The Agentic NOC Is Real And Now You Can Build It Yourself
February 25, 2026
Network Copilot ™
Network Copilot™ 1.5.6 introduces custom agent upload, management, and role-based access control; putting extensibility directly in the hands of the teams who operate the network.
Three Steps to a Custom Agent
- Build and test in the Network Copilot™ sandbox using the Agent SDK. Example agents and documentation are available at github.com/AvizNetworks/ncp-sdk-examples.
- Admin onboards the agent through an approval workflow. It’s immediately available to Power Users.
- Ready to use. For users beyond Power Users, administrators grant access through custom roles; controlling which teams see which agents.
Aviz Networks continues to offer agent authoring and support services for organizations that want help getting started.
Custom agents leverage the same reasoning engine, data connectors, and integrations as built-in agents but encode your logic, your runbooks, your escalation procedures. They operate interactively or autonomously, integrate with external systems via MCP servers, and push notifications through Slack, RocketChat, ServiceNow, or Zendesk.
No vendor can anticipate every operational scenario in every environment. The processes that differentiate a high-performing NOC are the ones that the team built themselves. Release 1.5.6 gives those processes a runtime.
What Is Network Copilot™?
Network Copilot™ is an AI operations platform built by Aviz Networks for network engineers, architects, NOC/SOC operators, SREs, and IT infrastructure teams. It connects to the tools you already rely on; controllers, CMDBs, observability platforms, ticketing systems, security appliances; and provides a unified natural language interface for querying, correlating, and acting on that data across multi-vendor environments (Cisco, Arista, SONiC, Fortinet, Palo Alto) and platforms (Splunk, ELK, ServiceNow, Zendesk, NetBox, SolarWinds, Snowflake, and more).
The goal isn’t to replace your tools. It’s to make them work together.
Your Data Is Already There; Its Just Trapped
Most organizations have the telemetry, logs, and configuration data they need. The problem is silos. Flow data in Splunk, inventory in NetBox, tickets in ServiceNow, firewall logs in ELK, runbooks in a shared drive.
Network Copilot™ frees that data and synthesizes insights by combining network telemetry with operational context; runbooks, policies, application dependencies, organizational structure, geographical metadata; that your team already maintains but rarely correlates at speed. The result: answers no single tool could produce on its own, in plain language, in seconds.
Neurosymbolic; Not Purely Symbolic
Recent industry analysis has categorized Network AIOps architectures as symbolic (pre-defined actions selected by AI), neural (AI as the reasoning engine), or neurosymbolic; combining neural networks that understand language and reason flexibly with symbolic systems that enforce structured rules and verifiable accuracy. Network Copilot is neurosymbolic; intentionally.
The reasoning engine uses ReAct and Chain-of-Thought to perform multi-step troubleshooting, correlate temporal events across data sources, and synthesize root cause analysis. It plans retrieval sequences, interprets results in context, and reasons about what to investigate next. At the same time, use-case agents provide deterministic guardrails; security audits, compliance checks, and troubleshooting workflows executed through structured, bounded paths.
Neural reasoning where you need flexibility. Symbolic execution where you need reliability. Answers that are both intelligent and verifiable.
What This Looks Like in Practice
A ticket comes in: a server has lost reachability.
Network Copilot™ searches for similar past incidents to inform root cause analysis. It checks the ARP service on the connected switch, correlates logs, and determines the service has stopped. It restarts the service, then validates; ARP is running, reachability is restored, the server appears in the ARP table. It summarizes findings, attaches troubleshooting notes and logs, and updates the ticket.
That’s not a scripted runbook. The reasoning engine assessed, planned, executed, validated, and documented; the same sequence an experienced engineer follows, compressed into seconds. MTTR drops. Institutional knowledge gets captured automatically.
Not a Data Lake
Network Copilot™ does not create another centralized data store. Enterprise data sources constantly change; new tools, vendor swaps, schema evolution, firmware upgrades. Pre-normalizing everything is a losing battle.
Instead, the LLM understands your data sources, their schemas, and use-case context provided by agents. Normalization happens on the fly at query time. When sources change, the system adapts. When a new tool is added, a connector brings it in without migration.
From Command Line to Common Language
Network Copilot™ replaces the Command Line Interface with the Common Language Interface. Users express queries and automation in plain language; the system translates intent into action across whatever infrastructure sits underneath. Hardware refreshes, vendor changes, and tool replacements no longer break the way your team works.
Also in Release 1.5.6
Expanded Observability. Improved ELK integration for firewall logs and network flow telemetry; richer correlation between firewall events and network behavior for teams running Fortinet or Palo Alto alongside ELK.
For a practical example of how this improved ELK integration support can be applied to firewall logs and network flow telemetry in a real-world troubleshooting workflow, see the “Breaking Silos with Network Copilot Agentic AI: Correlating FortiGate and Splunk for Intelligent Operations” guide.
Platform Hardening. Stability, performance, and reliability improvements across core services with enhanced security hardening.
Smoother Deployment. Streamlined installation and upgrade workflows for faster time-to-value.
Full release notes in the product documentation.
The Best Time to Start Is Now
Your data, infrastructure, and tooling are constantly changing. That’s not a blocker; its exactly what Network Copilot™ was designed for. It works with what you have today, shows you what your tools are actually telling you, surfaces overlaps and data quality issues, and identifies gaps. That visibility alone pays for the effort of getting started.
Frequently Asked Questions
What did Network Copilot 1.5.6 add for teams who want to build their own agents?
Release 1.5.6 lets teams build custom agents in the Network Copilot sandbox, upload them through an admin approval workflow, and control exactly which teams get access through role-based permissions. Custom agents use the same reasoning engine, data connectors, and integrations as built-in agents but encode the team's own logic, runbooks, and escalation procedures rather than a vendor's generic defaults.
Why does Network Copilot not replace the tools a team already uses?
The goal is to make existing tools work together not swap them out. Flow data in Splunk, inventory in NetBox, tickets in ServiceNow, firewall logs in ELK all stay where they are. Network Copilot connects them and correlates the data at query time so teams get answers no single tool could produce on its own, in plain language, in seconds.
What does neurosymbolic mean and why does Network Copilot use that approach?
Neurosymbolic combines neural networks that reason flexibly with symbolic systems that enforce structured rules. Network Copilot uses ReAct and Chain-of-Thought for multi-step troubleshooting and root cause analysis where flexibility matters. Use-case agents then provide deterministic guardrails for security audits, compliance checks, and troubleshooting workflows where reliability matters. Neural where you need flexibility, symbolic where you need certainty.
How does Network Copilot handle a real incident like a server losing reachability?
When a ticket comes in about lost reachability, Network Copilot searches past incidents, checks the ARP service on the connected switch, correlates logs, finds the service has stopped, restarts it, validates reachability is restored, then summarises findings and updates the ticket. The whole sequence happens in seconds. No scripted runbook drives it. The reasoning engine assesses, plans, executes, validates, and documents on its own.
Does Network Copilot create a centralised data store that needs constant maintenance?
No. Pre-normalising data from constantly changing enterprise sources is a losing battle. Instead the LLM understands data sources and their schemas directly. Normalisation happens at query time. When a tool changes or a new one gets added, a connector brings it in without any migration work. The system adapts rather than breaking.
What other improvements shipped in Network Copilot release 1.5.6 besides custom agents?
Three other areas got updated. ELK integration improved for firewall logs and network flow telemetry with richer correlation between firewall events and network behaviour for Fortinet and Palo Alto users. Platform hardening brought stability, performance, and reliability improvements with enhanced security. Deployment workflows were streamlined for faster installation and upgrades.
What is the Common Language Interface and how is it different from a command line?
Network Copilot replaces the Command Line Interface with what it calls the Common Language Interface. Instead of writing CLI commands for each vendor's hardware, teams express what they want in plain language and the system translates intent into action across whatever infrastructure sits underneath. Hardware refreshes, vendor changes, and tool replacements no longer break the way the team works.
