Hidden data co-occurrence relationships may be detected by a computer-implemented method, including monitoring data processing events on one or more server computers, gathering co-occurrences between a plurality of the data processing events, and generating one or more lineages between a plurality of directories associated with the plurality of the data processing events based on the gathered co-occurrences.