AI Intelligence Layer
TechForcz does not "send your metrics to an AI." It runs a two-layer pipeline: cheap, fast machine learning watches everything and compresses the firehose down to a few real incidents; then a large language model reasons over only those few incidents the way a senior engineer would, gathering evidence, naming the root cause, and proposing (or, when safe, applying) a fix. This page is the mental model for that pipeline, because every design choice below follows from one idea: ML is the eyes, the LLM is the brain, and the eyes must work before the brain is worth waking up.
Source of truth. Everything described on this page reflects the running platform, not a roadmap. Where a capability ships disabled or is a configuration choice, the page says so plainly.
1. The one idea: ML feeds the LLM
A medium network emits on the order of a million datapoints per minute. You cannot hand that to a language model: it would be ruinously slow and expensive. But you also cannot ask classical ML to explain a failure in English, weigh a config change against a BGP flap, or write a remediation plan. So TechForcz uses each layer for what it is good at, in a fixed order.
Read the funnel left-to-right as a series of reductions: a million datapoints become ~200 statistical anomalies, ~200 anomalies become ~5 correlated incidents, and each incident is packaged with everything needed to understand it before a single token is spent on reasoning. The LLM only ever sees the narrow end of the funnel.
Think of a hospital. Cheap, always-on sensors (heart-rate, temperature) watch every patient continuously, and that is the ML layer. They don't diagnose; they just flag "this one looks off." Only then does an expensive specialist (the LLM) walk over, read the chart, order a couple of targeted tests, and make the call. You would never pay a specialist to stare at every heartbeat of every patient all day, and you would never let the cheap sensor perform surgery. TechForcz wires the two together in exactly that order.
This is also the pattern every serious AIOps product converges on (Dynatrace Davis, BigPanda, Elastic, ServiceNow): classical ML for detection and noise-reduction, generative AI for reasoning and explanation. Nobody pipes the raw stream into a language model.
2. Why the ordering saves money
Because the LLM only ever touches a correlated incident (never the raw stream), the reasoning cost per incident stays low. The detection and correlation layers cost effectively nothing per event (they are Python doing arithmetic on a stream), a cheaper model resolves most incidents, and a stronger model is called in only for the few the cheaper model is unsure about.
If you skipped the ML layer and streamed raw metrics into an LLM, the bill would be enormous and the answers would actually get worse, because the model would drown in noise. The ML layer isn't just a cost optimisation; it's what makes the LLM accurate, because by the time the brain wakes up it is looking at one clean problem instead of a million numbers. Cheap-and-dumb first, expensive-and-smart last.
3. The seven layers, end to end
The pipeline is built as seven cooperating layers. The first two are the "eyes" (statistical anomaly detection and correlation); the rest are the "brain" (a budget-capped LLM triage agent with retrieval over past incidents and runbooks).
| # | Layer | In one sentence | Where it runs |
|---|---|---|---|
| 1 | Signal processing | Detect anomalies in metric streams and keep a running sense of "normal". | SaaS cloud |
| 2 | Correlation & incident formation | Group related anomalies/alerts into one incident per root cause. | SaaS cloud + edge |
| 3 | Context Pack Builder | Assemble everything the LLM needs to diagnose one incident, with no LLM calls. | SaaS cloud |
| 4 | LLM triage agent | Reason over the incident: gather evidence, name the cause, plan a fix. | SaaS cloud (LangGraph) |
| 5 | RAG knowledge base | Remember past fixes so the system gets smarter over time. | SaaS cloud vector store (pgvector) |
| 6 | Gated remediation | Safely apply an approved fix, or escalate to a human. | SaaS cloud (deterministic executor) |
| 7 | Learning loop | Turn every closed incident back into knowledge for the next one. | SaaS cloud |
4. What is built today, and what is configurable
This table is deliberately honest: it reflects the running code, not a roadmap.
| Capability | Status | Notes |
|---|---|---|
| Anomaly detection (Isolation Forest, Z-score, EWMA, IQR) | ✅ Built | All four selectable; IQR is fully implemented. |
| Persistent baselines + 24h re-fit / drift | ✅ Built | Redis-backed; survives restarts. |
| Prophet capacity forecasting (+ edge→cloud bridge) | ✅ Built | Edge borrows cloud Prophet on Enterprise; NumPy fallback offline. |
| Graph correlation + canonical Incident contract | ✅ Built | One typed Incident is the hand-off to the brain. |
| Context Pack Builder | ✅ Built | Resilient (empty section on failure). |
| LLM triage agent (LangGraph 5-stage) | ✅ Built | Read-only evidence tools; Postgres checkpointing. |
| RAG knowledge base + learning loop | ✅ Built | pgvector, tenant-isolated; embeds closed incidents. |
| LLM provider | ⚙️ Configurable | Choice of a production model provider or a development provider. |
| Auto-remediation (write tools) | ⛔ Off by default | Ships disabled until validated in production. |
Two choices matter most. The provider picks the brain: a production-grade model for production, or a development model when you only have a development key. The write tools are the safety lock on the hands: they are off by default, so out of the box the agent diagnoses and recommends but never touches a device. You turn them on deliberately, only after the read-only agent has earned trust on real incidents.
5. Multi-tenancy is never optional
Everything in the AI layer is scoped by tenant_id. The knowledge base is protected by PostgreSQL Row-Level Security, so one customer's past incidents and runbooks can never surface in another customer's RAG results. LLM spend is budget-capped both per incident and per tenant, enforced in code in the LLM gateway rather than left to the model. The hard tenant boundary that runs through the whole platform (described in Security & Compliance) is carried all the way into the AI layer.
Where to go next
The "eyes" of the pipeline, statistical anomaly detection and correlation, turn raw telemetry into a clean, correlated incident. The "brain", a budget-capped LLM triage agent with retrieval over past incidents and runbooks, then turns that incident into a diagnosis and a safe fix. For the platform topology these layers sit inside, see Platform Architecture.