In one embodiment, a network assurance service that monitors one or more networks identifies changes in a key performance indicator for each of a plurality of network entities in the one or more networks. The service forms a peer group of network entities from the plurality of network entities whose changes in the key performance indicator are correlated. The service monitors the key performance indicator for network entities in the peer group of network entities. The service, based on the monitoring, detects an anomalous change in the key performance indicator for a particular network entity in the peer group of network entities relative to other network entities in the peer group of network entities.