◆ Ritam · AIOps Engine (DarkNOC)

Stop reading alarms.
Close the loop.

Ritam — MatreComm’s AIOps engine (a true DarkNOC, lights-out NOC) — is the brain that turns intent into action. Declare the outcome you own; Ritam holds it true.

It ingests every signal, collapses the storm to one root cause, and remediates — then verifies and learns. On-prem and sovereign.

Book a demo →See the loop
TSLAM4b · ARGUS · TVECOn-prem & sovereignProven at ARKNOCYou stay in command
Alarm storm → one causeREASONING
214 alarms, one fibre cut214 → 1
The problem

Networks are run by alarm, not by goal.

Every domain has its own NMS, its own team and its own alarms. Faults are chased vendor-by-vendor after they hit, headcount grows with complexity, and no one is steering toward a declared outcome.

5–8 hrs
average MTTR — manual, vendor-by-vendor fault chasing
>85%
alarm noise — engineers lose most of a shift to false positives
6–12
separate NMS tools — optical, IP, RAN, core, access, zero correlation
100+
NOC FTEs — just to watch alarms, and it grows with the network
Watching alarms is not operating a network.You can’t scale by adding operators. A network has to be run by the outcomes it commits to — goals held true across every domain at once.
The thesis

Declare the outcome. Ritam holds it true.

You stop watching alarms and start declaring what the network must hold. Ritam measures it, drives toward it, and pre-empts anything drifting toward breach.

Alarm-driven — reactive
Goal-driven — autonomous
Operators watch alarms and react to faults
You declare the goal — “session success > 99.9%”
Each domain investigated vendor-by-vendor, for hours
Ritam correlates across every layer — RCA in <60s
Faults found after they hit the customer
Degradation predicted 30–90 min ahead, pre-empted
Headcount grows with network complexity
Ritam runs operations autonomously, on your approval
“With you in command.” Ritam remediates known classes autonomously; anything material is proposed, dry-run and approved. Full audit trail, always.
The Ritam loop

WATCH → DX → PLAN → ACT — a closed loop, not a dashboard.

Ritam replaces alarm-watching with a continuously-running cycle. It runs the same loop across every domain, all day, every day.

WATCH

Sense everything

100% telemetry across every domain — SNMP, gRPC/gNMI, syslog, flow, API. Zero blind spots.

DX

Predict & diagnose

TSLAM4b flags degradation 30–90 min ahead; ARGUS names one cross-domain root cause in <60s.

PLAN

Decide the safe fix

Ritam reasons over the cause and your runbooks — blast-radius and policy checks before anything runs.

ACT

Act & learn

Multi-vendor action via NETCONF/YANG, on approval and fully logged — then it verifies the fix and learns.

Inside Ritam

Three engines under one brain.

Ritam's reasoning is three specialised models working together — predict, reason, correlate — each earning its place in the loop.

TSLAM4b

Temporal-spatial anomaly detection — a behavioural fingerprint per entity. Flags degradation 30–90 min ahead; 90%+ of noise suppressed.

ARGUS

Multi-turn causal reasoning — one true root cause across domains in under 60 seconds. Tells a misconfiguration from a genuine attack.

TVEC

Transfer-vectors & event correlation — separates causal chains from coincidence, killing the false-positive RCA that wastes a shift.

The learning flywheel. Every fault, remediation and false-positive feeds Ritam — it gets measurably more accurate week over week, with zero manual retraining. By Year 3, full autonomous coverage frees 70–75% of NOC effort.
The architecture

Carrier-grade, on-prem, sovereign by design.

A data plane built for millions of events per second, a reasoning core that runs entirely in your data centre, and closed-loop control back out to the network.

INGESTEvery signal, every vendor
SNMPsysloggRPC / gNMINETCONFflowRESTTL1 (optical)BGP-LS40+ vendors
↓
SUBSTRATECarrier-grade data plane
Redpanda — streamScyllaDB — stateJanusGraph — topologyRedis — cachemillions of events/sec
↓
REASONThe Ritam core
Seastar C++20 engineon-prem Qwen3 MoE LLMTSLAM4bARGUSTVECWATCH→DX→PLAN→ACT
↓
ACTClosed-loop control
NETCONF / YANGgNMIvendor APIsSON / PRBLSP re-routeautonomous on approval · audited
Your data never leaves. The reasoning core — including the Qwen3 MoE LLM — runs on your infrastructure for full residency. ARKNOC proves the same engine also runs cloud-native at hyperscale when you want it.
Cross-domain, end-to-end

One fault, three domains, under a minute.

An optical event in transport cascades into a mobility outage — a chain no single-domain NMS can follow. Ritam connects it and pre-empts the customer impact.

T–60 min

Transport

An optical span's OSNR slopes down on a Nokia system — ~60 min to an OTN fault.

T–58 min

Transport

The correlated IP/MPLS LSP on the same physical route begins to flap.

T–55 min

Mobility

5G core sessions riding that backhaul path start failing setup.

T–52 min

Ritam

Links all three to one root cause, pre-positions traffic and re-routes the LSP — before the span drops.

5–8 hrs
Siloed NMS — time to root cause.
<15 min
Ritam — pre-empted, on approval.
1
One root cause across three domains — remediated before a subscriber ever noticed.
One engine, every domain

Ritam is horizontal. It powers the whole portfolio.

The same engine runs beneath both suites — prove it in one place, extend it across the estate without re-integrating.

CraftWorld · Telco

Carrier operations

Mobility, transport and access — run by experience and reliability goals.

Mobility →Transport →Access →
CraftUnify · Enterprise

The programmable enterprise

Network, security, applications and IT — plus experience and compliance surfaces.

CraftUnify →CraftDEM →CraftCompliance →
Production proof

ARKNOC — goal-driven ops, live at Tier-1 scale.

This isn't a lab benchmark. Ritam runs a multi-vendor NOC in production for a Tier-1 Indian operator — auditable metrics from a real network. On-prem is the default; ARKNOC proves it also runs cloud-native at hyperscale.

Live in production

Tier-1 Indian mobile operator

400M+subscribers served
Multi-vendorNokia · Ericsson · Huawei · Cisco
Multi-techDWDM · IP/MPLS · 4G/5G core · RAN
Hyperscalecloud-native NOC (Azure) — on-prem available
43%
MTTR reduction
first 90 days — auditable
90%+
Alarm noise suppressed
TSLAM4b false-positive elimination
37%
Incident reduction
proactive, before escalation
75%
NOC effort freed
by Year 3, progressive coverage

Auditable production metrics from a live Tier-1 deployment — operator reference calls by arrangement.

Product tour

The engine, on screen.

What an operator sees when Ritam is holding the network true.

Ritam — incident & root-cause view
Ritam — approval gate
Engineered for scale

Built to sense everything, everywhere.

4M ev/s
Sustained event throughput on the carrier-grade data plane.
40+
Vendors and technologies correlated in one control plane.
<60 s
Cross-layer causal RCA — optical → IP → service.
Trust & sovereignty

Autonomous — and answerable to you.

Autonomy without control is a liability. Ritam is built so operators stay in command and every decision is auditable.

◎

Approval gates

You approve what matters. Ritam proposes and dry-runs before any material change — nothing surprising ever executes.

◆

Explainable RCA

Every root cause shows its evidence chain — the correlated signals across domains that led to it. No black box.

▧

Sovereign & on-prem

Runs in your data centre on an on-prem Qwen3 MoE LLM — full data residency. Proven cloud-native at hyperscale too.

☰

Full audit trail

Every action, approval and outcome logged — ready for compliance, post-incident review and operator sign-off.

See it live

The Ritam console.

The alarm storm collapsing to one root cause, the WATCH→DX→PLAN→ACT loop mid-flight, and an approval gate awaiting sign-off.

The Ritam console
See it on your estate

See Ritam hold your goals true.

A performance-guaranteed PoC on your priority domain — baselined, KPI-gated, reversible.

Book a demo →Request a scoped PoC