4SO LabData is scattered across many sources
Devices, interfaces, addressing, VLAN/VRF, routing and topology usually live in separate formats.
NETWORK SOURCE OF TRUTH
4SO NetworkNetwork Source of Truth with Provenance & Confidence
4SO Network turns scattered network information into a machine-readable model: inventory, interfaces, L2/L3, routing, topology and history are kept with clear provenance, and inference never silently becomes fact.
InventoryTopologyL2 / L3Provenance
4SO Network components: from source evidence to derived views with provenance
- 1Source snapshotsInventory, configuration, topology and history; each snapshot keeps its source identity and time.
- 2Normalize & correlateDomain parsers turn different formats into canonical network records.
- 3Fact / Candidate / DerivedInference stays Candidate or Derived until corroborated; it never silently becomes Fact.
- 4Derived viewsL2/L3, path and forensic views are projections over source records. Solid edges are facts; dashed are candidate or derived.
01PROBLEM & OUTCOME
Product problem
A network usually has more than one “truth”.
Inventory, diagrams, configuration, routing state and operator knowledge can disagree with one another. A good single source of truth does not hide that disagreement; it keeps the provenance and confidence of each piece of data attached to the data itself.
A diagram is not always live reality
A relationship derived only from a diagram or naming must stay separate from an observed fact.
Inference must be labeled
An inferred link candidate or site/role is not promoted to a definitive authority until it is corroborated.
History matters for incidents
Knowing where data came from, and when, is essential for change and incident analysis.
02CAPABILITY SNAPSHOT
Capability overview
Network data is broken down into analyzable domains.
The goal is to turn config dumps into an operational model that supports queries, correlation and forensics.
Device Inventory
A structured model for devices and operational metadata, independent of the source format.
Interface Model
Interfaces, descriptions, bundles and their relationships to other domains.
VLAN and port-channel
An L2 model for segments, membership and aggregation.
IP and VRF
Addressing and routing context in a separate, queryable structure.
Routing Facts
Static, BGP and OSPF data for path and policy analysis.
Topology relationships
A node/edge model carrying the source and confidence of every relationship.
Service Dependencies
Network service dependencies such as DNS, time, AAA and logging in a common model.
Provenance and history
Timestamps, sources and change history for analysis and forensics.
4SO
In this product, authority is not a simple boolean. Every record must keep its own source, timestamp and confidence so that correlation and automation can tell fact from inference.
03AUTHORITY MODEL
Authority model
The source matters; so does the confidence.
Instead of a flat table that treats everything as definitive truth, data is classified by its origin and extraction method.
| Domain | Example records | Authority / Confidence | Use |
|---|---|---|---|
| Inventory | Device identity, platform/role metadata, source mapping | Fact within the scope of the source snapshot | Inventory, ownership and normalization |
| Interfaces / L2 | Interface, description, VLAN, port-channel | Configuration-derived + source timestamp | Link-layer analysis and aggregation |
| L3 / Routing | IP/subnet, VRF, static routes, BGP, OSPF | Observed/config-derived record | Path, routing context and policy analysis |
| Topology | Node, edge, device matching, link candidate | Fact / Candidate / Derived with confidence | Correlation without turning inference into truth |
| Dependencies | DNS, time, AAA, logging relationships | Source-owned relation or bounded inference | Service dependency analysis |
| History | Snapshot identity, source history, change context | Timestamp + provenance preserved | Forensics and change comparison |
04ARCHITECTURE
Architecture
The pipeline must preserve provenance, not erase it.
Sources are ingested separately, parsers normalize them, and the single source of truth keeps records with their provenance and confidence. Analytical views are only projections.
INPUTSInventory · Topology · Configuration · HistoryEach source has its own identity and timestamp.
↓
NORMALIZATIONParser & NormalizerConverts different formats into uniform domain records.
↓
SOTStructured network source of truthFact + provenance + confidence; inference is never automatically turned into truth.
↓
INTELLIGENCEDerived Views / Analytics / ForensicsCorrelation and analysis over source-owned records without creating a second authority.
TECH
Inference Guardrails. 4SO Network keeps an explicit distinction between what a source actually stated, what has been correlated across several sources, and what has only been inferred.
| Evidence type | Classification | Usage rule |
|---|---|---|
| Configuration snapshot | Fact within the scope of that snapshot | Interface, addressing, VLAN/VRF and routing facts are valid only with their own source and timestamp. |
| Topology/diagram source | Source-scoped fact | A relationship shown in a diagram does not prove the live state of the network. |
| Naming / Description correlation | Candidate | Link/role/site inference is not promoted to definitive authority before corroboration. |
| Multi-source corroboration | Confidence-bearing relation | Supporting evidence and sources stay attached to the relation; confidence is never separated from provenance. |
| Derived view | Projection | Summaries, path views or analytics are built from source-owned data and do not create a second SoT. |
| Historical comparison | Change context | The difference between two snapshots shows change; it does not claim the cause of an incident without additional evidence. |
05LIFECYCLE
Lifecycle
Network data has a quality lifecycle too.
Until a snapshot has been parsed, classified and correlated, it is only raw input; a derived result does not take the place of a fact until it has been reviewed.
01AcquisitionAcquire
02ParsingParse
03NormalizationNormalize
04CorrelationCorrelate
05ClassificationClassify
06ReviewReview
07Derived viewProject
08History comparisonCompare
06NETWORK DATA PROFILES
Data profiles
Each network domain answers a different question.
Separating domains keeps analysis from depending on one large, ambiguous CSV.
InventoryDEVICES
Device identity and metadata.
- Device model
- Platform / role metadata
- Source mapping
InterfaceLINK LAYER
Interface and aggregation detail.
- Interfaces
- Descriptions
- Port-channel relationships
L2 / L3NETWORK MODEL
Segment and routing context.
- VLAN
- IP / subnet
- VRF
RoutingPATH & POLICY
Routing data for path analysis.
- Static routes
- BGP data
- OSPF data
TopologyRELATIONSHIPS
Nodes and edges with explicit authority.
- Topology sources
- Device matching
- Link candidates
ForensicsHISTORY
Change tracking and confidence.
- Source history
- Last-change context
- Provenance-aware comparison
07ACTION & WORKFLOW CONTRACT
Data and evidence flow
In 4SO Network, the core action is turning evidence into an analyzable model while preserving provenance.
Rather than treating everything as truth, the pipeline keeps source-owned facts, correlation and inference in separate stages.
01AcquireSOURCE SNAPSHOT
02ParseSTRUCTURED RECORDS
03NormalizeDOMAIN MODEL
04CorrelateMULTI-SOURCE
05ClassifyFACT / CANDIDATE
06ReviewCORROBORATE
07ProjectDERIVED VIEW
EVIDENCE CLASSIFICATION
Fact / Candidate / Derived
Every relation is stored with its own evidence type.
SOURCE SNAPSHOT
↓
EVIDENCE
CLASS
CLASS
↓
FACT
CANDIDATE
DERIVED
A naming hint without corroboration is not a fact.
MULTI-SOURCE CORRELATION
Several sources, one explainable relation
Correlation does not remove source ownership.
CONFIG
INVENTORY
DIAGRAM
↓
CORRELATE + ATTACH PROVENANCE
↓
EXPLAINABLE RELATION
source identity · timestamp · confidence · supporting evidence
Conflicts between sources are preserved and do not collapse into a fabricated truth.
CORROBORATION LOOP
Candidate to fact only with evidence
Confidence and provenance remain throughout the review loop.
HINT
→
CANDIDATE
↓
REVIEW
↑
EVIDENCE
←
FACT /
UNRESOLVED
UNRESOLVED
confidence changes only with traceable evidence
Absence of evidence = unresolved, not automatic confirmation or rejection.
Ingest Snapshot
Source identity is preserved before parsing.
01Source02Hash / Time03Acquire04Parse05Persist Raw Context06Record Provenance
Failure / RecoveryA parse failure does not overwrite the previous source.
Normalize Domains
Different formats are converted into a canonical model.
01Device02Interface03L204L305Routing06Dependency
Failure / RecoveryUnknown fields are not fabricated; missing stays missing.
Correlate Sources
Relations are built without removing provenance.
01Select Keys02Match03Compare Evidence04Create Relation05Attach Sources06Confidence
Failure / RecoveryConflicts between sources are not turned into a single fabricated truth.
Infer → Corroborate
Inference is not fact until independent evidence exists.
01Hint02Candidate03Confidence04Review05Corroborate06Fact / Unresolved
Failure / RecoveryNo evidence = unresolved; neither a fabricated confirmation nor a fabricated rejection.
Historical Compare
A change view is a projection, not a new authority.
01Snapshot A02Snapshot B03Diff04Context05Derived View06Safe Export
Failure / RecoveryA snapshot difference does not claim the cause of an incident without additional evidence.
ADDITIONAL OPERATIONAL FLOWS
Additional analytical flows
Path analysis and conflict resolution are carried out without turning a projection into an authority.
Path / Dependency Analysis
A probable path is computed from structured evidence, and the source of every hop is preserved.
01Select Endpoints02Load L2 / L303Load Routing04Correlate Dependencies05Compute Candidate Path06Attach Evidence07Derived View
Failure / RecoveryIf link or routing evidence is incomplete, confidence is lowered; the system does not fabricate the missing path.
Source Conflict Resolution
Source conflicts are kept explicit before any promotion to fact.
01Detect Conflict02Preserve Values03Compare Source / Time04Authority Hint05Review06Corroborate07Reclassify
Failure / RecoveryIf there is not enough independent evidence, the conflict stays unresolved and no source is artificially declared the winner.
| Action / Flow | Admission / Preconditions | Execution / Lock | Success Criterion | Failure / Recovery |
|---|---|---|---|---|
| Ingest Snapshot | Source identity/hash/timestamp must be known | The parser materializes only that source's data | Records are traceable back to their snapshot/source | A parse failure does not overwrite the original source and does not record partial success |
| Normalize | Schema/domain parser for Device/Interface/L2/L3/Routing | Different formats are converted into the canonical domain model | Identity and source mapping are preserved in the record | Unknown fields are not fabricated; missing data stays missing |
| Correlate Sources | Match keys and provenance available on both sides | Correlation builds the relation but does not remove source ownership | Every relation can show its supporting evidence/sources | Conflicts between sources are not hidden and are not automatically turned into a single truth |
| Infer Candidate | Naming/description/topology hints used only for bounded inference | The candidate is recorded with its confidence and inference method | Candidates are distinguishable from facts and reviewable | Inference does not enter definitive authority without corroboration |
| Review / Corroborate | Independent evidence or operator confirmation required | The candidate is evaluated against additional evidence | Classification/confidence are preserved with a trace | No evidence = unresolved; no fabricated rejection/confirmation |
| Compare / Export Safe View | Specific snapshots and a sensitivity policy selected | Derived view/history/report is built from existing records | Reproducible projection without creating a second SoT | Public export removes real IP/ASN/device/site/topology data; root cause is not claimed without evidence |
FLOW
Core rule: Projection ≠ Authority. Summaries, path views, analytics or forensics may be built from several sources, but the original fact stays bound to its own source and timestamp.
08OPERATIONS CATALOG
Operations catalog
The operations catalog is data engineering for the network.
Turn your network into data you know how far to trust.
4SO Network is built for decisions on network data, with Provenance and Confidence as part of the model itself.