In general, the subject matter described in this specification can be embodied in methods, systems, and program products for correlating status information generated in a computer network. A computing system receives, for each particular computer server or application program in a group of computer servers and application programs that are executing on the computer servers, information that identifies statuses of the particular computer server or application program at a plurality of times. The computing system generates, using the information received, network signatures that each represent statuses of the computer servers and application programs in the group for a particular time, the network signatures being for multiple times. The computer system stores the network signatures along with data that identifies relationships, for each of the multiple times, between (i) application programs and the computer servers on which they were executing, and (ii) application programs that were in communication with each other.