What is NAPal
NAPal (Network AI Pal) is an Alibaba Cloud intelligent network operations service for enterprise customers. As your cloud digital network engineer, NAPal provides expert-level network knowledge, supports scheduled triggers, and delivers autonomous 24/7 online responses. It helps enterprises transition from manual response to AI-driven intelligent operations.
NAPal covers the full range of Alibaba Cloud network products, including VPC, EIP, SLB (ALB/CLB/NLB), CEN, Express Connect, NAT Gateway, VPN Gateway, GA, and PVL. By leveraging a rich library of domain-specific network expertise and intelligent orchestration capabilities, NAPal helps you reduce costs and improve efficiency across the entire network lifecycle, from cloud adoption and resource management to configuration, traffic insights, diagnostics, and alert response.
NAPal: So you can nap. — Let AI guard your network, so you can rest easy.
Core values
NAPal encapsulates vast Alibaba Cloud network operations data and expert experience into an interactive, intelligent service. It reduces the cost and complexity of network troubleshooting and shortens the Mean Time to Resolution (MTTR) for network failures.
Core values of NAPal:
Consolidated expert network knowledge: Integrates the extensive knowledge and best practices of network operations experts. This covers official documentation, SA solutions, best practices, and standard operating procedures (SOPs) for troubleshooting complex network scenarios to achieve rapid issue resolution.
Comprehensive network data foundation: Customers can access Alibaba Cloud's engineer-grade network operations data, probe data, and expert troubleshooting SOPs through the NAPal Agent. It provides unified access to Alibaba Cloud’s most complete network data foundation, covering network configurations, monitoring metrics, activity logs, and link probe data.
Full network operations lifecycle coverage: Covers the entire workflow, from cloud adoption and resource inventory to configuration management, traffic insights, fault diagnosis, and architecture inspection.
Uses RAM permission management: NAPal adheres to Alibaba Cloud's Resource Access Management (RAM) policies and accesses cloud services through standard OpenAPI MCP components.
Product architecture
Data foundation
NAPal aggregates six core data categories as its analytical foundation:
Data category | Description |
Network configuration information | Complete network configurations, including route tables, security groups, and VPC/vSwitch settings. |
Network monitoring metrics | Instance-level network monitoring metric data. |
Network log information | Layer 4 Flowlog activity logs and Layer 7 ALB/GA access logs. |
Link probing data | Data from Alibaba Cloud's proprietary probe clusters, covering intra-cloud traffic paths and global links for public network access. |
Network infrastructure data | Alibaba Cloud engineer-level infrastructure link diagnostics and operations data, made accessible by injecting expert knowledge into the AI model for interpretation. |
Network expert knowledge base | Covers network product Q&A, network solutions, and best practices for network architecture. |
Agent runtime layer
Powered by the Qwen model series, NAPal features a proprietary agent runtime foundation tailored for cloud network operations. Its core capabilities include multi-agent collaboration and orchestration, ReAct (Reasoning and Acting) thought-action loops, a sandboxed execution environment, long-term context management, expert knowledge bases and skill libraries, and a toolset of MCP and proprietary scripts.
User access layer
NAPal supports three access methods to meet different scenario requirements:
Access method | Description |
Console real-time chat (ChatBox) | An embedded conversational interface in the Alibaba Cloud console that supports real-time Q&A and context-aware interactions. |
IM channel | Integrates with major IM platforms like DingTalk, Feishu, WeCom, and Webhook URLs, allowing you to receive analysis reports and alert notifications via bots. |
OpenAPI | Provides a standard A2A-based OpenAPI that allows you to integrate NAPal's capabilities into your own agents or O&M systems. |
Work mode layer
NAPal supports three work modes:
Work mode | Description |
Conversation-triggered | Use natural language in the console or an IM channel to invoke skills for queries, diagnostics, and analysis. |
Scheduled task | Automatically perform recurring tasks like inspections, resource inventories, and report generation at set intervals without manual intervention. |
Event-triggered response | Integrates with CloudMonitor alerts. Network-related alerts automatically trigger an agent to perform Root Cause Analysis (RCA) for unattended operations. |
Features
NAPal builds an intelligent network operations system with six core capabilities, divided into two main areas:
Area one: Effective network usage
From cloud adoption to resource inventory, NAPal helps you quickly get started with your cloud network.
AI product consultation
Solves the initial challenge of network design for cloud adoption. Based on Alibaba Cloud product documentation, best practices, and SA solutions, NAPal provides network product recommendations, architecture suggestions, and cost estimates to help you plan your cloud deployment quickly.
Typical scenarios:
Recommending network solutions for new services moving to the cloud
Consulting on cross-region and cross-availability zone network architecture design
Comparing network products and estimating costs
AI resource management
Manages and inventories your cloud network resources. It supports multi-dimensional resource search and visualization, identifies idle resources and suggests cleanup, monitors quota usage with alerts, and analyzes resource utilization for cost optimization.
Typical scenarios:
Automating network-wide resource inventory to identify underutilized and idle resources for cost reduction
Aggregating and visualizing cross-region resource distribution
Quota bottleneck alerts and increase recommendations
Area two: Network perception and protection
This area provides visibility into your network, helping you understand traffic and pinpoint issues.
AI traffic insight
Provides fine-grained traffic analysis based on Flowlog and Layer 7 access logs. Capabilities include traffic insight reports down to the vport level, anomalous traffic detection and source tracing, analysis of public network access by provider, identification of inter-cloud public traffic, and analysis of microburst traffic growth.
Typical scenarios:
Flowlog traffic insights for VPC, CEN Transit Router, NAT Gateway, VPN Gateway, ALB, and NLB
Public-facing exposure analysis and security auditing
Provider quality insights and link anomaly detection
Microburst traffic growth analysis, calculating growth volume and rate at the 5-tuple flow level to precisely pinpoint burst sources
Top IP analysis to distinguish between normal traffic and burst trends
AI diagnostic analysis
Pinpoints the blast radius of network-level issues and provides root cause analysis and remediation suggestions. Capabilities include instance diagnostics, path connectivity analysis, basic performance queries and analysis, and interpretation of monitoring metrics.
Typical scenarios:
VBR packet drop detection and RCA for rate-limiting packet loss
Diagnostics for abnormal optical signals on physical ports
End-to-end path connectivity analysis and fault localization
In a hybrid cloud scenario, input any two IP addresses (one from an on-premises IDC and one from a cloud ECS instance) to visualize the path and detect issues like congestion or packet loss
Task center
NAPal provides a Task Center that allows you to configure scheduled tasks and event-driven RCA tasks for autonomous network fault response, enabling unattended intelligent network operations:
Scheduled tasks
NAPal provides a template framework for scheduled inspection tasks. You can select product types, inspection skills, and resource scopes. Tasks are triggered on a schedule across all network instances in your account, covering resource inventory, quota management, health checks, stability analysis, network quality, and traffic insights. The service generates comprehensive inspection reports that can be pushed to IM channels.
Six inspection perspectives:
Inspection perspective | Description |
Resource inventory | Automatically inventories network resource usage, identifies idle resources, analyzes utilization, detects waste, and provides statistics on cross-region resource distribution. |
Quota management | Scans quota usage, identifies bottlenecks, provides recommendations and warnings for quota increases, and analyzes quota usage across multiple accounts. |
Health check | Scans instance health status, checks backend server health, verifies port connectivity, and pinpoints the root cause of health check failures. |
Stability analysis | Analyzes network high availability, identifies stability risks like single points of failure, insufficient redundancy, and disaster recovery gaps, and assesses multi-availability zone redundancy. |
Network quality root cause analysis | Combines instance-level link probing, provider quality probing, and cross-domain PingMesh to provide network quality root cause analysis. |
Traffic insight report | Generates traffic insight reports down to the vport level, and detects and traces anomalous traffic by using Flowlog and Layer 7 access logs. |
Event RCA tasks
Integrates with CloudMonitor alerts to automatically orchestrate skills like topology blast radius analysis, resource health diagnostics, and anomalous traffic localization to perform root cause analysis. It then generates an RCA report and sends it to an IM channel, enabling unattended response to network alerts.
Automatic analysis workflow:
Subscribe to alerts: Forward CloudMonitor alerts to NAPal.
NAPal responds automatically: NAPal matches the alert to a built-in handling SOP.
Analyze topology blast radius: Analyzes the network topology and dependent resources affected by the alert (for example, the EIP → NAT Gateway → SLB impact chain).
Diagnose related resource health: Performs health checks and stability assessments on affected resources.
Locate and analyze anomalous traffic: Pinpoints abnormal traffic patterns and attack behaviors based on Flowlog and Layer 7 logs.
Output RCA report: Generates an event RCA report and pushes it to an IM channel (DingTalk, Feishu, or WeCom).
Skill center
NAPal continuously releases expert skills for network operations that cover Alibaba Cloud's core network product lines. You can follow updates in the NAPal Skill Center to stay informed about its evolving capability matrix.
Access methods
Console chatbox
An embedded conversational interface in the Alibaba Cloud network console allows you to interact with NAPal in natural language for real-time Q&A, resource queries, and troubleshooting.
IM channel
NAPal integrates with major enterprise IM platforms, allowing you to use bots to interact with NAPal and receive inspection reports and alert RCA reports:
DingTalk: Pushes notifications via a DingTalk bot.
Feishu: Pushes notifications via a Feishu bot.
WeCom: Pushes notifications via a WeCom bot.
IM channels support managing information flow on a per-agent basis, allowing you to set up different push groups for different teams or business lines.
OpenAPI
Provides a standard OpenAPI for integration into your own agents, operations platforms, or automated workflows.
To get raw data analysis results without AI interpretation, you can call the standard API directly.
To get intelligent analysis conclusions, call the agent to invoke AI capabilities, which generate insights based on the underlying data.
Use cases
Scenario 1: Daily conversational Q&A
Use natural language in the console or an IM channel to query resource information or get assistance with troubleshooting. Most queries are completed within minutes.
Examples:
"Show me how many ENIs are in VPC-123."
"What's the traffic trend for this EIP over the last hour?"
"Analyze why NAT Gateway nat-456 is dropping packets."
Scenario 2: Periodic intelligent inspections
Configure scheduled tasks to have an agent periodically inspect your entire network across six perspectives (Resource inventory, Quota management, Health check, Stability analysis, Network quality root cause analysis, and Traffic insight report). The agent generates a comprehensive inspection report and pushes it to your IM channel.
Examples:
Automatically run a full network resource inventory and health scan every Monday at 9:00 AM.
Identify underutilized and idle resources for cost reduction.
Proactively identify scaling needs to prevent alerts.
Periodically assess architectural health and stability to identify single points of failure and disaster recovery risks.
Scenario 3: Unattended event response
The NAPal agent integrates with CloudMonitor, allowing network-related alerts to automatically trigger root cause analysis. The analysis is fully automated, from alert to root cause. The analysis report can be sent back to CloudMonitor for delivery to your existing contact groups or pushed to specific groups via an IM bot.
Examples:
When shared bandwidth is saturated, automatically identify the IP address or 5-tuple causing the issue and provide a resolution plan.
After a physical port on a leased line fails, automatically analyze the blast radius and determine the root cause.
Identify the root cause of saturated NAT Gateway public bandwidth using top traffic sources
Billing
NAPal is currently in public beta and is free to use. The commercial version of NAPal will use a prepaid monthly subscription. The base subscription fee includes a set amount of AI Credits and a base number of concurrent sessions. You can purchase add-on AI capacity packages to increase your AI Credit allowance and number of concurrent sessions.
Monthly subscription
Includes a base AI Credit quota and 5 concurrent sessions, suitable for the daily operational needs of small to medium-sized environments.
AI capacity package (Add-on)
When the base subscription capacity is insufficient, you can purchase AI capacity packages to expand it. Each AI capacity package provides an additional 8 concurrent sessions and includes extra AI Credits.
Value of an AI capacity package:
More AI Credits to support more frequent analysis calls.
Allows more team members to work online simultaneously.
Enables more frequent scheduled tasks and denser inspection cycles.
Higher concurrent alert response capacity to support large-scale alert scenarios.
Billing details
Item | Includes | Fee (CNY/month) | Validity period |
Monthly subscription package | 5,000 AI Credits, 5 concurrent sessions | 8,000 | Calendar month |
AI capacity package | Each add-on AI capacity package provides:
| 10,000 | Calendar month |
FAQ
What network products does NAPal support?
NAPal covers the full range of Alibaba Cloud network products, including VPC, EIP, the SLB product family (ALB/CLB/NLB), CEN, Express Connect, NAT Gateway, VPN Gateway, GA, and PVL.
How fast does NAPal respond?
Most queries are completed within minutes, with a target of under 3 minutes. Responses within seconds are not guaranteed.
Integration with existing systems
NAPal provides a standard OpenAPI that can be integrated into your own agents or operations systems. It also integrates with major IM channels like DingTalk, Feishu, WeCom, and Webhooks, allowing you to receive analysis reports via bots.
Does NAPal support custom skills?
This feature is not yet supported. In the future, we plan to enable custom skills, allowing you to build on pre-set SOPs with your own operational logic to create a personalized network operations agent.
How are inspection reports delivered?
Inspection reports can be pushed to IM channels (DingTalk, Feishu, or WeCom). You can configure different push groups for different teams or business lines to manage information flow on a per-agent basis.
CloudMonitor integration for event RCA
The NAPal Agent is integrated with CloudMonitor. After you subscribe to network-related alerts and connect them to the NAPal Agent, CloudMonitor automatically pushes triggered alerts to NAPal. The agent then automatically performs blast radius analysis, health diagnostics, and root cause localization. The analysis report can be sent back to CloudMonitor for delivery to your existing contact groups.