How REAP reasons
REAP does not pattern-match an alert to a canned answer. It decides what evidence it needs next, gathers it, and changes course when the evidence says so, and it links every conclusion to the exact output that supports it.
The Investigation Window
Four answers and the evidence behind them: what changed, why it broke, what is affected, and the next best action.
Known conditions are detected by deterministic rules; the investigation that follows records its time to answer, reported as P50 and P95 in your pilot, with the P50 target agreed per pilot: never a hidden tail. Everything the agent looked at is one click from the conclusion.
What changed
CHG-1234 edited object group OG-ERP on plant-a-core-2 at 21:14: its members were replaced (10.20.5.0/24 → 10.20.50.0/24) so a second ACL could reuse it. ACL-ERP-IN already referenced the group.
Why it broke
ACL-ERP-IN permits ERP return traffic by matching OG-ERP. With the members replaced, traffic from the ERP servers (10.20.5.0/24) falls to the final deny. The link and the OSPF adjacency to dist-3 never changed, so nothing alarmed.
Impact
ERP return traffic to Plant A order entry (10.30.12.0/24) dropped on core-2 since 21:16: 1 device, 2 subnets, 1 service path. Undetected for 4 h 51 min; no probe watched the ERP path.
Next best action
Restore OG-ERP to its 21:13 members (runbook RB-07, awaiting approval); re-test ERP reachability; re-implement CHG-1234 with a separate group for ACL-B; add a probe on the ERP path.
Evidence
Four moments
Facts in play: interface errors drop HELLO packets; mismatched timers, MTU (a neighbor stuck in EXSTART) or area settings also keep a neighbor from forming.
Facts in play: “It was working fine yesterday morning; broken since last night.” Configuration changes are logged in accounting logs.
Facts in play: an active/standby pair protects nothing while the standby is out of sync; the posture check compares the configuration and state of both units.
Facts in play: a port-channel bundles interfaces that connect two devices; CDP and LLDP reveal which interfaces are actually connected.
Standards we hold ourselves to
Every conclusion links to command output, log lines, configuration diffs or ticket text. In a pilot we target at least 90% of conclusions traceable, scored by your engineers.
Time to answer is recorded per investigation and reported as P50 and P95 in the pilot; known conditions are detected by deterministic rules, the reasoning engine handles the rest.
When the evidence is insufficient, REAP says so and proposes the next diagnostic step. Confident guessing is a failure mode, and we treat it as one.
Your runbooks, design documents, naming conventions, tickets and change records inform investigations, not only device state.
Configuration history and change records are first-class evidence; in our discovery conversations, the change nobody connected to the symptom was the most common explanation.
Recommendations by default; runbooks under approval, each run logged with the device output. Reverse steps are written into runbooks where the change is reversible.
Bring us your last P1. Keep the root cause to yourself; in a 30-minute session we walk through how REAP would have investigated it, evidence first. The replay on your own network happens inside the proof of value.