Independent full-stack project
NEXUS
Turning a stream of network alerts into an incident an operator can investigate.
The operational problem
An upstream failure can trigger alerts from multiple downstream devices. During my NOC work, understanding those relationships and communicating the scope of an incident were central to investigation. NEXUS brings that context into one workflow.
What I built
A Next.js and TypeScript interface backed by a Python/FastAPI intelligence engine and PostgreSQL. The project combines event correlation, topology-aware analysis, explainable confidence scoring and incident history.
From alert to investigation
01
Ingest
Network events arrive through an authenticated API or scripted simulations.
02
Correlate
Related events are grouped into incidents rather than handled as isolated alerts.
03
Investigate
Device dependencies help identify likely causes and distinguish observed impact from potential downstream impact.
04
Explain
Named scoring factors show the evidence behind a diagnosis; analysis revisions preserve how it changed.
05
Act
Operators review incidents, add notes and record lifecycle transitions.
Engineering decisions
Explainable rules. Confidence scores use named factors rather than an opaque prediction. Operators can inspect the evidence, and deterministic rules make behavior testable. The tradeoff is that the rules need deliberate refinement as scenarios become more complex.
Separate symptoms from causes. Topology analysis distinguishes an upstream failure from downstream symptoms, and separates observed impact from potential impact. Its conclusions depend on accurate device relationships.
Keep backend credentials on the server. Browser requests use an authenticated Next.js proxy to the internal FastAPI service. Signed sessions and viewer/operator/admin roles support access control.
Validation and scope
The repository includes backend tests for correlation, confidence scoring, topology, security and incident APIs, plus frontend tests. Nine scripted failure scenarios support repeatable exploration of the analysis workflow. These are project capabilities, not a claim of production deployment or measured business impact.
The next validation priorities are representative telemetry, comparison against known incident outcomes and measured performance under load. A topology-aware diagnosis remains an aid to operator investigation.
Inspect backend tests ↗