Application runtime data is obtained from an application monitoring system which monitors execution of an application, and traffic monitoring data is obtained from a traffic monitoring system which monitors traffic to/from the application as the clients interact with the application. Corresponding application runtime data and traffic monitoring data can be selectively output to assist an operator in investigating an anomalous condition. The data can be classified and selectively output according to one or more hierarchies which characterize the interactions. The hierarchies can include a domain level, a business process level (where a domain is made up of a number of business processes), a business transaction level (where a business process is made up of different business transactions), an individual transaction level (where a business transaction is made up of different transactions), and a transaction component level (where a transaction is made up of one or more transaction components).