<- Back to featured projects

Draft Case Study

Azure AIOps - Intelligent Incident Detection and Root Cause Analysis

Operations teams need faster triage for noisy incidents across applications and infrastructure without relying on unsupported autonomous remediation claims.

AIOpsAzure MonitorLog AnalyticsApplication InsightsAzure FunctionsAzure OpenAI

Problem

Operations teams need faster triage for noisy incidents across applications and infrastructure without relying on unsupported autonomous remediation claims.

Architecture

Reference architecture (proposed): Azure Monitor, Log Analytics, and Application Insights feed correlated signals into an Azure Functions orchestration layer. Azure OpenAI is used to generate operator-facing incident summaries and probable-cause hypotheses, with integration adapters for Azure DevOps or ServiceNow ticket workflows.

MonitorCorrelateAI SummaryITSM/DevOps
Reference architecture diagram showing telemetry ingestion, AI-assisted incident analysis, and operational tool integration.

Reference/proposed architecture diagram for portfolio demonstration. Not a client production architecture.

Architecture Explorer

AIOps Incident Intelligence: Correlated telemetry with advisory probable-cause context.

Reference

Data flow: Telemetry events correlate into incidents, advisory AI summaries enrich context, and responders approve actions.

Accessible alternative: use the component buttons below to inspect architecture details without zoom.

Legend

  • Ingress / Trigger
  • Orchestration
  • Data / Storage
  • Security
  • Observability
  • Operations
  • Azure Monitor Signals ~> Incident Correlation (alert signals)
  • Log and App Signals ~> Incident Correlation (context signals)
  • Incident Correlation -> Advisory Summary (incident context)
  • Incident Correlation -> Incident Workflow (ticket payload)
  • Advisory Summary -> Incident Workflow (advisory summary)

Component Details

Azure Monitor Signals

Collect infrastructure and service metrics.

Responsibilities: Metric stream | Alert triggers

Security controls: Read-scoped telemetry identities

Dependencies: Incident Correlation

Design decisions: Correlation first to reduce duplicate incident noise.

Security

Reference security model uses managed identity, least-privilege access to telemetry stores, prompt/input sanitization, and role-based access controls for incident tooling. AI-generated content is logged for traceability and reviewer accountability.

Verified Outcomes

  • Reference design for portfolio demonstration; no client production deployment claim.
  • Draft: improved incident context packaging for human responders in triage workflows.
  • Draft: consistent escalation path through Azure DevOps or ServiceNow integration patterns.

Interactive Demo

Explore a local technical simulation with deterministic logic, explainable state transitions, and no live cloud integration.

Try Interactive Demo

Design Decisions

  • Use correlation-first incident grouping before AI summarization to reduce duplicate ticket noise.
  • Keep AI outputs as advisory context for responders, not autonomous production actions.
  • Route actionable incidents into existing Azure DevOps/ServiceNow processes to preserve governance and auditability.

Implementation

  • Collect platform and application signals from Azure Monitor, Application Insights, and Log Analytics workspaces.
  • Trigger Azure Functions workflows on threshold and pattern-based alerts for incident normalization.
  • Generate draft summaries and probable-cause analysis with Azure OpenAI, then append them to incident records.
  • Require human review/approval gates before any remediation runbook is invoked in production environments.

Trade-offs

  • Correlation quality depends on telemetry hygiene and standardized signal naming.
  • AI summaries can improve triage speed but still require operator validation to avoid incorrect assumptions.
  • Approval gates increase control and safety while adding response latency in urgent events.

Engineering Evidence

Implemented demo evidence

Architecture Evidence

Diagram classification: Reference

Sanitized data flow: Monitor and log signals correlate into incidents, advisory summaries enrich responder context, and workflow approvals gate remediation actions.

Diagram source id: azure-aiops-incident-intelligence

Linked Demo Routes

Automated Tests and Results

  • Correlation rules, lifecycle transitions, and remediation approval gating

    tests/aiops-incident-lab.test.ts

  • Architecture explorer rendering and diagram model coverage

    tests/architecture-explorer.test.ts

Latest test run (2026-09-26): Automated tests passed for pipeline simulator logic, AIOps incident lab logic, architecture explorer coverage, project evidence integrity checks, and Landing Zone IaC artifact checks.

Command: node_modules/.bin/tsc.cmd -p tsconfig.test.json && node --test .test-dist/tests/**/*.test.js

Latest build run (2026-09-26): Production build completed successfully with prerendered case-study routes and both interactive demo routes.

Command: node_modules/.bin/next.cmd build

Limitations and Verification Gaps

  • Evidence is for a local deterministic simulation and advisory workflow, not live Azure telemetry ingestion.
  • No production incident-management integration logs are included.

Evidence Pending

  • Manual verification needed for operational integrations (for example ticketing/workflow systems) outside this repository.

Evidence Status

  • Local checks: Local demo logic and unit tests executed in repository.
  • CI checks: Uses repository test/build checks; no external cloud credentials required.
  • Azure deployment: Not performed / Evidence pending.

Reproduction and Dependencies

Dependencies

  • Node.js (current project uses Next.js 16.x, React 19.x, TypeScript 6.x)
  • npm install
  • Local binaries under node_modules/.bin for lint/typecheck/test/build

Reproduction steps

  1. npm install
  2. node_modules/.bin/tsc.cmd -p tsconfig.test.json
  3. node --test .test-dist/tests/**/*.test.js
  4. node_modules/.bin/next.cmd build