Multi-agent coordination for network anomaly detection, troubleshooting, and remediation using language models

1. A method comprising:

receiving, at a troubleshooting agent executed by a device, an indication of an anomaly detected in a network by an anomaly detection agent;

using, by the troubleshooting agent, a language model to determine a root cause of the anomaly;

determining, by the troubleshooting agent, whether automated remediation for the root cause is allowed by a policy;

providing, by the troubleshooting agent, a remediation request to a remediation agent in the network to remediate the root cause of the anomaly, when the policy allows automated remediation for the root cause; and

receiving, at the troubleshooting agent, a filtering request from the remediation agent to prevent the troubleshooting agent from sending a subsequent remediation request, when the remediation agent is unable to remediate the root cause of the anomaly.

2. The method as in claim 1 , wherein the language model is a large language model.

3. The method as in claim 1 , wherein the language model determines the root cause of the anomaly based on a knowledge base of previously resolved support tickets for the network.

4. The method as in claim 1 , further comprising:

receiving, at the troubleshooting agent, an indication that the remediation agent was able to remediate the root cause of the anomaly; and, in response,

using the indication to update a knowledge base that the troubleshooting agent uses to troubleshoot anomalies.

5. The method as in claim 1 , further comprising:

providing, by the troubleshooting agent, an anomaly detection rule to the anomaly detection agent that causes the anomaly detection agent to associate the root cause with a further anomaly that it detects.

6. The method as in claim 1 , further comprising:

providing, by the troubleshooting agent, an indication to the anomaly detection agent when it cannot determine a root cause of a subsequent anomaly detected by the anomaly detection agent.

7. The method as in claim 1 , further comprising:

determining, by the troubleshooting agent and based on user feedback, whether the anomaly is relevant, before determining the root cause of the anomaly.

8. The method as in claim 1 , wherein the troubleshooting agent sends the remediation request to the remediation agent according to a policy that selects the remediation agent from among a plurality of remediation agents.

9. The method as in claim 1 , wherein the anomaly is specific to a particular online application accessed via the network.

10. An apparatus, comprising:

one or more network interfaces;

a processor coupled to the one or more network interfaces and configured to execute one or more processes; and

a memory configured to store a process that is executable by the processor, the process when executed configured to:

receive, at a troubleshooting agent executed by the apparatus, an indication of an anomaly detected in a network by an anomaly detection agent;

use, by the troubleshooting agent, a language model to determine a root cause of the anomaly;

determine, by the troubleshooting agent, whether automated remediation for the root cause is allowed by a policy;

provide, by the troubleshooting agent, a remediation request to a remediation agent in the network to remediate the root cause of the anomaly, when the policy allows automated remediation for the root cause; and

receive, at the troubleshooting agent, a filtering request from the remediation agent to prevent the troubleshooting agent from sending a subsequent remediation request, when the remediation agent is unable to remediate the root cause of the anomaly.

11. The apparatus as in claim 10 , wherein the language model is a large language model.

12. The apparatus as in claim 10 , wherein the language model determines the root cause of the anomaly based on a knowledge base of previously resolved support tickets for the network.

13. The apparatus as in claim 10 , wherein the process when executed is further configured to:

receive, at the troubleshooting agent, an indication that the remediation agent was able to remediate the root cause of the anomaly; and, in response,

use the indication to update a knowledge base that the troubleshooting agent uses to troubleshoot anomalies.

14. The apparatus as in claim 10 , wherein the process when executed is further configured to:

provide, by the troubleshooting agent, an anomaly detection rule to the anomaly detection agent that causes the anomaly detection agent to associate the root cause with a further anomaly that it detects.

15. The apparatus as in claim 10 , wherein the process when executed is further configured to:

provide, by the troubleshooting agent, an indication to the anomaly detection agent when it cannot determine a root cause of a subsequent anomaly detected by the anomaly detection agent.

16. The apparatus as in claim 10 , wherein the process when executed is further configured to:

determine, by the troubleshooting agent and based on user feedback, whether the anomaly is relevant, before determining the root cause of the anomaly.

17. The apparatus as in claim 10 , wherein the troubleshooting agent sends the remediation request to the remediation agent according to a policy that selects the remediation agent from among a plurality of remediation agents.

18. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

receiving, at a troubleshooting agent executed by the device, an indication of an anomaly detected in a network by an anomaly detection agent;

using, by the troubleshooting agent, a language model to determine a root cause of the anomaly;

determining, by the troubleshooting agent, whether automated remediation for the root cause is allowed by a policy;

providing, by the troubleshooting agent, a remediation request to a remediation agent in the network to remediate the root cause of the anomaly, when the policy allows automated remediation for the root cause; and

receiving, at the troubleshooting agent, a filtering request from the remediation agent to prevent the troubleshooting agent from sending a subsequent remediation request, when the remediation agent is unable to remediate the root cause of the anomaly.