VIPERAnalyst & Investigations
Keep the investigation honest.
Original observations, competing explanations and the next useful verification in one persistent investigation. The Analyst prepares an evidence-based interpretation for review; it does not touch the infrastructure, and the decision stays with authorized people.
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESanalyst-b
Operational Picture
SW-01 top-of-rack switch
Interface Eth1/24 · the highlighted link and possibly affected objects
- Observed link · device-reported
- Recorded dependency
- Recorded network membership
- Not observed
Synthetic presentation data
Before and after · affected and unaffected
Compare what changed.
And what did not.
Set the incident window against the intervals around it, and the affected uplink against one that shares its trunk. The comparison states its population and its intervals — and shows the evidence it does not have.
Question Did input errors change with the incident — and did the other uplink change too?
Population SW-01 uplinks on TRUNK-07: Eth1/24 (affected) and Eth1/23 (comparison)
Shared scale · input errors per 5 min · 0–2,500
Eth1/24 · primary, input errors / 5 min: 09:35 0, 09:40 1, 09:45 0, 09:50 2, 09:55 0, 10:00 1, 10:05 312, 10:10 1846, 10:15 2210, 10:20 1975, 10:25 2032, 10:30 1418, 10:35 96, 10:40 41, 10:45 38, 10:50 44, 10:55 39
Eth1/23 · secondary, input errors / 5 min: 09:35 0, 09:40 0, 09:45 0, 09:50 0, 09:55 0, 10:00 0, 10:05 0, 10:10 0, 10:15 0, 10:20 0, 10:25 0, 10:30 0, 10:35 0, 10:40 0, 10:45 0, 10:50 0, 10:55 0
SVC-01 check · p95 response: Before window 0.42 s, Incident window 3.4 s, After window 0.61 s
The next useful observation
Know what to
look for next.
VIPER Analyst proposes the observation that would separate the remaining alternatives, and states who or what obtains it. Approved reads run under their existing authority. Evidence held by another team becomes a request to that team.
Nothing is changed on the equipment. Tests, resets and replacements stay with the people who hold it.
Unresolved · H1 Which component: TX-24, CBL-042, PP-01 · P24, TRUNK-07 ch04, PP-02 · P08, CBL-043 or SW-02 · Eth1/08.
Candidate observations
Candidate components · H1 · recorded path
- MeasuredSW-01 · Eth1/24Input errors (CRC) elevated
- transceiverTX-24Near side
- patch cableCBL-042Near side
- panel portPP-01 · P24Boundary
- trunk channelTRUNK-07 · ch04Far side
- panel portPP-02 · P08 ?Far side
- patch cableCBL-043Far side
- Far endSW-02 · Eth1/08Far side
Obtaining ME-1 splits the candidates into near side (2), boundary (1) and far side (4).
- Observation
- ME-1 SW-02 · Eth1/08 receive counters, 10:05–11:00
- Why it is missing
- The far end is outside VIPER’s collection scope.
- Separates
- H1 near side vs far side
Who or what obtains it
Human requestnetops-shift-b · Network operations · shift B
Scope 10:05–11:00 UTC · read-only
Requested 10:46 · due 11:30
Part of NV-024-1 · requested by analyst-a at 10:46 · due 11:30. The device is held by another team; the request goes to them.
Human review and decision
VIPER prepares.
People decide.
The investigation ends in a decision that belongs to a named owner. The Analyst sets out what is supported, what is open and what to verify next; it does not reconfigure, reseat, replace or close anything. Every decision keeps its basis and its approver — and a superseded decision stays in the record.
INC-024SVC-01 · Records Gateway
Incident window10:05–10:35 UTC
Human review · INC-024
- Decision owner
- ops-lead · Operations lead
- Investigation
- INV-024 · analyst-b · Analyst · shift B
Prepared by VIPER
- Assessment ASM-024 rev 3 · alternatives open
- Verification NV-024-1 · pending
- Watch WCH-03 · approved, running daily
Not done by VIPER
- Change switch configuration or move traffic
- Reseat, replace or re-patch a component
- Confirm a defective part without its evidence
- Close the incident or accept a cause
Physical work on SW-01, TX-24 or the PP-02 segment needs the decision owner’s authorization and a network operations change record. VIPER Administration keeps the application running; neither it nor Bridge executes network repairs.
Investigation INV-024
Records Gateway degradation · errors on SW-01 Eth1/24
Why did the Records Gateway degrade between 10:05 and 10:35, and where is the fault?
Decisions
DEC-11Superseded10:20 · analyst-a · approved by netops-lead
Keep Eth1/24 in service until the secondary uplink is verified.
Basis: Secondary termination disputed (REC-031); CNT-SVC-01 rev 1.
DEC-12In force10:55 · analyst-a · approved by netops-lead
Keep Eth1/24 in service; move traffic to Eth1/23 only if errors rise again.
Basis: Both uplinks share TRUNK-07 and SW-02 (CNT-SVC-01 rev 2).
Decision owner
ops-lead · Operations lead, for INC-024 at NYC-01.
Approval
DEC-11 and DEC-12 approved by the network operations lead; DEC-11 superseded and preserved.
Physical work
Needs the owner’s authorization and a network operations change record — outside VIPER.
Bring one real workflow to the evaluation.
Name the service, the environment and the workflow you want to examine. We scope the evaluation around them.