receiving a plurality of events from multiple event sources;

classifying a plurality of the events according to a set of event attributes;

determining a temporal proximity of occurrence of different classified events;

further determining a frequency of occurrence of temporal proximity for particular classified events; and,

reporting a causal relationship between the particular classified events when the frequency of occurrence exceeds a threshold value.