Category determining incident root cause