A method including receiving events from different data sources for a service automatically executing in an enterprise system. A first event is enriched by providing the first event with first metadata that associates the first event with a first application used by the service. The first event is assigned to a time slice associated with the first application. A second event is enriched in a similar manner. A correlation graph of nodes and edges is built using the enriched events, with nodes representing the events and edges indicating relationships between the edges. A third event indicating a fault in the first application associated with the first node is received. The source of the error for the third event is identified using the second updated correlation graph and the time slice. The source of error is then mitigated.