A method by a network device to enrich database logs. The method includes detecting that a process executing on the network device has created a database connection to a database server, determining contextual information of the process in response to detecting that the process has created the database connection, generating a key associated with the database connection based on information that is known to be included in a database log of the database, and providing the key and the contextual information to a correlator component.