1. An method for clustering events, comprising: receiving data at an extraction engine from managed infrastructure; converting the events into alerts; mapping the alerts into a matrix M; determining one or more common steps from the events and producing clusters relating to the alerts and or events.