Daimler Truck uses graph technology to untangle its IT estate and gains long-lasting operational windfall – News

When Daimler Truck Holding AG began the long and complex process of separating from Mercedes-Benz Group AG in 2021, it faced a daunting problem.

Decades of tightly interwoven information technology systems, shared infrastructure and undocumented dependencies needed to be untangled. More than 1,500 IT systems and applications needed to be separated, redesigned or replaced. The changes would affect 100,000 employees worldwide, 55,000 dealers and 6,000 business partners.

Simply “cutting the cord” between the two companies was not an option. An unanticipated dependence could bring down critical applications on both sides, with no clear way to diagnose or recover from failures.

“If we just cut that link, both companies go down,” said Conor O’Shea, AI architect at Daimler Truck. “Recovering is almost impossible because of decades and decades of intertwined infrastructure.”

Daimler Truck turned to graph database technology to map its application landscape as a living model of how systems interacted. What began as a divestiture tool eventually became a foundational platform for observability, security insight and application intelligence across the newly independent company.

Separating what couldn’t be seen

Like many large enterprises, Daimler AG relied on a configuration management database to track applications and infrastructure. A CMDB is a centralized system that stores information about an organization’s IT assets and documents how they are configured and related.

Though useful for recordkeeping, the CMDB lacked context. Applications were documented as collections of servers, but real-world dependencies such as DNS entries, proxies, databases, email relays, tax services, and connections to legacy systems were often missing or outdated.

“Somebody maps out an application, that person leaves, and the new owner doesn’t really understand what that implies for their application,” O’Shea said.

Closing that gap was crucial. Over the years, Daimler Truck and Mercedes-Benz systems had become deeply interconnected. Applications on one side routinely relied on infrastructure owned by the other. Without a complete picture of those relationships, unexpected outages were inevitable.

Manual analysis wasn’t realistic. Daimler Truck estimated it would cost more than $1 million and months of effort to hire contractors to map dependencies by hand. Even then, there was no guaranteed the results would be complete. What was needed was a way to see how applications behaved in practice.

Daimler Truck chose Neo4j Inc.’s graph database technology to model its IT environment as an ontology, or a structured representation of entities and their relationships. The objective was to understand how everything was connected.

Network telemetry from ExtraHop Networks Inc. provided a foundation. ExtraHop captures live traffic flows across the enterprise, identifying client-server communications, ports, protocols and behavioral signals. Daimler Truck built an extract/transform/load pipeline using Go, a language optimized for scalable network services and distributed systems. to sample and transform millions of flows into graph relationships.

Each flow became a set of connected nodes showing client and server IP addresses, protocols and services. Those were then linked to application records from the company’s ServiceNow Inc. database using IP addresses as the primary key. The result was a continuously updating graph that represented how applications operated on the network.

Unlike static documentation, the graph evolved with the environment. As connections changed, ExtraHop data fed an ontology that changed with them. This proved critical during separation planning.

Clean break

With the graph in place, Daimler Truck could identify which applications belonged to the truck business, which belonged to Mercedes-Benz and where they overlapped.

Shared services such as ServiceNow and Salesforce were relatively straightforward to separate. Each company spun up its own instance and migrated the data. Internal applications were another matter. Using the graph, Daimler Truck was able to uncover hidden dependencies, including SMTP relays, database connections and network services located in Europe or Asia-Pacific that the company still relied on.

That allowed migration teams to develop separation plans on a case-by-case basis, coordinating with application owners and infrastructure teams to replicate, migrate or reconfigure services safely. The graph reduced the unknowns, which are the riskiest factor in large-scale IT transitions.

The transition took 3.5 years to complete. In addition to the applications, 130,000 mobile devices were migrated, and 15,000 servers were moved to Daimler Trucks’ data center. The effort reduced the total number of applications by 40% while modernizing systems in areas like finance, spare parts logistics and human resources, some of which were more than 30 years old.

An unanticipated but welcome benefit was that Daimler Truck gained unprecedented visibility into its IT landscape. By extending the graph to include firewall logs, security telemetry and system events generated by Cisco Systems Inc.’s Splunk machine data analytics platform, Daimler Truck created multiple overlapping ontologies representing network behavior, security policy and application intent represented in the graph. This made it possible to see not just what was happening, but what should have been happening.

Long-term value

“The ontology has value beyond just separating the two companies,” O’Shea said. “It’s an observability dashboard at the application level.”

The migration team went one step further, adding a large language model on top of the graph to expose the data to anyone who needs it. Instead of relying on network engineers or security specialists to run complex queries, users can ask questions such as “Why is this application failing today when it worked yesterday?” and “Which dependencies are at risk?”

“You don’t have to know network speak,” O’Shea said. “You can just use your words and get what you want. Anybody can do it.”

Using the graph as a structured context dramatically reduces the risk of LLM hallucinations and enables discoveries that humans would miss. For example, the graph identified expired certificates on two backend servers as the root cause of intermittent application failures, something O’Shea said would normally take human engineers hours or days to diagnose.

The graph also exposed underused and unknown assets. Legacy servers without a clear owner could be monitored and safely taken down, rather than left running indefinitely out of fear of breaking something. Security risks became easier to spot as abnormal behavior stood out clearly against expected relationships.

In one case, the graph helped identify compromised devices serving as proxies for outbound attacks, an activity that had been blocked by firewalls but never previously correlated at the application level.

What started as a tool to manage divestiture risk has become a strategic asset, giving Daimler Truck lasting visibility into how its applications work, how they change and how failures propagate, benefits that extend well beyond the original goal of separating two companies.

Image: Daimler Truck