Initiate a workflow to validate the alarm, ping and traceroute to the Interface (If it is IP enabled), identify weather the device’s gateway is reachable, if it was a transient alert, back-off and try again (either upon alarm clearing or wait for a fixed interval – whichever is easier to implement). Log onto the device and check for the interface status and interesting logs that show why the interface went down. Inform Ops on slack?