The Pipeline Is the Product

Running a network at scale is an end-to-end workflow, not a product you buy. It starts with a source-of-truth that defines how the network is supposed to be built, runs through the automation that provisions it, the telemetry that reports back what’s actually happening, the normalization and enrichment that turn raw signal into something usable, the correlation that finds the real problems inside the noise, and the remediation that closes the loop — with validation and feedback ideally carrying it all back to the start. The value a team gets out of this doesn’t come from any single stage. It comes from the whole pipeline working together, built for that team’s people and that team’s infrastructure.

That whole-pipeline view is where I think our industry is heading next. We’ve put years of good work into the source-of-truth — single, then multi, then frameworks to reconcile them — and that work matters; it’s foundational. The evolution underway now is recognizing it as one essential component among several and giving the surrounding stages the same care. Your observability platform is one such component. So is Selector, the example I want to work through here, because it owns a large and important stretch of the pipeline: the collection, normalization, enrichment, and correlation that sits between raw telemetry and any decision worth making. It’s a major part of the workflow rather than the whole of it, and to its credit, it presents itself that way.

What makes Selector worth writing about is how it handles that stretch, and why handling it well sets the company up to do something the whole field is still working out: where AI actually belongs in operations. There’s a lot of energy right now around wiring agentic copilots and autonomous remediation straight into the workflow, which is a natural place for an exciting new capability to start. The harder part shows up when it meets production, because language models are non-deterministic and they can hallucinate, and in a domain where being confidently wrong costs uptime and money, that matters. Selector’s approach is to let its AI build on a proven, deterministic foundation, so the AI is applied where the groundwork has already made it safe.

I saw that foundation up close at AI Field Day 8. Their chief data scientist walked us through a stack where the work that has to be right — what’s normal, what’s anomalous, what’s connected to what — is handled by traditional, well-tested models beneath the AI layer, not by the language model on top. That bottom layer mattered enough to me that I spoke up in the room to keep it from being glossed over. His response stuck with me: lose explainability, and you lose credibility in operations. If a system flags an anomaly, it has to be able to tell you why.

What makes Selector’s approach credible is the order of operations.

At the bottom of their stack, deterministic machine learning does the work that has to be right. Statistical and regression models learn what “normal” looks like for each metric from its own history — self-supervised, no hand-set thresholds — so 300 milliseconds of latency to a data center in Hawaii isn’t an alarm just because it crossed some arbitrary number. Logs are handled by NLP and named-entity recognition, which translates a Cisco “link down” and a Juniper “link down” into the same event, then collapses a million log lines into the handful that matter. None of this is an LLM, and that’s the point. These models can show their work, which is the entire basis for trusting what they tell you.

The LLM only shows up at the top of the stack, and by the time it does, the data has already been correlated, enriched, and reduced from millions of raw signals to a small set of anomalies, each carrying as many as thirty labels of context. The language model handles language and conversation. It never decides what’s true about your network. That boundary — deterministic ML owns the facts, the LLM owns the interface — is the whole trust story, and it’s a sequence that’s easy to get out of order.

Strip away the AI conversation, and Selector is solving something more fundamental: the mess most of us actually live in. A P1 hits, and 250 engineers pile into a war room, each staring at a different tool, none of them sure whether it was the application, the infrastructure, or the network. Selector’s pitch is to consolidate that tool sprawl into one correlated view, take as many as 450 separate anomalies and turn them into a single incident with a probable cause attached, and get the room back down to single digits.

What makes that possible is a deliberate choice they kept returning to: they describe themselves as data-centric — they put the work into the data first and let the models follow it. Their phrase for it was blunt: dirty data in, dirty outcomes out. So normalization is entirely their job, not yours. You don’t clean your multi-vendor telemetry before handing it over; their enrichment layer ingests it raw through a declarative ETL pipeline, joins it against your existing metadata, and adds the neighbor and topology context that makes correlation meaningful later. When their chief data scientist pointed to the “secret sauce,” he meant the enrichment layer.

That detail is the one I can’t stop thinking about, and it leads somewhere our community has been circling for years.

Network automation has put enormous energy into a source-of-truth, and rightly so. Single-source-of-truth, then multi-source-of-truth, then frameworks to reconcile them — each step solved a real problem and moved us forward. Where I’ve landed, building on that work, is that the source-of-truth is one part of the solution, and the pipeline that carries its data, enriches it, and delivers it shaped for your team and your infrastructure is where much of the value gets realized.

This is a little outside my lane, so I went and asked what the data engineering and distributed systems people think. It turns out they worked through this same question a decade ago, and the path they took is instructive.

Their centralized single-source-of-truth warehouse hit a scaling wall. The data lake that followed brought its own well-known lesson about governance, the so-called data swamp. What they learned from all of it was that the authoritative record is the substrate, and the value comes from data served as a product to whoever consumes it. The shift from ETL to ELT came from the same insight: rather than transforming everything into one canonical shape up front, load it raw, preserve the context, and transform for each consumer. Zhamak Dehghani’s Data Mesh, one of the most influential ideas in the space over the past five years, is essentially a long argument that domains should own their data and serve it as a product on a self-serve platform, because centralizing everything in one team and one canonical truth eventually becomes a bottleneck at scale. They draw a hard line between the system of record and the served, enriched, query-ready view sitting on top of it, and they’ll tell you the pipeline that builds that served view is where both the value and the hard engineering live.

Put in their terms, a source-of-truth is data at rest, while a network is fundamentally a data-in-motion problem. The source-of-truth is essential, and the pipeline built on top of it is where that data becomes the product, which is exactly why Selector points to enrichment when you ask what makes the platform work. They’ll happily ingest from your Nautobot or your existing source-of-truth; they simply treat that as the beginning of the work rather than the end of it.

Once the data layer is doing its job, the AI starts earning its keep in ways that actually lighten the work. You stop reading dashboards and start asking questions in plain English. You get the who, what, when, where, and probable cause, plus a next step, instead of a wall of red. The system watches for the chronic, intermittent problems you blink past and flags a device that’s trending toward failure before it fails. An operational twin lets you model what happens if you change a path without touching production, and the same data can sit inside a CI/CD pipeline to test a change before it ships — which is where this stops being monitoring and starts being NetDevOps.

The agentic side is real but appropriately cautious. Yes, they can run playbooks and workflows and partner with Ansible or Puppet to close the loop. But as their head of marketing put it when I asked, most organizations still want a human in the loop, because nobody wants an agent resetting a router on a confident hunch. The capability scales with the customer’s readiness, and that restraint is itself a trust signal.

You don’t have to adopt Selector to take the lesson. The pattern is the one I’d want from anyone bringing AI into network operations: let deterministic, explainable models establish what’s true, treat the source-of-truth as a valued input to the pipeline, treat the pipeline that enriches and delivers the data as the real product, and let the LLM sit at the top as the interface. Get the data foundation right, and the AI has something solid to stand on.

Tech Field Day covered my travel, accommodation, and meals for the event. I was not paid to attend or to write this.