A method, system, and computer program product for event detection using roles and relationships of entities are provided in the illustrative embodiments. A training event and a set of entities participating in the training event are identified in a training data. For a first entity in the set of entities, a first role occupied by the entity in the event is determined. A behavior attribute is assigned to the first role. A relationship of the first role with a second role corresponding to a second entity in the set of entities is determined. An event rule is constructed to detect an event corresponding to the training event in new data and comprising a plurality of roles, behavior attributes, and the relationship. The plurality of roles includes the first role and the second role, and the plurality of behavior attributes includes the behavior attribute assigned to the first role.