• 28 May, 2025
• No Comments

Planned: The PJ Networks Open-Source NOC Solution

You see, and after a 3rd coffee, here I stare at my desk and think about how much PJ Networks has achieved — and how much the open source tools that power our custom NOC solution get leveraged. Beginning my career as a network admin in 1993, I recall having to fight with PSTN muxes, and I even caught the Slammer worm all up in my face. Those early days informed my worldview: pragmatic, flexible, and hopefully a bit skeptical of shiny buzzwords. Fast forward to today. Our NOC uses no fluff, armchair-tools to monitor, alert and secure our clients’ very crucial infrastructure – including some recent zero-trust upgrades and implementations in older, character-building banks (yes, they really do want rock-solid visibility). Let me show you how we design this beast, why these tools kick proprietary solution’s butts, and some of the tricks I have learned in 30 years in the trenches to style them.

Why Open-Source? Here’s the thing—

The security industry is always eager to slap AI-powered on every product, but I’m skeptical. Automation and intelligent detection Aren’t these what we call automation and intelligent detection? Sure. Neural networks making decisions for your firewall? No thanks. Open-source offers us transparency, flexibility, and control, the foundation of strong cyber security. When you are managing your own NOC, flexibility triumphs over shiny, closed-box one-size-fits-all solutions every time.

Indeed, our open-source stack allows us to:

• Customize monitoring based on client’s requirement not with vendor’s lock.
• Merge data from various sources.
• Troubleshoot and innovate on the fly during live incidents (been there, done that — recall Slammer?).

NOC Architecture Elements of the PJ Networks Core

Here is a simplified diagram that shows how a normal deployment from us may look like.

Diagram callout: Mid-center, Zabbix acts as our central monitoring engine, able to receive metrics sent by network devices, servers and security appliances. Grafana provides a clean interface for these metrics, while we use ELK (Elasticsearch, Logstash, Kibana) stack to provide deep log analytics and incident forensics. Alerts get routed to integrated communication channels —Slack, email, SMS – to notify the NOC team.

Zabbix – The Heartbeat of Your NOC

Zabbix also like Zabbix if need real time monitoring for diversified networks. In the old days, network admins used clunky SNMP tools that gave them very limited abilities to see what was going on with the traffic. Zabbix leveled the field by introducing custom scripts and flexible triggers.

Why Zabbix?

• Extremely scalable for enterprise use.
• Among SNMP, IPMI, JMX and custom APIs.
• Excellent API for ticketing and chatops tools integrations.

Integration tips:

• For automatic device discovery you can use low-level discovery and templates.
• Tailor alert thresholds on a per client environment basis, not every ping fail is the end of the world.
• Develop user scripts in Perl or Python to enhance monitoring (ie: customer voice traffic KPIs for those multiplexers I used to support).

Grafana – Data Analysis Is Just A Dashboard Away!

Grafana provides the visualization layer for us. Nothing like building a platform for dashboards that even your easygoing, non-tech bank manager can look at one day and get it. I’ve seen the days where network monitoring dashboards were broken Excel sheets (yuck).

Key things we do:

• See Zabbix data in native plugins to prevent from loosing single pane of glass.
• Merge ELK analytics logs with real-time dashboards for correlated data.
• Setup Grafana alerting with top level alarms (abuse spikes on DB? Possible reconnaissance).

ELK Stack – The Logs Never Lie

Zabbix is for “health,” but logs are for “why something is wrong”. Our forensic powerhouse is ELK (Elasticsearch, Logstash, Kibana). I recall toiling over the early SIEMs, which acted like black boxes — dull and also slothlike.

Our workflow:

• Logstash to ingest Logs firewalls, IDS/IPS, servers etc.
• We use Elasticsearch to indexes and store logs - which makes for super fast queries.
• Analysts hunt threats with custom views in Kibana.

Here is a pro tip: You can do that with Logstash filters to normalize logs across devices. It hurts, but could save you hours in incident response.

How It All Works: The Integration Workflow

We have a workflow pipeline: Our workflow looks like this.

1. Collecting Data: Zabbix agents gets queried by devices & servers. Logstash follows logs dumped by security appliances.
2. Storage: Metrics data is stored in the Zabbix database, logs are stored in Elasticsearch.
3. Visualization: Grafana is fetching from Zabbix APIs, Kibana is querying Elasticsearch.
4. Notification: Zabbix notifies the concerned person for a particular event generation considering the configured thresholds; integrated with PagerDuty, Slack.
5. Incident Response: Kibana logs to investigate anomalies brought up by the alerts.

Diagram callout The data flow that ensures there are no blind spots Accept metrics as they give you health, accept logs as they give you context.

Custom Tips from my Desk

I’ve learned a few things over the years that might spare you headaches:

• Alert tuning first: Noise is the killer of attention. Set dynamic thresholds. Bombarding reminders every 5 minutes? No one’s gonna listen.
• Use community templates but test them: Plenty of out-of-the-box templates are available for Zabbix and ELK. But they often lack context for your specific environment.
• Central authentication: Connect with LDAP or Active Directory for role based access. Nobody should see everything, unless they want to.
• Script routine activities: Scripts to add devices/dev endpoints can be worth hours. I’m writing some fast Python scripts for our bulk network device monitoring arrangements.
• Backup everything: Zabbix configuration dumps, Grafana dashboards, ELK indexes are your life when shit happens.

Quick Take

Short on time? Here’s what you need to know about PJ Networks open source NOC:

• Zabbix does monitoring healthes with a flexible and scalable poller and alerter.
• All information is presented in consolidated dashboards with Grafana.
• The ELK stack itself goes on the hunt for threats by parsing through and correlating huge amounts of logs.
• Composability is more flexible, cheaper, and transparent than using proprietary tools.
• Custom script automation and alert tuning is necessary in order to decrease alert fatigue and increase response times.

Real Talk: Why This Attack Matters in Cybersecurity

When it comes to cybersecurity, seeing is believing. No volume of AI buzzwords, or vendor hype in general, can replace real insight into your network and systems. A well-constructed open-source NOC allows you to spot suspicious activity early, dig deep into it, and react quickly.

Remember the old PSTN days? You had to understand every patch panel and cable color — no magic software did everything. Same principle applies. Your NOC is your eyes and ears, and in some cases, your front line.

But — and this is somewhat contraversial — I think a lot of companies underinvest in their monitoring. They invest heavily in firewalls and endpoint protection, but are blind to the NOC’s capability to ferret out nuanced network irregularities. It’s as if you bought a muscle car but didn’t even bother to look at the oil. You can’t race without it.

Wrapping Up

After decades in networking and security, I am just as excited as I ever was that open-source tools allow us to build NOCs that fill actual operational needs—not things that only exist on marketing slides. At PJ Networks, this approach has enabled us to provide scalable, resilient monitoring solutions to complex clients — like banks implementing zero-trust upgrades.

Open source does not mean less money; it means inserting the human back into the security loop, where intuition and context intersect with automation. Zabbix, Grafana, and ELK stack centric workflows are still the bread and butter of our NOC, and the secret formula that I’m happy to discuss.

So, if you’re running a NOC, or if you’re thinking about building one, my advice is: Don’t buy the AI hype. Get your hands dirty. Get to know these tools’ strengths — and oddities. Customize relentlessly. And don’t ever lose that third cup of coffee. You’ll need it.

Cheers,

Sanjay Seth
Cybersecurity Consultant
PJ Networks Pvt Ltd