Collect and transform
From the whole stack — legacy and modern, hardware and software, across domains. The agent chooses what to gather, how to parse it, and how to shape it into the lake.
collect from vast variety of telemetry sources :modern softwarelegacy deviceshigh-volume infrastructuremodern devicesmodern infrastructurelegacy infrastructurehigh-volume softwarehigh-volume hardwareany vendorany formatcross-domaincross-stack
One telemetry lake.
Built for agentic automation.
When uptime is revenue, telemetry has to be live ground truth — logs, metrics, network, OT, apps and agents — so you can correlate failures fast and automate safely. 100% on-prem.
infra-ops-agent · ffwd-mcp · on-prem
live
>
deploy ffwd uc: syslog+snmp switches, gpu on ai rack
provisioning universal collector · snmp + dcgm
Collector deployment → telemetry lake
uc-net-07
syslog+snmp
OK
udp/514 · legacy-switches/* · attached
uc-gpu-03
dcgm
OK
nvidia gpu · ai-rack-07 · 8× H100 · attached
streaming to ffwd · 0 backlog
→ destination
FFWD Telemetry Lake · Iceberg (long-term)
>
why is splunk ingest up 38% this week?
querying flow stats via ffwd · 7d window
Ingest by source → splunk
Burst alarms · edge-rtr-04
06:12:03
edge-rtr-04
WARN
LinkDown · ge-0/0/7
06:12:09
edge-rtr-04
WARN
LinkUp · ge-0/0/7
06:12:14
edge-rtr-04
WARN
LinkDown · ge-0/0/7
… clustered ×41,208 in 6h 28m
⚠ root cause
interface flapping · ge-0/0/7
>
cut splunk ingest 70% — keep all security signal
profiling firewall-logs · 7d · 312 patterns → T7
step 0 · dedupe
measured −19%
⚠ auth_failure excluded · repeat count = brute-force signal
step 1 · tag at UC edge
crit high med low noise
step 2 · reduce at sink
shortfall only
step 3 · delete tags
raw logs stay raw
VERIFY
ingest ✓
parse ✓
egress ✓
content ✓
symptomatic
1,284 → 1,284
flat ✓
ⓘ 70% would cut crit/high — achievable 58%
✓ applied 58% · full copy retained in FFWD · rollback armed
>
reset ge-0/0/7 on edge-rtr-04 to stop the flapping
executing via ffwd · risk evaluation
Action plan · destructive
[1/3]
resolving edge-rtr-04
✓
[2/3]
connecting as net-operator
✓
[3/3]
issuing interface reset
⛔
Blocked by FFWD safety gate
production change window · requires human approval
Telemetry Lake
Agents trace logs at machine speed. They need data that can keep up.
Observability grew up around dashboards and metrics, because a person cannot read terabytes of logs. Agents turn that around. A number on a chart does not tell them what to do. They trace the log, and they act.
Filter the signal
Terabytes come in. Anomaly detection and filter rules keep the useful signal in fast, short-term storage, so agents act now instead of reading the raw lake.
Fully agentic
More than MCP tools on top. Agents configure collection and trace the cause themselves. Older history moves to low-cost Iceberg storage and stays queryable.
Agents move fast and shorten the time to recovery.
See the telemetry lake →Telemetry Pipeline
The pipeline that the lake relies on.
This is the building block of FFWD. It collects at TB/hr scale, and AI agents can operate it directly. Log reduction cuts the volume — and the bill — before they reach an expensive system like Splunk.
TB/hrClaude and CodexReduce before SplunkFeeds the Lake
Collect once. Keep the history in the lake. Send only the important signals to Splunk.
Reduction happens in the pipeline, so volume and cost drop before reaching expensive destinations.
See the telemetry pipeline →Reduction happens in the pipeline, so volume and cost drop before reaching expensive destinations.
Agents run it
Claude, Codex or any common agents operate the pipeline directly. They choose what to collect, how to parse it, and what to reduce.
- ✓collect at TB/hr rate
- ✓profile logs, parse and transform in place
- ✓reduce logs without losing important signals
- ✓feed the telemetry lake
Anomaly Intelligence
Log centric anomaly detection and correlation. 100% unsupervised
All telemetry treated as logs. Six independent evaluators. Correlation from unsupervised pattern scores — not from a topology map or a policy a human authored.
DRAIN + JSD
Log structure and distribution drift
BERT sequence
Order-aware modelling of event sequences
LSH fingerprinting
Semantic similarity — and never-before-seen lines
HDBSCAN
Numeric clustering across metric space
Time-series forecasting
Expected-band deviation and spike analysis
Cross-domain correlation
Silicon to application, in one causal chain
Others: Typical "AIOps"
Noise without a trail
- Alert storms and false positives
- Silent failures stay silent
- No evidence — root cause is still a human hunt
FFWD
Evidence, then root cause
- The symptomatic log lines, not a metric spike
- Evidence logs stored for near real-time audits
- Correlated patterns for your agents to troubleshoot at lightning speed
100% On-Premises
Runs entirely inside your walls. Including the AI.
The models train and run in-cluster on your own GPUs. No telemetry egress, no third-party inference, no data crossing a jurisdiction. The MCP interface your agents talk to sits inside your perimeter too.
ON
On-premises
Your datacentre, your hardware, your network boundary.
PC
Private cloud
Your tenancy in AWS, Azure, GCP or a sovereign provider.
AG
Air-gapped
Fully disconnected environments, including the ML stack.
MT
Multi-tenant
Provider-operated, with tenant isolation for downstream customers.
For operators under data-sovereignty and retention mandates, this is not a preference — it is the gate that decides who can be evaluated at all.
No SaaS dependencyLocal GPU inferenceMCP inside your perimeterFlat licensing, not per-GB
What’s next
When the infrastructure operator is an AI-agent.
Nio adds execution-risk scoring and policy gating at the agent boundary — every tool call evaluated before it lands, with a local audit trail. Available today for teams relying on fast acting agentic automations.
“ We, SAKURA internet, Inc., is constantly pursuing innovations to help our customer's business run more efficiently and smoothly. We are very honoured to contribute their success by offering FFWD, a superior observatory services on our IaaS service, “SAKURA's Cloud”, (so-called, Logging as a Service) provided in SaaS format through this partnership. ”
“ Capabilities such as infrastructure self-recovery and fast time to restoration after failure are very important to our business. Logs and events are essential clues and triggers to achieving these capabilities. FFWD helps us to affordably collect, analyse and monitor our infrastructure logs and events in real-time, improving our operational reliability and efficiencies. ”