always watching ✦
In Active Development
Case Study | 13

Our
AI Sarah
Net Monitoring

An AI-powered network monitoring assistant that watches your entire infrastructure, explains anomalies in plain English, and recommends actions before small issues become outages. Sarah doesn't just alert | she tells you what it means and what to do next.

View Screenshots ↓
Client
Internal / SaaS
Kodari product
Status
2026
In development
Category
AI · Network Ops
AI Agent + Dashboard
Key Feature
Sarah AI
Natural language alerts
sarah / net / dashboard
🌐
Network Overview Dashboard | Hero Screenshot
Drop the main dashboard screenshot here
+ Add Screenshot
The Problem

Logs nobody reads, alerts nobody understands.

Most network monitoring tools produce walls of data | raw logs, threshold alerts, traffic graphs | but none of it explains what's actually happening or what to do. Engineers get paged at 2am for a Zabbix alert that says "ICMP timeout on 192.168.1.44" and then spend 30 minutes figuring out if it even matters.

The problem isn't lack of data. It's that the tools speak machine, not human. Teams end up ignoring most alerts because they can't keep up with the noise, and real incidents slip through.

The Solution

An AI that speaks to you, not at you.

  • Sarah AI engine | an LLM-powered assistant that reads your network telemetry and explains what's happening in plain English, in real time
  • 🔔
    Smart alert triage | Sarah correlates related alerts, filters noise, and surfaces only what actually needs your attention, with context
  • 🗺️
    Live topology map | visual, interactive graph of your entire network with real-time health status per node and per link
  • 💬
    Natural language queries | ask Sarah "which switches had packet loss yesterday?" and get a direct answer, not a query builder
  • 📊
    Traffic analysis | bandwidth trends, top talkers, unusual flow patterns | all surfaced automatically with AI commentary on anomalies
24/7
Always-On Network Watch
AI.
Powered Alerts | Plain English Explanations
1×
Question to Sarah | Full Network Status
What Sarah Does

Core capabilities.

AI Alert Engine

Sarah reads incoming telemetry, correlates events across devices, suppresses noise, and writes a human-readable incident brief for every real issue.

🗺️

Network Topology

Live, interactive map of every node, switch, router, and link. Color-coded by health. Click any device to see Sarah's latest status assessment.

📈

Traffic Analysis

Bandwidth consumption per interface over time. Top talkers, protocol breakdown, anomaly detection, and AI commentary when patterns deviate from baseline.

💬

Sarah Chat

Ask anything about your network in natural language. Sarah queries the telemetry database, interprets the results, and answers directly | no SQL, no filters, no dashboards.

Platform Screens

Every screen,
one AI behind it.

From the live network overview to the Sarah chat panel | every view is powered by the same AI engine, giving every engineer on your team the same situational awareness as your most experienced network admin.

sarah / net / dashboard
🌐
Network Overview Dashboard
Screenshot coming soon
+ Add Screenshot
Screen 01 / Dashboard

Network Overview

The command center. Total devices, live alert count, uptime percentage, and Sarah's current network health summary at the top | then the full topology map below. One view, full picture.

Live View AI Summary
sarah / net / chat
💬
Sarah AI Chat
Screenshot coming soon
+ Add Screenshot
Screen 02 / Chat

Sarah Chat Panel

The natural language interface. Ask "What's causing the latency on Floor 3?" or "Which devices haven't been seen in 24 hours?" | Sarah pulls from live telemetry and answers directly, with source references.

Natural Language LLM-Powered
sarah / net / alerts
🔔
Alert Feed
Screenshot coming soon
+ Add Screenshot
Screen 03 / Alerts

Live Alert Feed

Prioritized, AI-triaged alert list. Each alert comes with Sarah's brief | what triggered it, what it likely means, and a recommended action. No raw SNMP OIDs, no threshold strings, just context.

AI-Triaged
sarah / net / topology
🗺️
Topology Map
Screenshot coming soon
+ Add Screenshot
Screen 04 / Topology

Network Topology Map

Interactive graph of your entire network. Nodes colored by health status | green/yellow/red. Click any device to open Sarah's current assessment: uptime, recent events, linked alerts.

Interactive
sarah / net / traffic
📊
Traffic Analysis
Screenshot coming soon
+ Add Screenshot
Screen 05 / Traffic

Traffic Analysis

Bandwidth charts per interface, top talkers ranked by volume, protocol distribution, and anomaly highlights. Sarah auto-annotates the graph when a spike or pattern shift warrants attention.

Anomaly Detection
sarah / net / device / [id]
🖥️
Device Detail
Screenshot coming soon
+ Add Screenshot
Screen 06 / Device

Device Detail Panel

Deep-dive on any single device | interfaces, uptime history, last 100 events, open alerts, and a Sarah context block explaining the device's current state and recent behavior patterns.

Per-Device
sarah / net / incidents
📝
Incident Reports
Screenshot coming soon
+ Add Screenshot
Screen 07 / Incidents

AI-Generated Incident Reports

When an incident resolves, Sarah auto-generates a post-incident report: timeline of events, root cause analysis, affected devices, and recommended follow-up actions. Human-readable, shareable, exportable | no manual write-up needed.

Auto-Generated RCA PDF Export
Under the Hood

How Sarah is built.

⚛️

React + Vite

Fast, responsive frontend with live topology graph (D3/Force), real-time alert feed, and Sarah's chat interface | all reactive and socket-driven.

🟢

Node.js + Socket.io

Event-driven backend ingesting SNMP traps, ICMP polls, syslog, and NetFlow. WebSocket push to the frontend for sub-second alert delivery.

LLM / AI Layer

Sarah's intelligence layer | processes telemetry context, generates natural language explanations, handles chat queries, and writes incident reports autonomously.

🐘

PostgreSQL + TimescaleDB

Time-series optimized storage for network metrics, event logs, and alert history. Supports Sarah's historical query answering with millisecond indexed lookups.

DTR System | ZTK View All Work