A system and method for automating workflow and performing root cause analysis for enforcement events is presented. The system can enable accurate detection of an enforcement event and identifies the root cause of such events. The system can provide a user with an interface to monitor the enforcement event by collecting a list of data characterizing the enforcement event, as well as analyze the data to evaluate what is the root cause of the enforcement event. The system can extract critical information from train system logs of the train using an extraction model to generate a window of activity providing an analysis model with a comprehensive scope to analyze the enforcement event. The system can give the user robust and accurate information of the root cause of the enforcement event.