SYSTEM AND METHOD FOR INCIDENT ROOT CAUSE ANALYSIS

A method of incident root cause analysis in an information technology (IT) system, wherein upon occurrence of an incident collecting changes to configuration items and/or system parameters on computer stations during a predetermined time prior to the incident, calculating a change lifetime for each of the collected changes, comparing the change lifetime to the time of occurrence of the incident to determine if the lifetime of the change is still valid, marking a probability value of zero for occurrence of the incident as a result of the change for changes with an expired lifetime value at the time of the incident, otherwise estimating a risk profile and calculating from it a probability value for occurrence of the incident as a result of the change, sorting the changes according to the probability value, and selecting a predetermined number of changes having the highest probability values for root cause analysis.