PocketNOC Core
What this connector does
PocketNOC Core diagnoses, compares, structures, plans and reports on IT incidents from measurements you provide (demonstration fixtures or a JSON bundle conforming to the Probe Protocol), via a Data Adapter.
- Diagnosis — first failure across the layer order, application path.
- Baseline & diff — regressions, device-to-device comparison, fleet vs norm, change timeline.
- Causal discipline — observation / correlation / hypothesis / confirmed; never a cause without proof of isolation.
- Security — cautious triage, IOC plan, graduated containment, chain-of-custody manifest (all as plans).
- Planners — remediation L1→L5, patch rings, rebuild, verification, return to service — in dry-run.
- Incident & LiveOps — incident case file, 12-section report, live LiveOps widget.
What it does not do (yet)
It measures no real device and executes no action. Real measurement will go through a signed Probe (V2) that feeds the same schema without changing the engines; action execution will go through a control plane (OAuth, tenants, RBAC, audit) — later phases.
Principles: unmeasured ≠ healthy · correlation ≠ cause · no irreversible action without a verified backup and approval.
Try it
MCP endpoint: /mcp (or /api/mcp). Call pocketnoc_apercu, then most tools with {"set":"demo"} to load a demonstration incident (expired TLS certificate), or pocketnoc_liveops for the live view.