-language query generation and AI investigations.
Rosetta. Plain-language questions answered with every claim linked to source data.

CloudWatch gaps

Analysis scoped to AWS signals.

Hybrid cross-domain correlation not described.

Optical failure prediction not applicable.

Selector value

Per-series models retrained every 30 minutes detect anomalies no threshold would catch.

Automatic correlation across network, cloud, and application signals in one model.

Optical failure prediction and capacity forecasting before impact.

Use case 2: Event intelligence

Event correlation and root cause

CloudWatch correlates and investigates within AWS. Selector determines cause across AWS, other clouds, and the on-premises network together.
Capability
Inputs
CloudWatch alarms and AWS signals.
Alerts and the raw telemetry, logs, flow, and configuration behind them, correlated together.
Correlation method
Composite alarms; AI investigations over AWS telemetry.
Contextual embeddings and clustering by shared devices, interfaces, IP addresses, topology, and time.
Noise reduction
Composite alarms and suppression.
Up to 99.9% of irrelevant noise removed before correlation.
Root cause
AI-assisted investigation hypotheses for AWS. Deterministic hybrid causation not described.
Deterministic causation from topology and domain logic: reboot, then link failure, then BGP flap.
Symptom vs. cause
Not described in CloudWatch materials.
Downstream effects labeled as consequences, not separate faults, across every domain.
Change correlation
AWS CloudTrail and Config change data.
Configuration diffs and change events correlated directly with degradation.
Evidence and replay
Investigation notes and logs. Network state replay not described.
Every finding links to source data; Network DVR replays past network state.

Selector example

The Loom agent resolved 214 alerts across six tools to a single fiber cut on one long-haul span, labeled routing reconvergence and cloud failover as consequences, and flagged the secondary path at 78% utilization as the next risk.

Where CloudWatch stops

CloudWatch can show an AWS service degrading. When the cause is a carrier circuit or on-premises device feeding a Direct Connect link, it sits outside CloudWatch’s view.

CloudWatch gaps

Correlation centers on AWS alarms and signals.

A deterministic causation model across hybrid environments is not described.

Network state replay not described.

Selector value

Alert floods collapse into one incident with a named cause, consequences, and next risk.

Telemetry, logs, flow, and configuration correlated with alerts in one model.

Every finding is traceable and reproducible with Network DVR.

Use case 2: Event intelligence

Agents, ITSM, and governed action

Function
Amazon CloudWatch
Foundry
Investigation
AI-assisted investigations for AWS resources.
Rosetta. Interprets plain-language intent, dispatches agents across domains, returns one cited thread.
Correlation / RCA
Composite alarms and investigations.
Loom. Connects time, topology, changes, and domains into one incident with a root cause.
ITSM
Integrations through AWS services and partners.
TicketMaster. Bi-directional ServiceNow sync across the lifecycle, with per-customer field mapping and incident-aware deduplication.
Communications
Notifications through Amazon SNS.
Herald. Executive briefs, ops updates, and post-incident reports from the verified record.
Custom agents
Governed agents built from described playbooks not described.
Sculptor. Turns a described playbook into a governed agent with goal, tools, triggers, and approval points.
Action
Alarm actions and Systems Manager automation.
Agents investigate, act, and verify within operator-set limits on high-confidence findings.
MCP
AWS MCP servers for AWS services.
Production MCP server with OAuth2, granular RBAC over insights, recommendations, and actions.
Deployment
AWS service.
SaaS, on-premises, customer cloud, or air-gapped.

CloudWatch gaps

AI investigations scoped to AWS.

Customer-defined governed agents from playbooks not described.

Runs only as an AWS service.

Selector value

Sculptor builds governed agents from the team’s own playbooks, acting only on verified findings.

MCP server shares insights and governed actions with other agent platforms.

Every Foundry agent is available now, in every deployment model.

Functionality gained with Selector

Capabilities a CloudWatch customer adds with Selector, whether Selector runs alongside CloudWatch or replaces it.

1. AWS plus everything else

AWS signals correlated with on-premises networks, carriers, and other clouds in one model.

2. Deterministic diagnosis

Root cause comes from deterministic topology and domain models, so the same data yields the same answer.

3. Detection beyond thresholds

Per-series models retrained every 30 minutes find conditions no static threshold or rule would catch.

4. Streaming and routing depth

gNMI streaming telemetry and BMP/OBMP and IGP analytics from the customer’s own devices, plus optical failure prediction.

5. Full-fidelity history

Raw data preserved with original timestamps; Network DVR replays past network state so findings can be verified and re-run.

6. No templates to maintain

Learned normalization infers structure across vendors and formats, replacing parsing rules and custom collection scripts.

7. Your playbooks as agents

Sculptor turns the team’s own runbooks into governed agents with approved tools, triggers, approval points, and audit.

8. Governed action through MCP

Selector’s MCP server exposes insights, recommendations, and actions to other agent platforms under OAuth2 and RBAC.

9. Custom outcomes with engineers

Forward deployed engineers build integrations, data models, views, and agents on the customer’s own data.

10. No rip-and-replace

Selector ingests from AWS APIs and flow logs, adding hybrid root cause and governed agents above CloudWatch.

Selector patents driving innovation

The techniques that define the Selector platform are covered by Selector’s U.S. patent portfolio. Patent records are available on request.
Capability
What Selector’s patented approach delivers
Root cause analysis
Deterministic causation across every domain.
Reproducible investigations
Network DVR replays network state so an investigation can be re-run.
Log intelligence
Structured signal from any vendor’s syslog without parsing templates.
Conversational investigation
Learns each customer’s names for sites, services, and devices without manual labeling.
Custom outcomes on demand
Declarative query chains for drill-downs and customer-specific views.
Operational context
Maintenance-window-aware alerting and reporting.
Optical failure prediction
Flags failing optics before they cause an outage.
Capacity planning
Forecasts capacity limits before they affect services.
Scale
Efficient storage and querying of millions of data points per minute.

Selector vs. Amazon CloudWatch at a glance

Capability
Amazon CloudWatch
Observability
Data collection
Native AWS coverage.
Any vendor, including gNMI, BMP/IGP, flow, config, and file sources, in one pipeline.
Normalization
AWS resources and tags.
Learned schema inference; ELT raw preservation.
Detection
Anomaly bands on AWS metrics.
Per-series models retrained every 30 minutes.
Cross-domain analysis
Within AWS.
Automatic correlation in one model.
Event intelligence
Correlation
AWS alarms and signals.
Alerts plus the raw telemetry behind them.
Root cause
AI investigations for AWS.
Deterministic causation with symptom labeling.
Reproducibility
Investigation notes.
Network DVR replay; source-linked evidence.
Custom agents
Not described.
Sculptor builds governed agents from playbooks.
MCP
AWS MCP servers.
Server for insights, recommendations, and governed actions.
Deployment
AWS only.
SaaS, on-premises, or air-gapped.

The bottom line

Amazon CloudWatch is the native, deeply integrated monitoring service for AWS, with strong metrics, logs, alarms, and AI-assisted investigations for AWS workloads.

Selector is built for hybrid estates. It correlates AWS data with on-premises networks and other clouds in one model, determines cause deterministically, and puts governed agents on top, including agents built from your own playbooks.

30 min

Model retraining cycle

99.9%

Noise reduction

8x

Faster resolution per P1

Related resources

PingMesh: Finding What the Network Actually Delivered

Synthetic Monitoring and the One-Minute Outage

How Selector AI Collects SNMP Data