View article

One embodiment provides a method, including: utilizing at least one processor to execute computer code that performs the steps of: receiving at least one heterogeneous system log from each of a plurality of systems, wherein each of the heterogeneous system logs comprises events corresponding to activities occurring within its corresponding system; for each of the plurality of systems, analyzing the events contained within its at least one heterogeneous system log to identify a plurality of entities, wherein each of the entities is associated with at least one of the activities; identifying relationships, across the plurality of systems, between entities within the plurality of entities; and linking (i) the entities having an identified relationship and (ii) the activities of those entities. Other aspects are described and claimed.