01
See it
Command center health, topology, syslog, traps, and collector status tell you what changed across sites.
Optima Pulse · AI Network Command Center
Monitor. Analyze. Act.
One platform for NMS, NDR, NEM, AIOps, and network automation. See device and path health, understand traffic and detections, and act before users are impacted.
Optima Pulse is built for NOC, SOC, enterprise, and MSP/MSSP teams that run real networks. Site-bound edge collectors feed inventory, metrics, flows, syslog, and traps into a tenant-isolated control plane. Empty telemetry stays empty — the UI never invents green.
Optima Pulse
NOC Command CenterEnterprise NMSDiscoveryLive topologyNetFlow / IPFIX / sFlowNDRNEMAIOps + CopilotAutomationMSSP tenancy
How operators use Pulse
A single operating rhythm instead of six consoles.
Monitor the estate, analyze the evidence, and act with approvals — on the same inventory, topology, flow, and detection graph.
02
Explain it
Open the device, the host graph, the conversations, and the matching NDR detection instead of exporting a PCAP first.
03
Prove it
AIOps RCA and Copilot sit on inventory, topology, flows, and detections — not a generic chatbot.
04
Act on it
Incident workspace, playbooks, and approval-gated automation turn the next step into an auditable action.
Everything in the product
NMS, topology, flow, NDR, NEM, AIOps, and automation — not a monitoring brochure.
These are the modules operators actually open. Each card maps to a live Optima Pulse route, not a placeholder capability name.
Command Center
NOC Command Center
One live operating picture for health, topology, traffic, detections, incidents, and site status — built for operators who cannot context-switch across six tools.
- • Live topology with device and link health
- • Critical alerts, incidents, and NDR detections in one wall
- • Site, collector, and availability KPIs from the same session
NMS
Enterprise Network Monitoring
Edge-collected SNMP, ICMP, syslog, and trap telemetry into a real inventory with device lifecycle, groups, dependencies, and explainable health.
- • Device lifecycle from discovered to monitored, maintenance, or decommissioned
- • Interface, availability, and collector health without invented green scores
- • Monitoring profiles, device groups, and synthetic checks
Traffic & Flow
NetFlow, IPFIX, and sFlow intelligence
Turn high-volume flow telemetry into conversations, top talkers, application demand, traffic matrices, and Sankey paths operators can actually use.
- • ClickHouse-backed flow analytics at investigation speed
- • Top talkers, applications, conversations, and WAN/cloud egress
- • Visual analytics hub for trends, protocol mix, and bottlenecks
NDR
Network Detection and Response
Detect, investigate, and respond on network telemetry — sessions, detections, hunting, evidence, and action — without pretending to be a SIEM or EDR.
- • Behavioral, IOC, and threshold detections on live network sessions
- • Alert analysis, investigations, evidence, and response workflows
- • Threat map, C2, lateral movement, and session hunting in the same product
AIOps
AIOps, RCA, and Copilot
Correlate noise, surface anomalies, trace likely root cause, and ask the AI Network Command Center for the next operational step.
- • Anomaly detection, correlation, and service-impact views
- • Root-cause analysis tied to topology and dependency context
- • AI Copilot for investigation summaries and recommended actions
Automation
Guided network automation
Turn repeatable NOC and NDR decisions into playbooks, approvals, jobs, and auditable execution — with human control on sensitive changes.
- • Playbooks, templates, and scheduled jobs
- • Approval gates for operational and security-sensitive actions
- • Execution history for accountability across tenants
Topology
Live topology and host graphs
LLDP/CDP discovery, inventory sync, and NetFlow conversations on one map so a red device opens into peers and paths instead of a static drawing.
- • Live health overlays on devices and links
- • Host-centered peer maps with traffic matrices
- • Unified graph across sites and dependencies
NEM
Network Exposure Management
Inventory internet-facing risk, vulnerabilities, misconfigurations, and attack paths on the same graph the NOC already uses.
- • Exposure inventory, assets, and internet surface
- • Vulnerability and misconfiguration views
- • Risk analysis and attack-path context
Analytics
Reporting and executive views
SLA, capacity, traffic, and NDR activity from VictoriaMetrics and ClickHouse — the same stores operations already trust.
- • Visual analytics hub for trends and protocol mix
- • Capacity forecast and SLA analytics
- • Executive dashboards without a weekend CSV export
Command Center
The operator home screen is a wall, not a landing page.
Overall health, devices, sites, interfaces, availability, critical alerts, open incidents, NDR detections, collectors, live topology, top talkers, and the incident stream share one session.
Health and inventory
Overall health, devices, sites, interfaces, availability, and collector status from the same session — not a second dashboard product.
Live topology
Device and link health on the operating map so a shift lead can go from a red count to a node without leaving the wall.
Traffic and talkers
Inbound/outbound volume, latency, and top conversations from ClickHouse flows, with pivots into matrix, Sankey, and bandwidth views.
Detections and incidents
Critical alerts, open incidents, NDR detections, exposure, and anomalies sit on the same clock as device health.
Site filters
Filter the command center by site — Dubai HQ, London DC, branch, lab — without changing tenant or tool.
NOC Wall
A dedicated wall layout for the operations room, plus incident workspace and event log one click away.
Optima Pulse
Enterprise NMS
Edge-collected monitoring with a lifecycle, not a fake availability score.
SNMP, ICMP, syslog, and traps run on site-bound collectors. Inventory and health live in Postgres; metrics land in VictoriaMetrics. Pulse does not invent green when there is no series.
Edge collection
SNMP, ICMP, syslog, and traps run on site-bound collectors. Poll targets come from the control plane; telemetry posts back over authenticated channels.
Device lifecycle
Discovered → registered → monitored → maintenance → decommissioned. Poll intent is explicit. Decommissioned devices are not quietly left green.
Honest health
Health factors include status, alerts, telemetry freshness, interface state, and lifecycle. Missing VictoriaMetrics series is a valid state.
Discovery
Continuous inventory of devices and relationships. Promote into monitoring only when a collector can actually poll the target.
Groups and policy
Device groups, dependencies, monitoring profiles, and synthetic checks keep NOC policy out of spreadsheets.
Interfaces and collectors
Interface inventory, utilization, and collector health are first-class — not hidden behind a device detail page.
Optima Pulse
Topology and traffic
From a red device to the conversations that explain it.
Live topology, unified graphs, and host-centered peer maps combine LLDP/CDP discovery with inventory. Traffic motion follows real interface utilization. NetFlow, IPFIX, and sFlow land in ClickHouse.
- • Live network map with health overlays, fit/reset, and CSV/SVG export
- • Host graphs for a device plus a source × destination traffic matrix
- • Top talkers, applications, conversations, WAN/cloud/internet splits
- • Visual analytics hub, bandwidth, bottleneck, and threat dashboards
- • No synthetic flow series — empty ClickHouse stays empty
Network Detection and Response
NDR on the same graph as the NOC — not a bolted-on SIEM.
Detect, hunt, attach evidence, and respond on network telemetry. Pulse NDR is network detection and response. It is not a SIEM, SOAR, or EDR substitute.
Detection path
Flows and sessions in ClickHouse feed NDR workers. Threshold, IOC, and behavioral rules upsert detections by fingerprint with explainable risk.
Analyst workspace
Alert analysis, detections, sessions, hunting, threat intelligence, rules, investigations, evidence, ingest, and response under one NDR module.
Security operations wall
Threat map, indicator volume (C2, lateral movement, exfiltration, DNS tunneling), and inbound/outbound traffic beside open detections.
Honest empty states
No TI feed configured stays visible. Insufficient graph evidence is stated — Pulse does not draw a fake attack path.
Optima Pulse
Optima Pulse
Security operations
Threat map, detections, and traffic on one wall.
SOC and NOC share the same incident clock. Geo threat context, C2 / lateral movement / exfiltration indicators, and inbound versus outbound volume sit beside open detections.
- • NDR overview, alert analysis, detections, sessions, and hunting
- • Evidence and response with automation execute permissions
- • Exposure management for internet surface, vulns, and attack paths
AIOps, Copilot, and automation
Turn noise into a next step — with human control on sensitive changes.
AIOps, RCA, and Copilot sit on inventory, topology, flows, and detections. Automation turns repeatable NOC and NDR work into playbooks, jobs, and approvals.
AIOps
Anomalies, correlation, RCA
Anomaly detection, noise reduction, forecasting, service impact, and root-cause views that follow the chain from application to host to uplink.
- • Baselined behavior instead of static thresholds alone
- • Insufficient-evidence states instead of a confident fiction
Copilot
AI Network Command Center
Ask for investigation summaries and recommended actions grounded in the same operational graph operators already trust.
- • Tied to inventory, topology, flows, and detections
- • Built as a first-class route, not a chatbot overlay
Automation
Playbooks with approvals
Enrichment, notifications, NDR response, and remediation become consistent execution. Sensitive changes stay behind approvals and show up in history.
- • Workflows, templates, schedules, and jobs
- • Tenant-scoped execution audit
Optima Pulse
Reporting and analytics
Executive views from the stores operations already use.
The analytics hub, bandwidth, bottleneck, SLA, and capacity views read VictoriaMetrics and ClickHouse. Leadership does not wait on a weekend CSV export.
- • Traffic trends, inbound vs outbound, protocol and port mix
- • NDR activity beside flow volume
- • Capacity forecast and SLA analytics
Capabilities
The full Optima Pulse surface area.
From command center to response — every capability below is a real product module with its own page.
Operations
NOC Command Center
A live command wall for health, topology, traffic, detections, and incidents.
Visibility
Enterprise NMS
Monitor devices, interfaces, collectors, and lifecycle across every site.
Inventory
Smart Network Discovery
Discover devices, relationships, and site inventory as the network changes.
Mapping
Live Topology
See how sites, switches, hosts, and paths connect with live health overlays.
Operations
Performance and Experience
Track latency, loss, WAN paths, and application experience before users feel it.
Network data
Traffic & Flow Intelligence
See who is talking to whom, which applications consume bandwidth, and where traffic is shifting.
Telemetry
NetFlow / IPFIX / sFlow
Correlate flow telemetry into patterns for troubleshooting, hunting, and capacity.
Security
Network Detection & Response
Detect suspicious traffic, hunt sessions, gather evidence, and drive response from the network.
NEM
Network Exposure Management
Inventory internet-facing risk, vulnerabilities, misconfigurations, and attack paths.
AI
AIOps and AI Copilot
Turn noise into action with correlation, baselining, RCA, and recommended next steps.
Intelligence
Anomaly Detection
Detect behavior changes earlier with baselines and network-aware signal correlation.
Diagnostics
Root Cause Analysis
Trace degraded service paths from user impact back to the likely failure domain.
Actions
Automated Workflows
Turn repeatable operational decisions into playbooks with approval gates.
Insights
Reporting & Analytics
Executive views, SLA analytics, capacity forecast, and operational reports from the same data.
Who Pulse is for
NOC, SOC, enterprise, data center, and service-provider operations.
One control plane, different operating rhythms. Multi-tenant RLS and RBAC keep customer and team boundaries server-side.
Enterprise
Unified visibility across campus, WAN, data center, cloud links, and critical sites.
- • One inventory and topology for every site
- • Flow and NDR context beside device health
- • SaaS, on-prem, or hybrid control plane
NOC
Command-center operations for incidents, health, and fast event triage.
- • Shift-ready command wall
- • Incident workspace instead of tab sprawl
- • Honest health — no fake green when telemetry is missing
SOC / NDR
Network detection, hunting, evidence, and response for security operations.
- • NDR detections with explainable risk
- • Hunt sessions and evidence in-product
- • Response actions with automation approvals
MSP / MSSP
Multi-tenant operations with customer views, delegated access, and service reporting.
- • Server-side tenant isolation
- • Portfolio and per-customer operating views
- • Role-based access for NOC, SOC, and customer teams
Data Centers
Track core paths, east-west traffic, and performance hotspots in high-density environments.
- • Host connection graphs for critical devices
- • Traffic matrix and bottleneck heatmaps
- • Capacity and interface utilization in context
Distributed Enterprise
Keep branches, campus, cloud, and remote operations visible from one command center.
- • Site-bound edge collection
- • WAN and application experience views
- • Per-site filtering on the command center
Industries
For environments that cannot go dark.
Healthcare, finance, government, telecom, manufacturing, retail, education, and technology teams use Pulse when connectivity, detection, and uptime are operational.
Healthcare
Mission-critical connectivity and clinical application continuity across facilities.
Financial Services
Availability for transactions, branch connectivity, and critical infrastructure reliability.
Government
Distributed infrastructure monitoring for resilient public-sector networks.
Telecom
Network performance, traffic intelligence, and service health across provider environments.
Manufacturing
Plant connectivity, OT/IT awareness, and resilient operations across distributed sites.
Retail
Branch and WAN visibility for point-of-sale, applications, and store continuity.
Education
Campus-wide connectivity for staff, students, and learning-critical services.
Technology
Cloud and data center visibility for modern digital operations.
Architecture
Edge-collected telemetry. Tenant-isolated control plane.
Collectors at the site. Go API with Postgres RLS. VictoriaMetrics for metrics. ClickHouse for flows. NATS for realtime. The console is not a refresh loop against the database.
- 01 Presentation. NOC Command Center, NMS, topology, flow analytics, NDR, AIOps, automation, and reporting in one React console.
- 02 API & identity. Go API, Keycloak/OIDC or local auth, RBAC, and tenant context that is never accepted from the client.
- 03 Intelligence. Alert correlation, NDR workers, AIOps, RCA, Copilot, and automation playbooks on the same control plane.
- 04 Telemetry stores. Postgres for inventory and detections, VictoriaMetrics for metrics, ClickHouse for flows, NATS for realtime.
- 05 Edge collection. Site-bound collectors for SNMP, ICMP, syslog, traps, and NetFlow/IPFIX/sFlow with local buffer and mTLS.
Security and tenancy
- • Tenant context is never accepted from the client. FORCE RLS on operational tables.
- • RBAC maps to routes: devices, NDR investigate/respond, automation execute, admin.
- • Collectors authenticate. Telemetry ingest is not an anonymous UDP hole into the API.
- • OIDC/SSO via Keycloak, or local auth for lab and air-gapped installs.
- • Automation execution history keeps change accountable across tenants.
Deployment
SaaS, on-prem, or hybrid — collectors stay with the network.
The control plane can live in Pulse Cloud or in your environment. SNMP, ICMP, syslog, traps, and flow collection run on site-bound edge collectors with mTLS.
SaaS
Cloud control plane
Operators use Pulse Cloud while site-bound collectors gather telemetry from distributed networks.
On-prem
Private instance
Run the full control plane in your environment — API, stores, workers, and collectors — with offline-capable packaging.
Hybrid
Connected operations
Keep sensitive collection at the edge, apply residency controls, and operate from a central Pulse command center.
Ready to see Optima Pulse?
Book a demo of the AI Network Command Center.
Walk the command center, NMS, topology, flow, NDR, and automation against your operating model — SaaS, on-prem, or hybrid.