A method, comprising: determining, by a device, first network data corresponding to a first time period, the first network data including information associated with alarms detected by a set of network devices, included in a core network, during the first time period, and the first network data including information associated with incidents experienced by the set of network devices during the first time period; creating, by the device and based on the first network data, rules for an incident prediction model associated with the core network; receiving, by the device, second network data, associated with the core network, corresponding to a second time period, the second network data including information associated with alarms detected by at least one network device, of the set of network devices, during the second time period, the second network data including information associated with incidents experienced by the at least one network device during the second time period, and the second time period being a time period after the first time period; generating, by the device and based on the second network data and the incident prediction model, an incident prediction that includes a prediction whether the at least one network device will experience an incident during a third time period; and providing, by the device, information associated with the incident prediction to cause an action to be performed in the core network, the method further comprising: deriving a set of variables based on the first network data; identifying at least one variable, of the set of variables, as a predictor variable; and where creating the rules for the incident prediction model comprises: creating the rules for the incident prediction model based on the identified predictor variable, the at least one variable identified as a predictor variable comprises at least one of: a number of alarms per twelve hours variable, a reason for a last alarm sequence variable, an alarm intensity variable, an alarm reason variable, a maximum amount of memory usage per twelve hours variable, and a number of alarm sequences per six hours variable. determining, by a device, first network data corresponding to a first time period, the first network data including information associated with alarms detected by a set of network devices, included in a core network, during the first time period, and the first network data including information associated with incidents experienced by the set of network devices during the first time period; creating, by the device and based on the first network data, rules for an incident prediction model associated with the core network; receiving, by the device, second network data, associated with the core network, corresponding to a second time period, the second network data including information associated with alarms detected by at least one network device, of the set of network devices, during the second time period, the second network data including information associated with incidents experienced by the at least one network device during the second time period, and the second time period being a time period after the first time period; generating, by the device and based on the second network data and the incident prediction model, an incident prediction that includes a prediction whether the at least one network device will experience an incident during a third time period; and providing, by the device, information associated with the incident prediction to cause an action to be performed in the core network, deriving a set of variables based on the first network data; identifying at least one variable, of the set of variables, as a predictor variable; and where creating the rules for the incident prediction model comprises: creating the rules for the incident prediction model based on the identified predictor variable, the at least one variable identified as a predictor variable comprises at least one of: a number of alarms per twelve hours variable, a reason for a last alarm sequence variable, an alarm intensity variable, an alarm reason variable, a maximum amount of memory usage per twelve hours variable, and a number of alarm sequences per six hours variable. creating the rules for the incident prediction model based on the identified predictor variable, the at least one variable identified as a predictor variable comprises at least one of: a number of alarms per twelve hours variable, a reason for a last alarm sequence variable, an alarm intensity variable, an alarm reason variable, a maximum amount of memory usage per twelve hours variable, and a number of alarm sequences per six hours variable. a number of alarms per twelve hours variable, a reason for a last alarm sequence variable, an alarm intensity variable, an alarm reason variable, a maximum amount of memory usage per twelve hours variable, and a number of alarm sequences per six hours variable.