US Patent 12028204 Network event detection and automated remediation

A method of identification and remediation of a mass event in a managed network. The method includes receiving a first report of an event occurring at a first endpoint of the managed network. In response, a first action is performed. The first action being initiated based on a repeating event trigger not being triggered. The method includes receiving a second report of the event occurring at a second endpoint. In response, the method includes determining whether a threshold that triggers the repeating event trigger is exceeded. The threshold being indicative of a mass event in the managed network. Responsive to the threshold being exceeded, the method includes triggering the repeating event trigger and performing a second automated resolution action in the managed network. The second action being different from the first action. Responsive to the threshold not being exceeded, the method includes performing the first action at the second endpoint.