In various examples, upon receiving data comprising a plurality of key performance indicators (KPIs), an anomaly may be detected in a first KPI. An engine may apply rules associating two or more KPIs together to confirm, reject, or narrow the anomaly in the first KPI. Through this technology, the mean time for detecting an anomaly in a network may be reduced thereby preventing the potential for more serious anomalies in the network.