Netflix Builds AI Knowledge Graph to Tame 38 Million Events Per Second

Netflix is moving its observability stack away from reactive dashboards and toward an AI-driven operational ontology, according to a presentation by engineers Prasanna Vijayanathan and Renzo Sanchez-Silva. The system is designed to handle a firehose of roughly 38 million events per second, unifying metrics, events, logs and traces into a single queryable knowledge graph. The goal is to let software, not on-call engineers, do the first pass of incident triage.

The core problem Netflix is attacking is fragmentation. MELT data has traditionally lived in separate systems with separate schemas, which forces responders to stitch together context by hand while an outage is unfolding. By encoding operational knowledge as an ontology, the company gives machines a shared vocabulary for services, dependencies, symptoms and failure modes. That structure is what makes the graph queryable by both humans and agents rather than just searchable.

On top of the graph, Netflix is running agentic workflows built with Anthropic's Claude models. According to the engineers, these agents can traverse the knowledge graph to correlate signals across services, propose likely root causes and trigger remediation steps. That shifts the system toward self-healing behavior, where routine incidents are resolved before a human is paged and engineers focus on the cases the agents cannot close.

The scale numbers explain why Netflix needs this. At tens of millions of events per second, no team can manually curate alerting rules fast enough to keep pace with a constantly changing microservices topology. Graph databases give the platform a way to model relationships that change in real time, so a new dependency or a degraded service is reflected in the graph rather than in a stale runbook.

Netflix is not alone in chasing this pattern. Across the industry, observability vendors and large platform teams have spent the past two years bolting AI assistants onto monitoring tools, mostly as chatbots that summarize alerts. Netflix's approach goes further by making the data model itself the foundation for automation, which is a meaningfully harder engineering problem than wrapping an LLM around a dashboard.

The presentation lands as agentic operations becomes a crowded category, with Grafana, Datadog and a wave of startups all pitching AI-assisted incident response. What Netflix has that most vendors do not is a single, enormous production environment to validate the approach against, plus the internal pressure to reduce mean time to resolution at a scale where minutes of downtime carry real cost.

The open question is how much autonomy Netflix is willing to grant these agents. Automated triage and root-cause suggestions are one thing; letting a model execute remediation against production is another, and the company has not detailed its guardrails for that boundary. Watch for follow-up on how the ontology is versioned and how agent actions are audited when something goes wrong.