In one embodiment, the techniques herein provide that a node may receive indicia of a fault state in one or more components of a computer network. Based on the indicia, the node may then identify a network dependency group including a plurality of network components that are hierarchically associated with the one or more components. The node may then receive, from a database, a time series of performance data values corresponding to the network dependency group, wherein the time series comprises performance data values from before and after the onset of the fault state. The node may then identify altered performance data values in the time series comprising values which differ before and after onset of the fault state, and then determine a root cause of the fault state by identifying one or more particular components within the network dependency group that are associated with the altered performance data values.