The Logmetry BlueprintEvery phase
What AI native actually means. An estate your agent can read.
Most estates are configured in consoles and cannot be read as a whole, by a person or by anything else. Holding the estate as code is not a delivery preference, it is the thing that makes AI on your operations possible.
AI native, phase by phase
- 01 FoundationThe pipeline, every route and the Lake, held as files an agent can read.
- 02 AI triageAn agent that investigates on the Lake and finds the cause.
- 03 RemediationThe same agent writes the fix and opens the pull request.
- 04 FootprintCollector configuration, alert rules and dashboards an agent can change by pull request.
01The loop
Agentic remediation, end to end
On an estate held as code the Agent can work the loop without touching production: it investigates the alert on the Lake copy, read-only, proposes the correction, and opens a pull request that a person approves before the merge updates the estate.
The loop starts where your team already lives: an alert fires from the SIEM, the APM, or the metric store, and the Agent picks it up the moment it does. It investigates on the Lake, where the full-fidelity history is enriched and correlated, and it reaches back into the platforms over MCP when their context helps. Everything it finds, the hypothesis, the evidence, and what it checked, lands in the ServiceNow ticket your service desk already opened, because that ticket is your current flow and the Agent joins it instead of replacing it.
Then comes the part no console can offer. When the fault sits in configuration, in a routing decision, in an alert rule, or in the infrastructure itself, those are all files in your repositories, so the Agent does not stop at a diagnosis. When it is confident, it writes the correction and opens a pull request linked into that same ticket. When it is not, it does not touch the code: the findings still land in the ticket, and a person takes it from there. Either way the human is the gate: a person approves the diff, the pipeline tests it, and the merge is what updates the estate.
And then the loop closes. The corrected estate runs until the next alert, every fix is a commit with an author and a reason, and the playbooks sharpen with every pass. This is why everything as code is not a delivery preference: it is the difference between an assistant that describes your problems and an Agent that fixes them.
02Four capabilities
What a readable estate can do
An estate held as code can be asked, edited, audited, and worked by agents, and each of those is a file operation rather than a console feature.
Answers come out of the files.
What is running, why it is configured this way, what changed this morning. The answer comes out of the files rather than out of whoever set it up, so it survives that person leaving and it does not begin with learning a query language. People who do not write code get answers too.
You ask
Why does the firewall pipeline drop debug events?
The answer
pipelines/firewall.yaml drops them before routing. The rule came in with the change that onboarded the source, and your team reviewed it.
A change is a few lines in a file.
What used to be a click in a console is a few lines in a file. You describe the change to a coding agent, it makes the edit, and it goes through the same pipeline as everything else: reviewed, tested and validated before it ships. Safe by process rather than by care.
You describe
Send the new VPN logs to the SIEM and the Lake.
What happens
A pull request against routing/destinations.yaml, tested by the pipeline, waiting for your review.
Every change has an author and a reason.
Every change is a commit with an author, a date and a reason. When something breaks, the change that broke it is findable, whether it landed this morning or two quarters ago. That is the question a dashboard has never once answered.
You ask
What changed before the proxy alerts went quiet?
The answer
One commit yesterday: a new parser for the proxy logs, its author, its reviewer, and the reason it gave.
Requests become pull requests.
Much of the service desk queue is requests, not incidents: onboard this source, add an alert, raise a threshold. The Agent picks the ticket up, writes the change into the repository that rule lives in, and opens a pull request. Somebody reviews and merges, and the pipeline ships it.
The ticket
Onboard the logs from the new HR system.
What the Agent does
A pull request in pipelines/, linked to the ticket, for someone on your team to review and merge.
03The scope
What the Agent can reach
The readable estate spans the stack, the knowledge, and the infrastructure, because all three are files in the same repositories.
The Stack
Collection, routing and enrichment, the Lake, and the alert rules and dashboards on every destination, including the platforms you keep.
The Knowledge
Runbooks, service ownership, and the notes explaining how the parts relate, kept as files beside the code they describe rather than in a wiki nobody opens.
The Estate
The infrastructure itself declared as code, so a resource that is wrong is a file that is wrong, and correcting it is the same motion as everything above.
Your platforms sell a version of this too. Theirs is an assistant living inside their own console, so it reasons about what that console holds and stops at its edge. The same idea over an estate you hold as code reaches the collection layer, the destinations, the Lake and the infrastructure underneath, because every part of it is readable. That is what AI native means here, and it is why the phases run in the order they do.
04The direction
AI on a Lake, on open table formats
The direction of travel is AI working directly against telemetry held in open table formats, because open storage is what keeps years of history readable by every model you will ever run.
The Lake built in Phase 01 is partitioned the way investigations move, so it serves compliance, audit and the agents at once. Every model you point at it, today's or the one you swap in later, reads the same clean, enriched history.
That is the foundation the market's AI features will stand on, and owning it is the difference between renting intelligence and running it.
05Questions
Asked about AI native
What does AI native actually mean here?
That the estate is readable. Most estates are configured in consoles and cannot be read as a whole by a person or by anything else. Held as code, the collection layer, the destinations, the Lake and the infrastructure underneath are all reachable by the same Agent, which is what the platform assistants cannot do.
How is this different from the AI our platforms sell?
Their assistant lives inside their own console, reasons about what that console holds, and stops at its edge. The same idea over an estate you hold as code reaches everything, because every part of it is a file. That difference is architectural, not a feature gap that closes next quarter.
Where does the Lake fit in?
AI on your telemetry is only as good as the data it reaches. The Lake holds full-fidelity history, enriched and partitioned for retrieval, on open table formats, which is the direction the whole market is moving for exactly this reason: open storage is what keeps the data readable by every model you will ever run.
Which model does this run on?
Whichever you choose, and that choice is a configuration knob rather than an architecture decision. Frontier or open weight, in your cloud. Every capability on this page reads the same foundation, so swapping the model later rebuilds nothing.
See your architecture drawn, with the costs, before you spend anything.
Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing