Identifying problem graphs in an information technology infrastructure network

Method and system are provided for identifying problem graphs in an information technology infrastructure network. The method includes: selecting a set of nodes in a topology, wherein the nodes of the topology represent resources in an information technology infrastructure network; querying historical timeseries data for the selected nodes, wherein the timeseries data records changes in state of the resources represented by the nodes; and analyzing the timeseries data for the selected nodes across problem time periods to produce a set of historical directional rules defining one or more historic problem graph. The method may search the historic problem graphs for current problem state nodes to determine likely causing nodes and affected nodes of a current problem.