A method may include determining first network data corresponding to a first time period, including alarm data and incident data collected by a set of network devices of a core network during the first time period. The method may include creating, based on the first network data, an incident prediction model. The method may include receiving second network data, associated with the core network, corresponding to a second time period. The second network data may include alarm data and incident data collected by a network device, of the set of network devices, during the second time period. The method may include generating, based on the second network data and the incident prediction model, an incident prediction that includes a prediction whether the network device will experience an incident during a third time period.