Network event grouping

A method, comprising:

• receiving, via one or more processors, historical event data associated with a computing network during a first time period;
• determining, via the one or more processors, a plurality of event types based on the historical event data received during the first time period;
• calculating, via the one or more processors, a correlation between each event type of the plurality of event types based on an amount of mutual information between an event of each event type and an event of each other event type of the plurality of event types;
• determining, via the one more processors, one or more sets of event types of the plurality of event types by dynamically adjusting a threshold degree of correlation between the plurality of event types in real-time until a peak number of sets of event types is determined, wherein each event type of a particular set of event types of the one or more sets of event types has a respective correlation with at least one other event type of the particular set of event types greater than the threshold degree of correlation;
• storing, via the one or more processors, data specifying the one or more sets of event types;
• receiving, via the one or more processors, event data associated with the computing network during a second time period;
• aggregating, via the one or more processors, the event data received during the second time period into respective event types and respective sets of event types based on the determined one or more sets of event types;
• and
• transmitting, via the one or more processors, the aggregated event data to a display device for display.

A non-transitory, computer-readable storage medium, comprising instructions that when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving historical event data associated with a computing network;
• determining a plurality of event types based on the historical event data;
• calculating a correlation between each event type of the plurality of event types based on an amount of mutual information between an event of each event type and an event of each other event type of the plurality of event types, wherein the correlation is indicative of a co-occurrence between the event of each event type and the event of each other event type;
• determining one or more sets of event types of the plurality of event types by dynamically adjusting a threshold degree of correlation between the plurality of event types in real-time until a peak number of sets of event types is determined, wherein each event type of a particular set of event types of the one or more sets of event types has a respective correlation with at least one other event type of the particular set of event types greater than the threshold degree of correlation;
• receiving event data associated with a plurality of events occurring within the computing network, wherein the event data comprises one or more alerts;
• aggregating the event data into respective event types and respective sets of event types based on the determined one or more sets of event types;
• and
• activating one or more auto-remediation measures based on the aggregated event data to resolve the one or more alerts.