Some embodiments provide a method for identifying root causes of incidents within a network. The method receives a graph of a portion of the network related to a particular network entity for which an incident is reported. The graph specifies dependencies between neighboring network entities in the network. The method uses probabilistic analysis to determine, for each network entity of a set of network entities represented in the graph, whether adjusting a set of metrics of the entity affects one or more metrics of the particular network entity that have been diagnosed as indicative of a problem. The method reports a subset of the network entities with metrics that affect the one or more metrics of the particular network entity as potential root causes of the incident.