A telecommunication network management system. The system comprises an incident reporting application that creates incident reports pursuant to alarms on network elements of a telecommunication network and wherein one of the incident reports is associated with a large-scale event (LSE), wherein the LSE incident report identifies alarms at a plurality of different network elements as associated with the LSE; and an incident management application that analyzes attributes of cell sites identified in the LSE incident report as impacted by the LSE, determines that at least 75% of the cell sites receive backhaul service from a same alternative access vendor (AAV) and that at least one backhaul circuit of the at least 75% of the cell sites is in an alarmed state, causes the incident reporting application to record a root cause of the LSE incident report as an AAV fault.