A method of real-time processing of events received from a network, the network comprises a plurality of network elements connected by a plurality of links, whereas an event comprises a plurality of attributes, the method comprising: - maintaining a plurality of counters, including counters indicating numbers of occurrences of instances of specific attributes of received events as well as counters indicating numbers of co-occurrences of instances of specific attributes of the received events, wherein instances of specific attributes are considered to co-occur if their events are received within a defined measurement window; - maintaining a record of instances of specific attributes of recent events received in a time period equal to the measurement window; - receiving a first event; - increasing respective counters indicating occurrences and co-occurrences of instances of attributes of received events, based on the instances of attributes of the first event; - for a first attribute, calculating relation measure scores between a first instance of the first attribute of the first event and instances of the first attribute of events recently received in the measurement window using the maintained record, wherein the relation measure score depends on a number of co-occurrences in which the first instance of the first attribute and a second instance of the first attribute were received within the measurement window, the total number of occurrences of the first instance and the total number of occurrences of the second instance; - identifying a group of events as related based on their relation measure scores; - creating incident information based on the information about the identified group of events. - maintaining a plurality of counters, including counters indicating numbers of occurrences of instances of specific attributes of received events as well as counters indicating numbers of co-occurrences of instances of specific attributes of the received events, wherein instances of specific attributes are considered to co-occur if their events are received within a defined measurement window; - maintaining a record of instances of specific attributes of recent events received in a time period equal to the measurement window; - receiving a first event; - increasing respective counters indicating occurrences and co-occurrences of instances of attributes of received events, based on the instances of attributes of the first event; - for a first attribute, calculating relation measure scores between a first instance of the first attribute of the first event and instances of the first attribute of events recently received in the measurement window using the maintained record, wherein the relation measure score depends on a number of co-occurrences in which the first instance of the first attribute and a second instance of the first attribute were received within the measurement window, the total number of occurrences of the first instance and the total number of occurrences of the second instance; - identifying a group of events as related based on their relation measure scores; - creating incident information based on the information about the identified group of events.