the stronger a causality and/or precedence implication between the two activities is understood to be. Such directly-follows relationships are also the basis for the identification of more complex and abstract constructs in the workflow of a process, such as interleaving or parallelism of activities. These relationships between activities are often represented in a labeled directed graph called the _Directly-Follows Graph_ (DFG). In recent times, a new type of event logs has gained research interest: _uncertain event logs_[2]. Such execution logs contain, rather than precise values, an indication of the possible values that event attributes can acquire. In this paper, we will consider the setting where uncertainty is represented by either an interval or a set of possible values for an event attribute. Moreover, we will consider the case in which an event has been recorded in the event log albeit it did not happen in reality. Uncertainty in event logs is best illustrated with a real-life example of a process that can generate uncertain data in an information system. Let us consider the following process instance, a simplified version of anomalies that are actually occurring in processes of the healthcare domain. An elderly patient enrolls in a clinical trial for an experimental treatment against myeloproliferative neoplasms, a class of blood cancers. The enrollment in this trial includes a lab exam and a visit with a specialist; then, the treatment can begin. The lab exam, performed on the 8 th of July, finds a low level of platelets in the blood of the patient, a condition known as thrombocytopenia (TP). At the visit, on the 10 th of May, the patient self-reports an episode of night sweats on the night of the 5 th of July, prior the lab exam: the medic notes this, but also hypothesized that it might not be a symptom, since it can be caused not by the condition but by external factors (such as very warm weather). The medic also reads the medical records of the patient and sees that shortly prior to the lab exam, the patient was undergoing a heparine treatment (a blood-thinning medication) to prevent blood clots. The thrombocytopenia found with the lab exam can then be primary (caused by the blood cancer) or secondary (caused by other factors, such as a drug). Finally, the medic finds an enlargement of the spleen in the patient (splenomegaly). It is unclear when this condition has developed: it might have appeared in any moment prior to that point. The medic decides to admit the patient in the clinical trial, starting 12 th of July. These events generate the trace of Table 1 in the information system of the hospital. For clarity, the timestamp field only reports the day of the month. Event \(e_{2}\) has been recorded with two possible activity labels (_PrTP_ or _SecTP_). This is an example of uncertainty on activities. Some events, e.g., \(e_{3}\), do not have a precise timestamp but a time interval in which the event could have happened has been recorded: in some cases, this causes the loss of a precise ordering of events (e.g., \(e_{2}\) and \(e_{3}\)). This is an instance of uncertainty on the time dimension, i.e., on timestamps. As evident by the \"?\" symbol, \(e_{1}\) is an indeterminate event: it has been recorded, but it is not guaranteed to have actually happened. Conversely, the \"?\" symbol indicates that the \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Case ID** & **Event ID** & **Timestamp** & **Activity** & **Indet. Event** \\ \hline ID327 & \(e_{1}\) & 5 & _NightSreats_ &? \\ ID327 & \(e_{2}\) & 8 & \{_PrTP_, _SecTP_\} &! \\ ID327 & \(e_{3}\) & [4, 10] & _Splenomeg_ &! \\ ID327 & \(e_{4}\) & 12 & _Adm_ &! \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The uncertain trace of an instance of healthcare process used as running example. The “Case ID” is a unique identifier for all events in a single process case; the “Event ID” is a unique identifier for the events in the trace.