Novel tools and techniques for the machine discovery and rapid agglomeration of similar states are provided. A system includes a plurality of network devices, and a decision system. The plurality of network devices may be configured to generate a respective data stream. The decision system may include a processor and a non-transitory computer readable medium including instructions executable by the processor. The system may obtain, via the plurality of network devices, one or more data streams, determine an anomaly has occurred on a data stream of the one or more data streams, determine a set of data streams of the one or more streams sharing at least one of a set of centroids associated with the data stream, and determine, based on the set of data streams, the occurrence of an incident.