SONIC - Security + Operations + Network Intelligence Center

SONIC NOC
SONIC SOC
GIF
HLD

Inspiration

The spark for SONIC came directly from our client. Their Network Operations Center on Wireless network, and the team faced two painful, recurring problems. First, alerts were being missed -dashboards generate a constant stream of notifications, and in the noise, genuinely important alerts slipped through the cracks until they became outages. Second, they had no single, end-to-end solution to manage multiple network controllers. Each controller was its own island, monitored in isolation, with analysts manually swivel-chairing between consoles to figure out what was actually happening across the network.

The deeper issue was that even when an alert was caught, resolving it meant a human working through the same repetitive runbook every time — check the device, run diagnostics, restart the service or reroute traffic, update the ticket. There was no way to auto-resolve the recurring, low-risk incidents that made up the bulk of the volume. Skilled engineers were stuck firefighting Tier-1 noise instead of doing real network engineering, and Mean Time to Resolve (MTTR) kept climbing.

We realized the client didn't need another monitoring dashboard — they needed an operator: something that could watch every controller at once, never miss an alert, correlate signals across the whole network, and actually fix the routine problems on its own. When UiPath Maestro arrived in 2025 with BPMN process modeling, DMN decision logic, and agentic orchestration, we finally had the pieces to build it. SONIC was born — one agentic layer that unifies monitoring, decisioning, and remediation across multiple Cisco Meraki controllers, escalating to a human only when judgment is genuinely required.

What it does

This isn't a toy — it's solving a live problem for a real wireless controllers–run NOC that was missing alerts and drowning in multi-controller noise.

In our demo, we fire a real wireless controller interface-down alert. ‹14 seconds› later — with zero human touch — the agent has correlated it with ‹2› sibling alerts across controllers, run diagnostics, rerouted traffic, and closed the ServiceNow ticket. What used to take an analyst ‹~12 minutes› of swivel-chair work happens before anyone opens a console. (Watch the timeline in the video.)

The agent is what makes this work. When alerts arrive, an AI agent reasons across multiple wireless controllers, fuses noisy signals into a single incident, enriches it with asset/owner/history/threat-intel context, and decides the risk tier itself — then picks the path: act now, or stop and ask a human.

The hard part of an agent isn't making it act — it's making it know when to stop and ask. That's our entire design.

SONIC runs that judgment through a risk-tiered, human-in-the-loop model:

Risk tier	What the agent does	Example use cases
Low	Acts autonomously, end-to-end, unattended	Service down, disk threshold, backup job failure
Medium	Investigates + enriches, then a human approves the action	High CPU/memory, link degradation, phishing triage, suspicious login
High	Prepares a decision-ready case; a human must approve containment	Malware isolation, account disable, data-exfiltration response

The same agent unifies both the NOC and the SOC — only the connectors and runbooks differ. One brain, one pane of glass, every controller.

How we built it

UiPath Maestro is the agent's brain. It models each runbook as a BPMN process, runs the agent's reasoning and DMN risk decision, dispatches RPA robots for deterministic action, and pauses for human approval through Action Center — all on one governed, fully-audited workflow.

The core loop: Trigger → Enrich → Decide → Act → (Approve) → Verify → Close. A Meraki/SIEM alert starts an instance; the AI agent correlates and enriches; a DMN table assigns the risk tier; robots execute (restart, reroute, block, disable, ticket); medium/high tiers gate on a human; a health re-check confirms the fix or escalates; the ticket closes and every step is logged.

Built entirely on the UiPath Platform: Maestro (orchestration + DMN), Studio Web (BPMN/DMN design), Orchestrator + RPA robots (action), AI Agents / Autopilot for Maestro (triage, cross-controller correlation, recommendations), Integration Service (Cisco Meraki API, SIEM, EDR, ITSM, identity, messaging), and Action Center (human approval).

Challenges we ran into

Correlating across controllers without double-firing. A single network event shows up as multiple alerts across multiple Meraki controllers. Deduplicating and fusing them into one incident — without dropping a real second event — was the hardest technical problem, and it's the thing that actually kills the "missed alerts" pain.
Tuning the risk gate. Where exactly the agent stops and asks defines whether anyone trusts it. Too eager and it scares operators; too cautious and we've just rebuilt the manual process. We landed on a hard guardrail: every autonomous action must be reversible or escalatable, and the agent only acts unattended when both the tier is Low and its confidence clears a threshold.

Getting the agent to act was easy. Getting an operations team to trust it acting was the real build.

Accomplishments that we're proud of

A genuine agent that reasons across multiple Cisco Meraki controllers and decides its own risk tier — not a script with an LLM bolted on.
A "no missed alerts" guarantee: every controller's signals get ingested and correlated, so nothing slips through the noise.
End-to-end auto-resolution of recurring Tier-1 incidents — trigger → fix → verify → close — proven live in our demo, not just notified.
A trust model judges-and-operators-can-live-with: autonomy where it's safe, a human where it matters, full audit everywhere.

In our demo run, one runbook went from ‹~12 min manual› to ‹~14 sec unattended› — the same job, same steps, zero swivel-chair.

What we learned

Agency lives in the decision, not the action. Anyone can restart a service. The value was the agent fusing scattered alerts into one incident and choosing the right tier — the DMN table is where the intelligence became auditable.
Correlation is where the payoff hides. Watching controllers individually is noise; fusing their signals into single incidents is what actually cuts analyst load.
Human-in-the-loop is a design dimension, not a disclaimer. Tiering by risk was the single decision that made SONIC deployable.
Agents and robots are complementary. The agent reasons; robots execute deterministically. Maestro let us use each for what it does best.

What's next for SONIC - Security + Operations + Network Intelligence Center

[ ] Go vendor-agnostic — extend beyond Cisco Meraki to other network and security platforms
[ ] Grow the runbook library — more NOC/SOC use cases so a larger share resolves with zero human touch
[ ] Close the learning loop — let the agent learn from analyst overrides to refine its triage and risk-gating over time
[ ] Shift fully proactive — act on leading indicators (disk at 80%, latency creeping up, certs expiring) so the incident never happens
[ ] Executive insights — dashboards on automation rate, MTTR, SLA adherence, and incidents prevented across the estate