Managed operations
Your infrastructure stays up — including at 3am
Remote NOC and SOC: monitoring, incident triage, response and escalation on documented runbooks — alongside your team or instead of one.
The problem
Running 24/7 with an in-house team is expensive and fragile
Covering three shifts needs five or six engineers. In practice the team is small, on-call rests on one person, and the runbook lives in someone's head — which is exactly when an incident exposes it.
- Alert noise — the real incident gets lost
- No defined escalation path
- No post-incident review
- Knowledge concentrated in one person
What we deliver
Your infrastructure stays up — including at 3am
Monitoring baseline
Discovery, inventory and a check set defined per service.
Runbooks
Documented steps for every recurring incident class.
Escalation matrix
Severity, owner, time targets and contact channels.
Change control
Agreed windows, rollback plan and a change log.
Reporting
Monthly reporting on incidents, trends and open risk.
Continuous improvement
Alert tuning, automation and architectural recommendations.
Architecture
Architecture
- 01MonitorMetrics, logs, synthetics
- Zabbix
- Prometheus
- Blackbox
- 02DetectThresholds and anomalies
- Alertmanager
- Grafana Alerts
- 03TriageSeverity, impact, owner
- Runbook
- On-call
- 04RespondIsolate and restore
- Change window
- Rollback
- 05ResolveVerify and report
- RCA
- SLA report
- 06ImproveRules, automation
- Alert tuning
- Runbook update
Operator consoles
Operator consoles
These exact systems run on the group's own infrastructure — the screenshots are processed before publication.
Bandwidth and peering in real time
Every upstream and every peering session is measured separately, with global and local traffic split apart. Capacity and peering decisions come from this view — not from a hunch.
Global BGP Report — automatic, every day
From four international vantage points — Sofia, the USA, Amsterdam, India — every one of our prefixes is measured for reachability, loss and latency. No human assembles this: the system compares a 3-hour window against a 24-hour baseline, picks out the direction that is degrading and assigns the priority itself — in this frame P1 is India, where RTT passes 190 ms.
OpenPath — our own NOC console
Live path monitoring on a 15-second refresh: latency and packet loss to each service, including cache servers hosted inside individual operators. A path change is recorded as its own incident, with filters by ASN, ISP and customer. We wrote this tool ourselves because no off-the-shelf product answered the question.
The team member that does not sleep
Pipi Jarvis sits in the same channel as the engineer on shift — it posts its reports and warnings there, answers questions and acts within the rights it was given. There is no separate interface: it lives where the team already works.
Backup and recovery
Centralised backup for virtual and physical systems: protection status per machine, the storage usage trend, and a separate list of hosts that stopped reporting. That last list is what matters — a backup nobody watches is not a backup.
The firewall — policy, sessions and load
A FortiGate in production: thousands of concurrent sessions, SPU load, security-fabric state and per-interface throughput on one screen. A firewall is not a separate box to us — it is designed and operated together with routing, segmentation and logging, by certified engineers.
ros-backup — the configuration archive, collected on its own
A device's configuration is the one file whose loss is measured in hours of downtime. ros-backup collects it every day over SSH — MikroTik RouterOS, Juniper JunOS, Cisco IOS and Arista EOS — and keeps it in a git repository, versioned, with a line-by-line diff between any two. No engineer signs in to each device to copy a config by hand: any router's configuration from any day is two clicks away — including when the device itself will no longer power on. We wrote this one ourselves too.
Ansible on a schedule — the Semaphore scheduler
Ansible playbooks here are not scripts someone ran once — they are jobs on a schedule: latency checks against cloud VPS instances, a DNS server check, a reporter run from TVG, a weekly VPS job. Each has its own cron expression and its own playbook, and each produces the same result every time, because a playbook describes the state it wants rather than the steps to get there.
Capabilities
Capabilities
Every item is marked: verified production experience, or engineering capability.
24/7 network monitoring
ProvenThe group's own ISP and datacenter run continuously — same processes, same tooling.
- Zabbix
- Prometheus
- Grafana
Severity-based incident response
Proven- Runbooks
- On-call rota
SOC — event correlation
CapabilitySIEM rules, detection content and incident response playbooks.
- Wazuh
- Graylog
- OpenSearch
Co-managed mode
CapabilityYour team keeps control; we cover the shifts and the escalation path.
ITSM integration
CapabilityTwo-way sync with your ticketing system.
- Webhooks
- REST API
Telegram / PagerDuty escalation
Proven- Telegram Bot API
- Alertmanager
Path monitoring and loss detection
ProvenLatency and packet loss to every critical destination — including cache servers hosted inside individual operators. That is how you tell whether the fault is in our network, in transit, or at the content provider.
- OpenPath
- ICMP / TCP probes
- per-ASN
Process
Process
- 01
Monitor
- 02
Detect
- 03
Triage
- 04
Respond
- 05
Resolve
- 06
Improve
Technology stack
Technology stack
- Monitoring
- ZabbixLibreNMSPrometheusGrafanaBlackbox
- In-house tooling
- OpenPathnoc.com.ge
- Logging
- GraylogOpenSearchLokiVector
- Security
- WazuhFortiGateSuricata
- Alerting
- AlertmanagerTelegramPagerDuty
Engagement model
Engagement model
Co-managed
NetWizard and your in-house team together, with split responsibility.
Fully managed
We own the agreed operational scope end to end.
Critical operations
24/7 monitoring, response and severity-based escalation.
Retainer
Monthly engineering hours — specialist access on demand.
Use cases
Use cases
ISP night shift
The provider covers business hours; we cover nights and weekends.
Hosting platform
Continuous watch over hypervisors, storage and network with escalation.
MSP augmentation
A white-label NOC for an MSP's clients, under their brand.
FAQ
FAQ
How do you access our infrastructure?
Named accounts only, with MFA, logged sessions and agreed change windows. Details are in the Trust Center.
What SLA do you offer?
The SLA is defined per service plan: severity-based acknowledgement, response and escalation targets are fixed in the contract.
Can you work with our existing tools?
Yes. If you already run Zabbix, Prometheus, Grafana or a SIEM we operate on it, correcting the configuration where needed.