# US 2026/0074947 A1 · Intelligent network incident management, root cause analysis, and automated remediation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0074947 A1 - Document ID: US20260074947A1 - Status: Published application - Kind: A1 - Application number: 18/826,888 - Filed: 2024-09-06 - Published: 2026-03-12 - Earliest claimed: 2024-09-06 - Assignees: Zscaler, Inc. - Applicants: Zscaler, Inc. - Inventors: Rosh Ramadass; Sasamka Mone - Web page: https://patentgrep.com/patent/US20260074947A1 ## CPC - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for intelligent network incident management, Root Cause Analysis (RCA), and automated remediation include receiving metrics, graphs, and historic logs associated with network performance of a tenant of the cloud system; identifying a network issue based on the received metrics, graphs, and historic logs; performing an automated RCA to determine a cause of the network issue; and remediating the identified network issue based on the determined cause. Various embodiments include training specialized Large Language Models (LLMs) for performing the automated incident identification, RCA, and remediation. ## Claims ### Claim 1 A method implemented by a cloud system comprising steps of: receiving metrics, graphs, and historic logs associated with network performance of a tenant of the cloud system; identifying a network issue based on the received metrics, graphs, and historic logs; performing an automated Root Cause Analysis (RCA) to determine a cause of the network issue; and remediating the identified network issue based on the determined cause. ### Claim 2 (depends on 1) The method of claim 1, wherein the graphs comprise metric trends over a period of time. ### Claim 3 (depends on 1) The method of claim 1, wherein the remediation is performed automatically based on one or more remediation scripts. ### Claim 4 (depends on 1) The method of claim 1, wherein identifying the network issue is based on one or more metric thresholds. ### Claim 5 (depends on 4) The method of claim 4, wherein the one or more metric thresholds are dynamic, and wherein the steps comprise adjusting the one or more metric thresholds via a trained Large Language Model (LLM). ### Claim 6 (depends on 1) The method of claim 1, wherein the metrics, graphs, and historic logs are received from one or more cloud connectors. ### Claim 7 (depends on 6) The method of claim 6, wherein the one or more cloud connectors are associated with any of computing devices and enterprise networks. ### Claim 8 (depends on 1) The method of claim 1, wherein the identifying a network issue, performing automated RCA, and remediating are each performed by one or more trained Large Language Models (LLMs). ### Claim 9 (depends on 8) The method of claim 8, wherein the steps comprise: training a first LLM to perform automated identification of network issues; training a second LLM to perform automated RCA; and training a third LLM to perform automated remediation of identified network issues. ### Claim 10 (depends on 9) The method of claim 9, wherein the tenant is one of a plurality of tenants of the cloud system, and wherein the one or more LLMs are trained based on tenant-specific metrics, graphs, and historic logs. ### Claim 11 A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors associated with a cloud system to perform steps of: receiving metrics, graphs, and historic logs associated with network performance of a tenant of the cloud system; identifying a network issue based on the received metrics, graphs, and historic logs; performing an automated Root Cause Analysis (RCA) to determine a cause of the network issue; and remediating the identified network issue based on the determined cause. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the graphs comprise metric trends over a period of time. ### Claim 13 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the remediation is performed automatically based on one or more remediation scripts. ### Claim 14 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein identifying the network issue is based on one or more metric thresholds. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the one or more metric thresholds are dynamic, and wherein the steps comprise adjusting the one or more metric thresholds via a trained Large Language Model (LLM). ### Claim 16 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the metrics, graphs, and historic logs are received from one or more cloud connectors. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the one or more cloud connectors are associated with any of computing devices and enterprise networks. ### Claim 18 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the identifying a network issue, performing automated RCA, and remediating are each performed by one or more trained Large Language Models (LLMs). ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the steps comprise: training a first LLM to perform automated identification of network issues; training a second LLM to perform automated RCA; and training a third LLM to perform automated remediation of identified network issues. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the tenant is one of a plurality of tenants of the cloud system, and wherein the one or more LLMs are trained based on tenant-specific metrics, graphs, and historic logs.