A population of devices provides telemetry data and receives software changes or updates. Event buckets for respective events are found. Event buckets have counts of event instances, where each event instance is an occurrence of a corresponding event reported as telemetry by a device. Records of the software changes are provided, each change record representing a software change on a corresponding device. The event buckets are analyzed to identify which indicate an anomaly. Based on the change records and the identified event buckets, correlations between the software changes and the identified event buckets are found.