A system and method is disclosed for performance analysis of processes in a managed network. Processes may be represented as sets of activities, and an audit database may be configured for logging activities within the managed network. Database may include fields to identify process instances, process classes, process states, and process transitions. A server device may receive a request from a client device to view information representative of multiple process instances. The server device may select a plurality of process instances according to filter criteria applied to the data fields of the audit database records, and generate a graphical representation of interconnections between the one or more data fields of the selected plurality based on a statistical analysis of the one or more data fields of the audit database records corresponding to the selected plurality of process instances. The server may then transmit the graphical representation to the client device.