A computing system may be configured to monitor the operation of a plurality of nodes in a manufacturing network that comprises a plurality of edge nodes, a plurality of intermediate nodes, and a root node. While monitoring the operation of the plurality of nodes, the computing system may identify a given time at which at least one node in the manufacturing network satisfies node-level threshold criteria indicating anomalous operation of the node and responsively evaluate the operation of the manufacturing network at the given time using one or more of macro-level threshold, micro-level threshold criteria, path-level threshold criteria, and node-level threshold criteria. Based on the evaluation, the computing system may identify an anomaly in the manufacturing network at the given time and then cause a client station to present an alert indicating the anomaly.