Process states of computing devices may be obtained and processed. Process event information of a computing device may be obtained. The process event information may characterize states of processes of the computing device. The process event information may be stored within a queue. Graph information may be determined based on the process event information within the queue. The graph information may characterize states of processes of the computing device using nodes and edges. The graph information may be stored within a graph database.