A typical SOC alert says something like 412 failed SSH logins on 10.24.8.17. That is useful to a security analyst and almost meaningless to anyone else. The NOC wants to know which device and port. The account manager wants to know which customer. The duty manager wants to know whether an SLA is at risk.
In most operators, answering those questions means three lookups in three tools, usually by different people. We built Netcosm so that the answer is already attached to the alert.
The resolution path
Every event carries at least one identifier: an IP address, a hostname, an interface name or a MAC. Netcosm matches that identifier to an inventory record and then walks the dependency graph outward.
Because the inventory and the SIEM share one data model, there is no sync job to go stale. When an engineer re-patches a port, the next alert on that port resolves to the new circuit.
What the router sends
Nothing special is needed on the device. Standard syslog is enough, as long as interface descriptions follow a convention the parser can read.
# Junos · forward to the Netcosm UK endpoint
set system syslog host logs.eu-west-2.netcosm.[PLACEHOLDER] any notice
set system syslog host logs.eu-west-2.netcosm.[PLACEHOLDER] authorization info
set interfaces xe-1/0/3 description "CCT-LL-00419"Why it matters
[PLACEHOLDER: closing section with outcome data from the UK operator, subject to approval.]