A computer-implemented method for monitoring transactions in a computer system includes monitoring events reported by components of the computer system responsively to a flow of the transactions through the system. A state machine model and a rule-based model are jointly applied to the monitored events, so as to identify respective transaction-level events and business-level events. A status of the flow of the transactions is assessed responsively to the transaction-level events and the business-level events.