A method of identifying a root cause of an event in a network of linked entities. The method comprises: defining a plurality of signatures, each signature comprising one or more classes, the classes being categorized by a taxonomy of classes; receiving a first message from the network; assigning one or more of the signatures to the first message; establishing a set of one or more hypotheses, each hypothesis identifying:a respective root cause; and one of the signatures assigned to the first message; receiving one or more subsequent messages from the network; determining whether each subsequent message matches a signature identified by a previously hypothesis; and generating an output based on the determination.Typically the method involves an element of human interaction. Typically at least one of the signatures includes a class which encloses two or more subclasses categorized by the taxonomy of classes. The ability to define signatures including such higher level entity classes in the taxonomy enables a human user to generate, store and edit generic hypotheses quickly and intuitively, and/or provides an output which can be easily understood by a human user.