Uploaded June 2026 | Updated September 2026, 1 week ago
Abstract
Network operators spend the majority of incident response time on investigation, not remediation. Runbooks, scripts, and alert-driven automation handle known failure modes well — but when the failure is novel, investigation remains manual, serial, and slow.
This talk presents a working agentic investigation system built on Azure that addresses the unknown-failure case. It demonstrates end-to-end network failure investigation including hop-by-hop topology discovery, protocol-level diagnostics across BGP, IKE Phase 1/2, and ExpressRoute, and a real production case where the agent detected a blackhole route from a deallocated firewall in under 35 seconds. The architecture combines large language model reasoning with structured tools (Azure CLI, Resource Graph, Network Watcher) and operator-authored skills written in Markdown.
The session covers four practical scenarios: live natural-language troubleshooting, scheduled monitoring with alert integration, topology discovery from minimal input, and protocol-level analysis for hybrid connectivity (ExpressRoute, VPN, vWAN). It also covers what doesn't work yet — read-only as the enterprise default, on-prem coverage requiring telemetry forwarding to Log Analytics, and human approval as a hard requirement before any write action.
Attendees will leave with a concrete picture of where agentic investigation fits in network operations today, what the integration boundaries look like, and how to evaluate whether this approach belongs in their own environments.
Mohibul Mahmud:
Mohibul Mahmud is a Support Engineer on the Azure Monitoring Enterprise team at Microsoft, based in Montreal, working with enterprise customers on observability across Azure Monitor, Log Analytics, Application Insights, and Container Insights. He has more than fifteen years of experience in network operations, cloud engineering, and enterprise support, including a decade leading network operations at BRACNet, one of Bangladesh's first commercial ISPs. Outside Microsoft, Mohibul is active in internet governance as an RSSAC Caucus member, NARALO representative to ICANN, ISOC Ontario board member, and lead of the VSIG Bengali localization initiative for Universal Acceptance.
nanog.org/events/nanog-97/content/5766
Abstract
Network operators spend the majority of incident response time on investigation, not remediation. Runbooks, scripts, and alert-driven automation handle known failure modes well — but when the failure is novel, investigation remains manual, serial, and slow.
This talk presents a working agentic investigation system built on Azure that addresses the unknown-failure case. It demonstrates end-to-end network failure investigation including hop-by-hop topology discovery, protocol-level diagnostics across BGP, IKE Phase 1/2, and ExpressRoute, and a real production case where the agent detected a blackhole route from a deallocated firewall in under 35 seconds. The architecture combines large language model reasoning with structured tools (Azure CLI, Resource Graph, Network Watcher) and operator-authored skills written in Markdown.
The session covers four practical scenarios: live natural-language troubleshooting, scheduled monitoring with alert integration, topology discovery from minimal input, and protocol-level analysis for hybrid connectivity (ExpressRoute, VPN, vWAN). It also covers what doesn't work yet — read-only as the enterprise default, on-prem coverage requiring telemetry forwarding to Log Analytics, and human approval as a hard requirement before any write action.
Attendees will leave with a concrete picture of where agentic investigation fits in network operations today, what the integration boundaries look like, and how to evaluate whether this approach belongs in their own environments.
Mohibul Mahmud:
Mohibul Mahmud is a Support Engineer on the Azure Monitoring Enterprise team at Microsoft, based in Montreal, working with enterprise customers on observability across Azure Monitor, Log Analytics, Application Insights, and Container Insights. He has more than fifteen years of experience in network operations, cloud engineering, and enterprise support, including a decade leading network operations at BRACNet, one of Bangladesh's first commercial ISPs. Outside Microsoft, Mohibul is active in internet governance as an RSSAC Caucus member, NARALO representative to ICANN, ISOC Ontario board member, and lead of the VSIG Bengali localization initiative for Universal Acceptance.
nanog.org/events/nanog-97/content/5766
