A method for diagnosing and resolving network incidents, the method comprising: generating, by one or more processors, a model of historic network incidents, comprising: executing clustering logic against historic network incident data, wherein the clustering logic is configured to identify a plurality of clusters (310, 320) associated with the network incidents represented by the historic network incidents data, each cluster of the plurality of clusters (310, 320) corresponding to a set of historic network incidents associated with a same network incident cause, wherein each of the clusters (310, 320) represents a different type of network incident; receiving, by the one or more processors, an alarm message comprising information indicative of a network incident that occurred in a network; executing, by the one or more processors, machine learning logic against the information indicative of the network incident and the model to determine one or more candidate actions, the one or more candidate actions determined to resolve a cause of the network incident; determining a score for each of the candidate actions, the score being based on a metric representing a degree of closeness between parameters of the alarm message and one or more network incidents of a cluster determined to be similar to the network incident; and executing, by the one or more processors, at least one candidate action of the one or more candidate actions, wherein when the score for the at least one candidate action satisfies a threshold score, the at least one candidate action is automatically executed; wherein the executing of the at least one candidate action resolves a cause of the network incident. generating, by one or more processors, a model of historic network incidents, comprising: executing clustering logic against historic network incident data, wherein the clustering logic is configured to identify a plurality of clusters (310, 320) associated with the network incidents represented by the historic network incidents data, each cluster of the plurality of clusters (310, 320) corresponding to a set of historic network incidents associated with a same network incident cause, wherein each of the clusters (310, 320) represents a different type of network incident; executing clustering logic against historic network incident data, wherein the clustering logic is configured to identify a plurality of clusters (310, 320) associated with the network incidents represented by the historic network incidents data, each cluster of the plurality of clusters (310, 320) corresponding to a set of historic network incidents associated with a same network incident cause, wherein each of the clusters (310, 320) represents a different type of network incident; receiving, by the one or more processors, an alarm message comprising information indicative of a network incident that occurred in a network; executing, by the one or more processors, machine learning logic against the information indicative of the network incident and the model to determine one or more candidate actions, the one or more candidate actions determined to resolve a cause of the network incident; determining a score for each of the candidate actions, the score being based on a metric representing a degree of closeness between parameters of the alarm message and one or more network incidents of a cluster determined to be similar to the network incident; and executing, by the one or more processors, at least one candidate action of the one or more candidate actions, wherein when the score for the at least one candidate action satisfies a threshold score, the at least one candidate action is automatically executed; wherein the executing of the at least one candidate action resolves a cause of the network incident.