A network RCA should answer more than “what probably happened?” It should show what changed, where it changed, when it changed, why the proposed cause fits, what contradicts it, and what should be checked next.
Start with deterministic facts
Reachability, interface transitions, counter changes, routing-neighbor state, device resource health, topology edges, and configuration events are facts when their sources and timestamps are known. A deterministic rule can assemble these facts into a hypothesis without an AI provider.
Separate evidence from interpretation
An evidence row might say CRC errors increased before a link flap on both ends of a connection. “Failing optic or patch cable” is an interpretation. The interface should render them separately so the operator can accept the observation while challenging the conclusion.
Minimum fields for useful evidence
- Tenant and resource identity
- Source protocol or integration
- Event time and ingest time
- Previous and current state
- Unit, threshold, and observation window
- Raw-source reference or normalized values
- Freshness and data-quality status
Confidence should explain itself
A numeric score without contributing factors is hard to trust. Confidence should identify supporting and contradicting signals, missing inputs, and whether the topology relationship is observed, configured, or inferred.
AI can enrich, but should not become the evidence
An AI model can summarize an incident or suggest additional checks. It should not silently invent device state or replace deterministic evidence. The system should still produce a useful RCA when AI access is absent, and the UI should say when enrichment is unavailable.
Recovery is part of diagnosis
If the proposed upstream cause recovers, dependent symptoms should recover in a compatible sequence. Recovery evidence strengthens the hypothesis. If downstream symptoms persist, the incident may contain another cause or the original hypothesis may be wrong.
Recommended next steps should remain conditional
“Replace the optic” is too strong if DOM values were never collected. A safer recommendation is to inspect optic levels, compare both ends, reseat or replace if evidence supports it, then clear counters and observe. The recommendation should name missing evidence.
Questions for an RCA evaluation
- Can the RCA run without an external AI provider?
- Can each evidence item be traced to a source?
- Are event time and ingest time separate?
- Does missing telemetry appear as unavailable?
- Can the operator see contradictory signals?
- Does the recommendation say whether it was executed?
Read the AssureMesh evidence methodology or review common questions, or request a demo.