VIPERDependencies & Resilience
Know what the service depends on.
See the network, service and power dependencies behind a service, where redundant paths converge, which connections are recorded and which are missing — and what continuity would rely on, stated as a model with its assumptions.
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESanalyst-b
Dependencies · Records Gateway
Dependencies · SVC-01 Records Gateway
- Shared · SW-01 Both hosts of the four services reach the network through one top-of-rack switch.
- Shared · TRUNK-07 Primary (ch04) and secondary (ch03) uplinks ride one trunk; its route is documented, not surveyed.
- Shared · SW-02 Since record rev 15–16 both uplinks terminate on SW-02; its counters are not observed.
- Shared · UPS-01 SRV-01’s two supplies run separately to their breakers and converge on one UPS.
- Missing · into PP-02 The primary segment from TRUNK-07 ch04 to PP-02 is unresolved.
- Missing · patch lead The secondary patch lead at PP-02 P07 has no cable record.
RecordedDocumented onlyUnresolved mappingNo cable recordShared failure domainObserved symptom — not a cause
Synthetic presentation data
Network and service dependencies
Which services ride
which path.
Four services on two hosts reach the network through SW-01 and its uplinks. The view keeps three readings apart: what an independent check observed, which recorded path a service is exposed to, and what a modeled scenario would leave it relying on.
INC-024SVC-01 · Records Gateway
Incident window10:05–10:35 UTC
Service consequence · Eth1/24 path
| Service | Observed degradationWhat an independent check actually saw. | Recorded exposureWhat the recorded dependencies connect to the path. | Modeled scenarioWhat would follow if the path left service. |
|---|---|---|---|
| SVC-01Records GatewayCritical | Degraded 10:09–10:31CHK-RGW-01 | RecordedSRV-01 → SW-01 → Eth1/24 path | ModeledContinues on Eth1/23 · shares TRUNK-07, SW-02 |
| SVC-04Internal directoryCritical | No degradation observedCHK-DIR-01 | RecordedSRV-02 → SW-01 → Eth1/24 path | ModeledContinues on Eth1/23 · shares TRUNK-07, SW-02 |
| SVC-02Shift rosterHigh | No degradation observedCHK-ROS-01 | RecordedSRV-01 → SW-01 → Eth1/24 path | ModeledContinues on Eth1/23 · shares TRUNK-07, SW-02 |
| SVC-03Field reports intakeStandard | Not observed · no service check | RecordedSRV-01 → SW-01 → Eth1/24 path | ModeledContinues on Eth1/23 · shares TRUNK-07, SW-02 |
SCN-NET-01 · Eth1/24 path out of serviceTraffic would rely on the secondary uplink Eth1/23. It shares TRUNK-07 and SW-02 with the primary, so continuity holds only while both remain healthy. Modeled — not observed.
Observed
Only Records Gateway was measured degraded. Where a service has no independent check, it reads “not observed”.
Recorded exposure
Being on the Eth1/24 path is not being affected. Exposure says what a service relies on, not what happened to it.
Modeled
What would carry each service if the path were taken out of service — a model, labelled as one.
Shared upstream failure domains
Redundant on paper.
Shared in practice.
A failure domain is a point every “independent” path passes through. VIPER finds them in the recorded graph and states each with its basis, what it exposes and the question it raises — for the owner to answer, not for VIPER to act on.
SW-01
Access switch · R12 U40
- Shared by
- SRV-01 and SRV-02 — all four services in the graph — and both uplinks.
- Basis
- Device inventory · surveyed 13 Oct
- Exposes
- Every service on R12’s two hosts, on either uplink.
For review Is a second access path for the critical services in scope?
TRUNK-07
MPO-8 trunk · Row A → Row C
- Shared by
- Primary uplink on channel 04, secondary on channel 03.
- Basis
- DCIM rev 14 · route documented, not surveyed
- Exposes
- Both uplinks at once if the trunk itself were cut or disturbed.
For review Should the trunk route be surveyed before it is relied on?
SW-02
Aggregation switch · R03
- Shared by
- Both uplinks since record rev 15–16 (Eth1/08 and Eth1/07).
- Basis
- Field survey rev 15 · accepted as rev 16 at 10:52
- Exposes
- New single point of failure for SVC-01 and SVC-04, reported by watch WCH-03.
For review Is the change to a shared far end intended?
UPS-01
UPS · Room 02
- Shared by
- SRV-01 supply A and supply B, after separate PDUs and breakers.
- Basis
- Recorded chain · device-reported state 11:03
- Exposes
- SVC-01, SVC-02 and SVC-03 in the modeled outage SCN-PWR-01.
For review Is a second UPS or an alternative source recorded anywhere?
Recorded versus missing
What is mapped.
What is not.
Switch between the two uplinks: the primary stops at an unresolved segment into PP-02; the secondary reaches SW-02 through a patch lead with no cable record. Neither gap is drawn in, and a drawn path is not proof that the cabling is sound.
Recorded path · Primary uplink
SW-01 Eth1/24 to SW-02 Eth1/08 through PP-01, TRUNK-07 channel 04 and PP-02.
Row A · Rack R12
Under-floor tray
Row C · Rack R03
SurveyedDocumented onlyGap · no recordHighlighting marks where evidence points — it is not a finding.
TraceRecorded to TRUNK-07 ch04. The segment into PP-02 is unresolved: LLDP names the far end, no record maps the route to it. Errors are observed at Eth1/24 only — no component on this path is established as the cause.
| Connection | Status | Source |
|---|---|---|
| SW-01 Eth1/24 → CBL-042 → PP-01 P24 | Recorded · surveyed | DCIM rev 14 · field survey 13 Oct |
| PP-01 P24 → TRUNK-07 ch04 | Documented only | DCIM rev 14 · 2 Sep |
| TRUNK-07 ch04 → PP-02 rear position | Unresolved mapping | No record · far end named by LLDP only |
| PP-02 P08 front → CBL-043 → SW-02 Eth1/08 | Recorded · surveyed | DCIM rev 14 · LLDP 10:38 |
| TRUNK-07 ch03 → PP-02 P07 | Documented only | DCIM rev 14 |
| PP-02 P07 → SW-02 Eth1/07 | No cable record | Unlabelled patch lead · REC-031 rev 16 |
| SRV-01 PSU-A / PSU-B → UPS-01 | Recorded | Power records · surveyed cords 13 Oct |
| PDU-A A14 / PDU-B B14 load | Not observed | PDUs report per-phase totals only |
Continuity scenarios
A model, with its
assumptions in view.
Each scenario states its premise, what continuity would rely on, what it assumes and what is not known. It informs the decision owner; it does not predict an outage, and it does not act.
Continuity scenarios · NYC-01
SCN-NET-01Modeled
Eth1/24 path out of service
Premise The primary uplink is taken out of service for verification or replacement.
Traffic would rely on the secondary uplink Eth1/23. It shares TRUNK-07 and SW-02 with the primary, so continuity holds only while both remain healthy. Modeled — not observed.
Would rely on
- Eth1/23 · TX-23 · CBL-041
- TRUNK-07 · ch03
- SW-02 · Eth1/07
Assumes
- Eth1/23 stays as recorded: no input errors 10:05–10:35 (OBS-0149)
- Record rev 16 is correct: the secondary terminates on SW-02
- Capacity headroom on Eth1/23 is not assessed by this scenario
Not known
- SW-02 counters on either uplink
- The physical route into PP-02
- TX-24 optics for the incident window
SCN-PWR-01Modeled
UPS-01 unavailable
Premise UPS-01 becomes unavailable while FEED-1 remains present.
Both supply paths of SRV-01 converge on UPS-01. If UPS-01 were unavailable, SRV-01 would lose both inputs and SVC-01, SVC-02 and SVC-03 would be exposed. SW-01 draws from the same PDUs. Modeled — not observed.
Would rely on
- No alternative recorded for SRV-01
- PSU-A and PSU-B both converge on UPS-01
Assumes
- The recorded chain is complete: cords, outlets, PDUs, breakers, UPS
- SW-01 draws from the same PDUs (A01 / B01), as recorded
- The vendor runtime estimate is not used to predict duration
Not known
- Per-outlet load on A14 and B14
- Any unrecorded bypass or transfer switch
Human review Scenarios inform the decision owner, ops-lead · Operations lead. The decision in force is DEC-12 — “Keep Eth1/24 in service; move traffic to Eth1/23 only if errors rise again.” — approved by netops-lead · Network operations lead. VIPER does not move traffic, change power or alter records.
Continue in VIPER.
Bring one real workflow to the evaluation.
Name the service, the environment and the workflow you want to examine. We scope the evaluation around them.