Repository navigation
fix(demo): add the telco demo pack - #389
Merged
Merged
Conversation
The pack answers the NOC questions on /solutions/telco/: what changed, which peer flapped, which cell's KPIs fell. - bgp-updates polls RIPEstat every 60 seconds for four prefixes of large networks (Akamai, Cloudflare, Amazon, Google). RIPEstat publishes about 12 hours behind. Each poll reads the minute that ended 12 hours ago. The BGP tiles shift each update forward 12 hours. - ran-kpis and core-probes replay a generated day of cell PM counters and NGAP, GTPv2-C and Diameter probe records through the receiver as JSON. Routing uses _dfe_demo_source. The day's last hour holds four faults: an RSRP drop, a backhaul collapse, a silent cell and an S6a failure burst. events/generate.py uses a seed to generate the day and replays it. - Five dashboards (peers, AS paths, cells, probes, an RFO timeline built from the counters) and three searches. - A hunt matches every BGP withdrawal. The peers dashboard lists peers with over 20 withdrawals a minute. A source matched on a field other than data_stream.dataset, with no transform, is a JSON source. The pack replays JSON sources through demo-beats with its own generate.py. A pack of JSON and fetcher sources needs no intake.
The cell charts use five minutes per bucket. Missing cell data shows as a gap rather than a 0 dBm spike. The peers and probes tables span the full width, so peer addresses and causes are readable. The RFO timeline shows minutes ago. The BGP tables show the RIS clock in UTC.
`up --wait` failed on the telco file because demo-console exited 0 before the wait began. Nothing depended on it. demo-beats now waits on demo-console completing, so the wait counts the exit as done. The BGP peers table puts the RIS collector in its own column, so the peer address shows in full at 1440x900.
catinspace-au
force-pushed
the
feat/demo-pack-telco
branch
from
November 13, 2026 23:08
a798580 to
5b6bc56
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The telco pack answers the NOC questions on /solutions/telco/: what changed, which peer flapped, which cell's KPIs fell.
A source matched on a field other than data_stream.dataset with no transform is a JSON source. demo-beats replays it with the pack's events/generate.py. A pack of JSON and fetcher sources needs no intake.
Results on desktop-derek with a rendered dfe-demo-telco.yaml: startup took about 2 minutes. Row counts: bgp-updates 12,903, ran-kpis 5,818, core-probes 6,331. Hunt detections: 1,599. Screenshots cover all five dashboards. The stack is down.
The hunt follows the cyber pack's hunts/ and rules/ layout, which #384 installs. After #384 merges, rebase conflicts in Makefile and demo_seed.py need both sides kept.