--- title: "Self-Hosted ITSM and Network Observability: Case Study" description: "A self-hosted platform replacing a patchwork of IT tools: assets, credentials, ITIL ticketing, syslog/NetFlow on ClickHouse, anomaly alerts, live topology." url: https://williamw.name.my/portfolio/itops-observability/ language: en --- [Home](https://williamw.name.my/) [Portfolio](https://williamw.name.my/portfolio/) Enterprise IT Ops & Network Observability Platform # ITSM & network observability platform: Assets, tickets and traffic in one console A self-hosted IT operations platform that replaced spreadsheets, log viewers and scattered admin consoles for an internal IT department: near a thousand devices tracked, network logs and NetFlow analyzed on ClickHouse with statistical anomaly alerts, ITIL ticketing in enterprise chat. It shipped across 127 released versions with 207 automated tests. [Ask me on WhatsApp](https://williamw.name.my/go/whatsapp?from=case-itops-observability-head&l=en&text=Hi+William%2C+I+read+the+%22Enterprise+IT+Ops+%26+Network+Observability+Platform%22+case+study+on+your+website+and+would+like+to+discuss+a+similar+project.) By [William W](https://williamw.name.my/about/), WilliamW Resources. Ten-plus years in IT infrastructure and security. Updated 2026-09-14 In production · anonymised demo Built and operated in production for a company that is deliberately not named. The demo you can open is the same system, sanitised: real data and names removed, everything else as deployed. [Live demo](https://demo-itsm.williamw.name.my) ![Subscription renewals and credential rotation due dates, across 22 operational modules (the live demo, sample data)](https://williamw.name.my/images/projects/demos/itsm-dashboard.jpg) Account rotation2026-09-27 5 days left System FortiGate firewall Account fwadmin Due for rotationSample data Subscription renewals and credential rotation due dates, across 22 operational modules (the live demo, sample data) ## The starting point The IT team ran the office network on a patchwork: asset lists in spreadsheets, passwords in a shared document, firewall logs viewable only on the box, no NetFlow visibility, and tickets arriving by chat message and getting lost. Nothing connected an IP address to a device to its owner. ## What was built - Asset ledger, encrypted credential vault (AES-256-GCM) and software-subscription tracking in one place - Syslog, SNMP and NetFlow collectors feeding ClickHouse, with statistical anomaly alerts for deny spikes, port scans and lateral movement - Endpoint attribution engine: any IP or MAC resolves to a physical device and its owner, despite MAC randomization - ITIL ticketing with a legal state machine, opened and updated straight from enterprise chat - Live network topology, IPAM and wireless monitoring across switches, APs and firewalls - Zero-downtime deployments; 127 released versions and 207 automated tests over the platform’s life Tech stack - React - TypeScript - FastAPI - ClickHouse - PostgreSQL - Docker ## What it changed - "Whose device is this IP?" went from an afternoon of detective work to one search - Security-relevant traffic patterns surface as alerts instead of being discovered after the fact - Tickets stopped getting lost in chat; every request has a number, an owner and a state - Credentials moved out of shared documents into an encrypted, role-scoped vault with audit logs ## Have a project in mind? Tell me what you need. I usually reply within one business day. [WhatsApp](https://wa.me/ww6886) [Email](mailto:inquiry@williamw.name.my) [Telegram](https://t.me/williamw6886) [Signal](https://signal.me/#eu/h1W76J74uDauxkfBfSoVotZ-pZe2ogGDa6vmK3Xqw8tWLNsiTE9OaIvVwXZxHiqE) [LinkedIn](https://www.linkedin.com/company/williamw-resources/) [Or send the details through the form](https://williamw.name.my/contact/?from=case-itops-observability) ## Related - [All case studies](https://williamw.name.my/portfolio/) - [Services and how I deliver](https://williamw.name.my/services/) ## Common questions ### Is this SaaS? Where does our network data live? No, it is self-hosted on your own server (Docker Compose). Logs, credentials and asset data never leave your infrastructure, which for network-security data is usually a hard requirement. ### Our switches and firewalls are a mixed bag of brands. Will it work? The collectors speak standard protocols (syslog, SNMP and NetFlow v9), which nearly every network vendor supports, and per-vendor API integrations (the delivered system integrates a major firewall and wireless-controller brand) are added as needed. ### Can we start with just ticketing or just monitoring? Yes. The platform grew module by module across 127 releases, and a new deployment is scoped the same way: start with the module that hurts most, add the rest as phased milestones. ## Ready to scope it? Send what you manage today and what hurts. I reply within one business day; once we have talked it through, you get a written scope with a fixed price per milestone within one business day. [Message me on WhatsApp](https://williamw.name.my/go/whatsapp?from=case-itops-observability-end&l=en&text=Hi+William%2C+I+read+the+%22Enterprise+IT+Ops+%26+Network+Observability+Platform%22+case+study+on+your+website+and+would+like+to+discuss+a+similar+project.) [Email or other ways](https://williamw.name.my/contact/?from=case-itops-observability-end) [inquiry@williamw.name.my](mailto:inquiry@williamw.name.my)