Techniques for recommending plans to remediate a network topologies are disclosed. The techniques include predicting characteristics of the network using network topology information identifying relationships between entities in the network. The techniques further include determining a subset of the topology based on the predicted characteristics violating anomaly detection criteria. Additionally, the techniques include determining a remediation plan for modifying the subset and presenting the plan to a user.