A computer may receive connection information associated with one or more communication devices in a network, where the connection information specifies dynamic associations or connections between electronic devices and the one or more communication devices in an environment as a function of time. Then, the computer may store system information that includes: first identifiers of the one or more communication devices, second identifiers of the electronic devices, and timestamps, where a portion of the system information specifies a duration of a dynamic association or connection between a given electronic device and a given communication device. Moreover, the computer may receive occurrence information that indicates an occurrence of an event. In response, the computer may determine, based at least in part on the system information, one or more regions in the environment where an electronic device was present during a time interval, and the computer may accordingly perform a remedial action.