Near Real-Time System or Network Incident Detection

Systems and arrangements for performing a textual analysis to identify incidents likely to cause a significant business impact are provided. Historical data related to previously occurring incidents may be analyzed to determine a magnitude of impact of the incident. The magnitude may be compared to a predetermined threshold and, if above the threshold, the incident may be flagged as having a significant business impact. If the magnitude is below the threshold, the incident may be flagged as not having a significant business impact. The incidents in each group may then be analyzed to identify keywords, combinations, and/or sequences having a strong correlation to incidents having a significant business impact and incidents not having a significant business impact, which may form inclusion and exclusion criteria. Data from newly received incidents may be compared to the inclusion and exclusion criteria to determine whether the incident is likely to have a significant business impact.