Detecting network events having adverse user impact

A method comprising:

• determining, by a network management system (NMS) executed by processing circuitry, a pattern of network events within a rolling time window based on network telemetry data obtained from a plurality of network devices that provide network access to one or more client devices;
• determining, by the NMS, an impact event based on user data obtained from the one or more client devices for one or more users, the user data indicating feedback related to a quality of an application session;
• correlating, by the NMS, in time the pattern of network events within the rolling time window to the impact event;
• and
• determining, by the NMS, based at least in part on the correlation, that the pattern of network events is indicative of network behavior that is a cause of the impact event, wherein the network behavior comprises an instance of a high volume of discovery messages per unit time exchanged by the one or more client devices.

Non-transitory, computer-readable media comprising instructions that, when executed, cause processing circuitry to:

• execute a network management system (NMS) configured to:
• determine a pattern of network events within a rolling time window based on network telemetry data obtained from a plurality of network devices that provide network access to one or more client devices;
• determine an impact event based on user data obtained from the one or more client devices for one or more users, the user data indicating feedback related to a quality of an application session;
• correlate in time the pattern of network events within the rolling time window to the impact event;
• and
• determine, based at least in part on the correlation, that the pattern of network events is indicative of network behavior that is a cause of the impact event, wherein the network behavior comprises an instance of a high volume of discovery messages per unit time exchanged by the one or more client devices.