A system and method identify a set of rules for determining a commonality of attributes across different behavior changes for a network. The system performs the method by receiving a set of data correlating network triggers to performance changes of one or more network devices. The set of data further includes an indication of a sign of the performance change for each of the network devices based on the triggers. The method further includes extracting a set of rules relating to a set of relationships between the triggers and the performance changes. The rules identify a commonality of the performance changes for multiple network devices based on the triggers.