The investigation layer for infrastructure engineers.

The engine treats every incident as a set of competing explanations. It plans targeted, read-only collection to confirm or reject each one, weighs the evidence and keeps going until a candidate clearly stands out — or tells you that it doesn't.

Results always include the evidence trail, so an engineer can verify the conclusion in minutes.

Netlume continuously builds a graph of your environment: physical adjacency, IGP and BGP, EVPN/VXLAN and MPLS overlays, VRFs, ECMP groups and the services that depend on them.

When something fails, the investigation is scoped automatically to the devices that can actually affect the symptom — not every device that raised an alarm.

Netlume keeps configuration history across vendors and understands it semantically — policies, neighbors, VRFs, ACLs and QoS — rather than as plain text.

It detects drift from intended state, highlights risky changes and connects recent changes to the incidents that follow them.

Symptoms that share a cause are grouped into a single incident using topology and timing, not just text similarity. Each incident shows which devices, paths, services and workloads are affected — and which are not.