Detect anomalies. Understand incidents. Automate response.
PulseOps is a real-time infrastructure monitoring and incident intelligence platform that combines
AI anomaly detection, automated incident management,
LLM-powered root cause analysis, and multi-channel alert automation.
Modern infrastructure can fail long before a traditional threshold-based alert fires.
A server may gradually consume more memory, experience unusual CPU behaviour, generate abnormal traffic, or exhibit a combination of subtle signals that individually look harmless.
PulseOps turns raw infrastructure metrics into actionable incident intelligence.
Instead of:
Metric → Threshold → Alert
PulseOps follows:
Infrastructure Metrics
↓
Real-Time Ingestion
↓
AI Anomaly Detection
↓
Risk Scoring
↓
Incident Creation
↓
LLM Root Cause Analysis
↓
Recommended Response
↓
Automated Notifications
The result is a system designed to help engineering teams move from:
"Something is wrong."
to:
"This is what happened, why it happened, how serious it is, and what should happen next."
|
|
|
|
|
|
Real-time infrastructure visibility with anomaly scores, host health, alerts and incident activity.
Track incidents from initial detection through investigation and resolution.
┌──────────────────────────────────────────────────────────┐
│ INCIDENT │
├──────────────────────────────────────────────────────────┤
│ Severity CRITICAL │
│ Host server-02 │
│ Status INVESTIGATING │
│ Anomaly Score 0.94 │
│ │
│ Timeline │
│ │
│ 14:21 Anomaly detected │
│ 14:22 Incident automatically created │
│ 14:22 Risk score calculated │
│ 14:23 AI RCA generated │
│ 14:24 Slack escalation triggered │
└──────────────────────────────────────────────────────────┘
PulseOps converts raw telemetry into an engineering-friendly explanation.
┌──────────────────────────────────────────────────────────┐
│ AI ROOT CAUSE ANALYSIS │
├──────────────────────────────────────────────────────────┤
│ │
│ Root Cause │
│ Elevated CPU utilization combined with abnormal │
│ memory pressure on server-02. │
│ │
│ Confidence │
│ High │
│ │
│ Impact │
│ Increased request latency and potential service │
│ degradation. │
│ │
│ Recommended Action │
│ Investigate high-consumption processes and evaluate │
│ recent deployments on the affected host. │
│ │
└──────────────────────────────────────────────────────────┘
┌─────────────────────┐
│ React + Vite │
│ Dashboard │
└──────────┬──────────┘
│
REST + Socket.IO
│
┌──────────▼──────────┐
│ Node.js / Express │
│ Backend │
└─────┬────┬────┬─────┘
│ │ │
┌────────────────┘ │ └─────────────────┐
│ │ │
┌────────▼────────┐ ┌────────▼────────┐ ┌───────▼────────┐
│ MongoDB │ │ Redis │ │ n8n │
│ │ │ │ │ │
│ Metrics │ │ Queue / Cache │ │ Automation │
│ Incidents │ │ Async Processing│ │ Webhooks │
│ Alerts │ │ │ │ │
└─────────────────┘ └────────┬────────┘ └───────┬────────┘
│ │
│ ├── Slack
│ ├── Telegram
│ └── Email
│
┌──────────▼──────────┐
│ FastAPI AI │
│ Service │
├─────────────────────┤
│ Isolation Forest │
│ Anomaly Scoring │
│ Model Management │
└──────────┬──────────┘
│
┌──────────▼──────────┐
│ Groq LLM │
│ Root Cause Analysis │
└─────────────────────┘
Infrastructure metrics are continuously generated by the simulator or connected infrastructure agents.
server-01
server-02 ───────► PulseOps
server-03
The Node.js backend receives individual or batched metric payloads.
POST /api/metrics
POST /api/metrics/bulkRedis decouples high-volume metric ingestion from database persistence and downstream processing.
Incoming Metrics
↓
Redis
↓
Async Processing
↓
MongoDB
The FastAPI service evaluates infrastructure behaviour using an Isolation Forest model.
Metric
↓
Feature Extraction
↓
Isolation Forest
↓
Anomaly Score
↓
Normal / Anomalous
PulseOps aggregates anomaly behaviour to determine host-level operational risk.
Anomaly Frequency
+
Peak Anomaly Score
+
Recent Behaviour
↓
Risk Score
When an anomaly satisfies incident conditions, PulseOps creates an incident and records its timeline.
Anomaly
↓
Incident Engine
↓
Severity
↓
Incident Created
The incident context is passed to the Groq LLM to generate a structured explanation.
Incident
+
Metrics
+
Anomaly Information
↓
Groq LLM
↓
Structured RCA
n8n receives webhook events and triggers the configured notification workflow.
PulseOps
↓
Webhook
↓
n8n
┌─┴──────┬─────────┐
↓ ↓ ↓
Slack Telegram Email
PulseOps uses a two-layer intelligence system.
The Isolation Forest model detects unusual infrastructure behaviour without requiring labelled production failure data.
Traditional monitoring often depends on fixed rules:
IF CPU > 90%
THEN ALERT
This can miss gradual or contextual anomalies.
PulseOps instead learns the characteristics of normal behaviour and identifies observations that are statistically unusual.
Normal Behaviour
████████████████████████████
█
█
█
Anomaly
This makes the system suitable for environments where labelled failure datasets are limited.
Once an incident is identified, the LLM provides human-readable reasoning.
Telemetry
↓
Anomaly Detection
↓
Incident Context
↓
LLM
↓
┌───────────────────────┐
│ Root Cause │
│ Impact │
│ Severity │
│ Explanation │
│ Recommendation │
└───────────────────────┘
This separation keeps machine detection and language-based reasoning as distinct components.
PulseOps provides host-level risk visibility rather than simply displaying individual alerts.
The dashboard tracks:
- Anomaly frequency
- Peak anomaly score
- Recent anomaly behaviour
- Host-level risk
- Historical score trends
Example:
Host Risk
server-01 ███████░░░ 71%
server-02 ██████████ 94%
server-03 ████░░░░░░ 38%
This allows operators to prioritize the infrastructure that requires attention first.
| Layer | Technology |
|---|---|
| Frontend | React 18, Vite, Tailwind CSS v4 |
| Visualization | Recharts |
| Real-Time | Socket.IO |
| Backend | Node.js 20, Express |
| Database ODM | Mongoose |
| AI Service | FastAPI |
| ML | Scikit-learn, Isolation Forest |
| LLM | Groq |
| Queue / Cache | Redis 7 |
| Automation | n8n |
| Notifications | Slack, Telegram, Email |
| Database | MongoDB 7 |
| Reverse Proxy | Nginx |
| Containerization | Docker / Docker Compose |
| Testing | Jest |
| Load Testing | Custom Node.js load-test script |
PulseOps/
│
├── frontend/
│ ├── src/
│ │ ├── pages/
│ │ │ ├── Dashboard
│ │ │ ├── Incidents
│ │ │ ├── Alerts
│ │ │ ├── AI
│ │ │ └── Automation
│ │ │
│ │ ├── components/
│ │ └── hooks/
│ │ ├── useMetrics
│ │ ├── useAlerts
│ │ └── useRiskScores
│ │
│ └── ...
│
├── backend/
│ ├── controllers/
│ │ ├── auth
│ │ ├── metrics
│ │ ├── incidents
│ │ ├── alerts
│ │ └── rca
│ │
│ ├── services/
│ │ ├── alertEngine
│ │ ├── anomalyProcessor
│ │ └── metricsQueue
│ │
│ ├── models/
│ ├── routes/
│ └── __tests__/
│
├── ai-service/
│ ├── routers/
│ │ ├── predict
│ │ ├── train
│ │ └── status
│ │
│ ├── scripts/
│ │ ├── generate_dataset
│ │ └── train_model
│ │
│ └── models/
│
├── simulator/
│ └── simulate.js
│
├── nginx/
│ └── nginx.conf
│
├── scripts/
│ ├── deploy.ps1
│ ├── deploy.sh
│ ├── monitor.ps1
│ └── loadtest.js
│
├── docker-compose.yml
└── README.md
Make sure you have:
- Docker Desktop
- Node.js 20+
- Python 3.11+
- Git
git clone https://github.com/Atharvverma1234/PulseOps.git
cd PulseOpscp backend/.env.example backend/.env
cp ai-service/.env.example ai-service/.envConfigure the backend environment:
MONGO_URI=mongodb://mongo:27017/pulseops
JWT_SECRET=your_secret_here
GROQ_API_KEY=gsk_your_key_hereNever commit
.envfiles or API keys to Git.
cd ai-service
python -m venv .venv.venv\Scripts\activatesource .venv/bin/activateInstall dependencies:
pip install -r requirements.txtGenerate the training dataset:
python scripts/generate_dataset.pyTrain the model:
python scripts/train_model.pyFrom the project root:
docker compose up --buildThis starts the core PulseOps infrastructure:
Frontend
Backend
AI Service
MongoDB
Redis
n8n
Nginx
In another terminal:
node simulator/simulate.jsThe simulator continuously generates infrastructure metrics for multiple hosts.
Example:
PulseOps Simulator
✓ Simulator started
✓ Pushing metrics every 5s
Hosts:
• server-01
• server-02
• server-03
http://localhost:5173
Register an account and open the dashboard.
You should now see infrastructure metrics streaming in real time.
POST /api/auth/register
POST /api/auth/login
GET /api/auth/me{
"name": "John Doe",
"email": "john@example.com",
"password": "password",
"role": "engineer"
}POST /api/metrics
POST /api/metrics/bulk
GET /api/metrics
GET /api/metrics/latest
GET /api/metrics/stats/:hostPOST /api/incidents
GET /api/incidents
GET /api/incidents/:id
PATCH /api/incidents/:id
POST /api/incidents/:id/timeline
GET /api/incidents/statsPOST /api/rca/:id/generate
GET /api/rca/stats
GET /api/ai/risk-summary
GET /api/ai/anomalies
GET /api/ai/score-history/:hostPOST /predict
POST /predict/bulk
GET /model/status
POST /trainRun the backend test suite:
cd backend
npm testGenerate coverage:
npm run test:coveragePulseOps includes a custom metric ingestion load-test script.
node scripts/loadtest.jsExample configuration:
Target:
localhost:5000
Endpoint:
/api/metrics/bulk
Concurrency:
10
Requests:
200
Batch Size:
5
This can be used to evaluate the metric ingestion pipeline under concurrent traffic.
PulseOps is designed as a multi-service containerized system.
Docker Compose
│
┌──────────────────┼──────────────────┐
│ │ │
Frontend Backend AI Service
│ │ │
│ ┌────┴────┐ │
│ │ │ │
│ MongoDB Redis │
│ │
└──────────────────┬──────────────────┘
│
Nginx
│
Client
This makes the platform easy to reproduce locally and provides a foundation for production deployment.
docker compose up --build.\scripts\deploy.ps1./scripts/deploy.sh.\scripts\monitor.ps1Production infrastructure rarely provides perfectly labelled datasets containing every possible failure mode.
Isolation Forest provides an unsupervised approach that learns normal behaviour and identifies unusual observations.
Benefits:
- No labelled production failures required
- Lightweight inference
- Suitable for numerical telemetry
- Easy to retrain
- Works well as an anomaly scoring layer
Directly writing every incoming metric to MongoDB can create unnecessary pressure during traffic spikes.
Redis acts as a buffering and processing layer:
High-volume ingestion
↓
Redis
↓
Batch processing
↓
MongoDB
This separates ingestion from persistence and provides a more resilient processing pipeline.
Incident response frequently requires integrations with external systems.
Instead of hard-coding every integration into the backend, PulseOps delegates workflow orchestration to n8n.
PulseOps Event
↓
Webhook
↓
n8n
↙ ↓ ↘
Slack Telegram Email
New integrations can therefore be added without heavily modifying the core application.
Root cause analysis is an interactive operation where response latency matters.
Groq provides low-latency LLM inference suitable for generating structured incident analysis while keeping the LLM layer independent from the anomaly detection system.
PulseOps includes several backend security mechanisms:
- JWT-based authentication
- Protected API routes
- Request rate limiting
- Authentication-specific rate limiting
- Environment-based secrets
- Helmet security middleware
- CORS configuration
- Input validation
- Cooldown-based alert deduplication
Secrets should always be supplied through environment variables rather than committed to source control.
┌──────────────┐
│ DETECTED │
└──────┬───────┘
│
▼
┌──────────────┐
│ OPEN │
└──────┬───────┘
│
▼
┌─────────────────────┐
│ INVESTIGATING │
└──────────┬──────────┘
│
▼
┌─────────────────────┐
│ RESOLVED │
└─────────────────────┘
Every transition can be represented in the incident timeline, creating an operational history that can be used for investigation and post-incident analysis.
PulseOps brings together four traditionally separate layers:
┌─────────────────────────────────────────────────────────┐
│ OBSERVABILITY │
│ │
│ Metrics ───────► AI Detection ───────► Risk │
│ │ │
│ ▼ │
│ Incident │
│ │ │
│ ▼ │
│ AI Root Cause │
│ │ │
│ ▼ │
│ Automation │
│ │ │
│ ┌────────┼────────┐ │
│ ▼ ▼ ▼ │
│ Slack Telegram Email │
└─────────────────────────────────────────────────────────┘
The architecture is intentionally designed to support future expansion.
- Real-time infrastructure dashboard
- Socket.IO metric streaming
- MongoDB metric persistence
- Redis processing layer
- Isolation Forest anomaly detection
- Host-level risk scoring
- Incident lifecycle management
- AI-powered RCA
- Alert engine
- n8n automation
- Slack / Telegram / Email workflows
- Docker Compose deployment
- Load testing
- Backend test suite
- Kubernetes integration
- Prometheus integration
- Grafana integration
- Distributed tracing
- Predictive incident detection
- Automatic remediation
- Multi-tenant organizations
- SSO / OAuth
- Advanced incident correlation
- Historical incident learning
Traditional monitoring answers:
"Did a threshold get crossed?"
PulseOps aims to answer:
"Is this behaviour unusual, how risky is it, what caused it, and what should the team do next?"
Metric
↓
Static Threshold
↓
Alert
↓
Human Investigation
Metric
↓
AI Anomaly Detection
↓
Risk Scoring
↓
Incident Intelligence
↓
LLM Root Cause Analysis
↓
Recommended Action
↓
Automated Escalation
The goal isn't simply to generate more alerts.
The goal is to reduce the amount of investigation required after an alert occurs.
React • Node.js • Express • FastAPI • Python • Scikit-learn • MongoDB • Redis • Groq • n8n • Docker
Atharv Verma
Electrical & Electronics Engineering Student Dayananda Sagar College of Engineering, Bengaluru
This project is licensed under the MIT License.
Observe → Detect → Understand → Respond
Built to make infrastructure incidents less reactive and more intelligent.