An embodiment involves receiving a request specifying a particular process, wherein an event table associates event identifiers of events, process identifiers of processes that generated to the events, timestamps of times when the events occurred, states of the processes at the times, and references to related processes; generating nodes of a graph, wherein the particular process and each of its related processes are represented by entity nodes annotated with respective process identifiers, and the events are represented by event nodes annotated with respective event identifiers; generating edges between the entity nodes and the event nodes for which the events of the event nodes either were: generated by the processes represented by the entity nodes, or refer to the processes represented by the entity nodes; and generating edges between pairs of the event nodes that: generated by a common process, and the events of which occurred sequentially according to their timestamps.