Active IQ at scale: proactive IT behind the scene

What does it take to turn infrastructure telemetry into something genuinely useful for customers?

At NetApp IT, it takes more than collecting data. It takes the ability to ingest it securely, process it on a massive scale, analyze it quickly, and transform it into recommendations customers can act on. That is the role Active IQ plays across the NetApp ecosystem.

Behind every recommendatio, risk alert, health insight, and automated support action is an architecture designed to help customers move from reactive support to proactive operations.

For NetApp IT, this is more than a product story. It is a real-world use case for running a large-scale, data-intensive service on our own technology while maintaining security, performance, and operational efficiency.

Active IQ is built to help customers better understand the health of their environments using telemetry data sent from their systems. That telemetry is not customer business data. It is operational information about the systems themselves, including configuration details, capacity trends, performance counters, and logs. At scale, that adds up quickly.

Today, NetApp processes billions of data points across its global install base every month, performs billions of risk assessments, and manages an environment measured in petabytes. Scale matters, but the real value comes from how NetApp turns that data into actionable intelligence.

The goal is to turn telemetry into action.

Delivering actionable insights at scale

Once telemetry arrives, it is parsed, enriched, and analyzed to populate the dashboards, APIs, and integrations that power Active IQ Digital Advisor. This gives customers, partners, and authorized NetApp teams a consistent way to monitor system health, identify risk, and take corrective action before issues become disruptive.

That proactive model produces measurable value. According to NetApp, 98% of technical issues surfaced through Active IQ are predicted and addressed proactively. Customers using the Active IQ ecosystem also resolve support issues on average twice as fast, and the platform has helped prevent millions of hours of downtime each year.

Those outcomes depend on the infrastructure behind the experience.

Building the platform behind Active IQ

NetApp’s Active IQ platform runs on a modern microservices architecture, with much of the platform containerized and running on Kubernetes. The processing pipeline uses Kafka to move telemetry through multiple stages, allowing teams to scale services independently, prioritize workloads when necessary, and keep data flowing efficiently through the system.

As telemetry moves through that pipeline, it is transformed and enriched with additional context, including install base and product information, so the platform can perform health assessments and generate recommendations. Parsed data is stored in MongoDB, while APIs and analytics services make the information accessible through GraphQL, REST, and internal analytics environments.

NetApp also uses StorageGRID for components that require S3-compatible object storage and Dremio to support internal data lakehouse-style access and analysis.

Because the platform operates on such a large scale, storage efficiency is not a nice-to-have. It is essential. NetApp benefits directly from the storage efficiencies built into its technology, making it practical to manage a telemetry environment measured in petabytes.

Designing for cyber resilience

Disaster recovery is another critical part of the design. To meet compliance and resilience requirements, NetApp uses SnapMirror for geographic replication between U.S. locations. That allows the team to maintain backup copies of critical data and rehearse disaster recovery by spinning up compute and mounting mirrored datasets when needed. FlexVol technology also helps support low-downtime migration scenarios, which is especially important in an environment where moving data without disrupting service is a constant requirement.

Securing telemetry end to end

NetApp uses the Security Development Lifecycle (SDL), security scans, and penetration testing to ensure the development process and infrastructure starts and remains secure.

Telemetry enters the system over encrypted channels, primarily HTTPS with TLS. From there, it passes through an encryption service that flags potentially personally identifiable or customer-identifiable information and immediately masks or encrypts it. Even information such as contact details, volume names, or aggregate names is handled with caution to reduce risk. Encryption keys are tightly controlled and only available to authorized personnel.

Access to telemetry and insights is governed through strict role-based access controls. Customers can access only their own environments. Partners can access only the systems they are authorized to support. NetApp employees are granted access based on job roles and need-to-know requirements, with temporary access requests subject to approval and time limits.

Applying AI to operational intelligence

AI and machine learning are also beginning to enhance the platform's value. Today, Active IQ uses predictive and expert-system approaches for tasks such as capacity forecasting and at-risk system reporting. NetApp also uses semantic search internally to help support teams compare new issues against similar historical cases and speed triage. As newer capabilities such as AIDE continue to evolve, the focus remains the same: reduce time to resolution and help teams act faster with better context.

Turning scale into customer value

The bigger takeaway is this: proactive IT is not just about surfacing alerts. It is about building the infrastructure, controls, and data pipeline needed to turn scale into insight.

That is what Active IQ demonstrates inside NetApp. It is a practical example of how modern data infrastructure, security-minded architecture, and automation can work together to help customers spend less time reacting to problems and more time staying ahead of them.