The hardest problem in network alerting isn't detection — it's definition. What counts as abnormal for a backup circuit is business-as-usual for a core uplink. A wiring closet in Phoenix runs hotter than one in Portland. Any system that applies one rule to both is guaranteed to be wrong somewhere.
The Ntuition Engine is our answer, and it sits at the heart of Ntrospect.
Baselines, per everything
Ntuition continuously builds statistical baselines for the signals Ntrospect collects — interface throughput and error rates, device health metrics, environmental sensor readings, log volumes, flow patterns. Crucially, baselines are learned per entity and per time context: this interface, at this hour, on this day of the week.
That context-awareness is what kills the classic false positives. Monday morning's traffic surge doesn't trip anything, because Monday mornings always look like that. The same surge at 3am Sunday scores very differently.
Anomalies are evidence, not alarms
When a signal departs from its baseline, Ntuition records an anomaly with a severity score — how far outside normal, for how long. Individually, most anomalies are trivia. A brief error burst on one interface isn't worth a human's attention.
The value compounds when anomalies cluster. A temperature sensor drifting high, then fan-error log messages, then climbing interface errors on the same switch — three signals, three data sources, one device, one time window. That cluster is no longer trivia; it's a narrative. Ntrospect surfaces these clusters on a shared timeline so the pattern is visible at a glance, and feeds them into evaluations for root-cause analysis.
Tunable, not opaque
Machine-learned baselines shouldn't mean take-it-or-leave-it. In Ntrospect's settings, the Ntuition Engine exposes its knobs: detection sensitivity, which signal families to model, and how anomalies feed into alerting. Teams that want conservative paging can require sustained deviations; teams hunting early warnings can run it hot on selected sites.
Why "engine," not "AI feature"
We deliberately built Ntuition as the platform's core rather than a bolt-on badge. Anomaly scoring informs which alerts fire, how incidents group, and where root-cause evaluations start looking. The goal isn't a system that replaces your judgment — it's one that hands you the three signals that matter out of the ten thousand that don't, and shows its work every time.