System and method for network incident remediation recommendations

A method for identifying network incidents and providing remediation recommendations for the network incidents, the method comprising:

• analyzing a stream of network data that is captured over a time period, in order to identify a plurality of incidents within the network over the time period, each network incident relating to an issue and having a set of symptoms that is associated with a set of possible root-causes;
• and
• identifying a plurality of groups of network incidents with the network incidents in each group related to the same issue;
• analyzing the grouped network incidents to identify, and to provide a display of, a list of remediation recommendations that includes a remediation recommendation for each group of incidents, each group's remediation recommendation identifying a remediation to resolve the issue related to the group and a quantified expected benefit from implementing the remediation.

A non-transitory machine readable medium comprising a program that when executed by at least one processing unit identifies network incidents and provides remediation recommendations for the network incidents, the program comprising sets of instructions for:

• analyzing a stream of network data that is captured over a time period, in order to identify a plurality of incidents within the network over the time period, each network incident relating to an issue and having a set of symptoms that is associated with a set of possible root-causes;
• and
• identifying a plurality of groups of network incidents with the network incidents in each group related to the same issue;
• analyzing the grouped network incidents to identify, and to provide a display of, a list of remediation recommendations that includes a remediation recommendation for each group of incidents, each group's remediation recommendation identifying a remediation to resolve the issue related to the group and a quantified expected benefit from implementing the remediation.