A method for identifying causality objects comprising a causality link between two or more alerts, wherein an alert is produced by a fault occurring in a node of a cloud environment comprising nodes for running application programs, the method comprising: - receiving a set of alerts (A to E), - forming all possible combinations of a number k+1 of the alerts of the set, wherein the number k is firstly set to one, wherein for the number k equal to one, the possible combinations are formed by combining two different alerts of the set, whereas for a number k higher than one, the possible combinations are formed by combining a filtered combination of a number k of alerts and an alert of the set which is not part of the filtered combination, - for each possible combination of k+1 alerts, detecting a co-occurent combination if the k+1 alerts of the combination are co-occurent, wherein a co-occurrence is detected as a function of one or more co-occurrence rule, - for a detected co-occurent combination of k+1 alerts, detecting if there is a causality link between a subset of k alerts of the combination of k+1 alerts and the last alert of the combination, as a function of one or more causality rule, - as a function of detecting that there is a causality link, storing a causality object in a causality repository, wherein the causality object comprises an oriented link originating from the subset of k alerts of the combination of k+1 alerts identified as source alerts of the causality object, and pointing to the last alert of the combination of alerts identified as an end alert of the causality object, - filtering a possible combination of a number k+1 alerts, wherein the possible combination of a number k+1 alerts is a filtered combination of a number k+1 of alerts if the possible combination of a number k+1 alerts is a co-occurent combination of alerts in which no causality link has been detected, - iterating to the step of forming and increasing the number k by one until the number k is equal to the number of alerts of the set or until no combination of a number k+1 of alerts has been filtered. - receiving a set of alerts (A to E), - forming all possible combinations of a number k+1 of the alerts of the set, wherein the number k is firstly set to one, wherein for the number k equal to one, the possible combinations are formed by combining two different alerts of the set, whereas for a number k higher than one, the possible combinations are formed by combining a filtered combination of a number k of alerts and an alert of the set which is not part of the filtered combination, - for each possible combination of k+1 alerts, detecting a co-occurent combination if the k+1 alerts of the combination are co-occurent, wherein a co-occurrence is detected as a function of one or more co-occurrence rule, - for a detected co-occurent combination of k+1 alerts, detecting if there is a causality link between a subset of k alerts of the combination of k+1 alerts and the last alert of the combination, as a function of one or more causality rule, - as a function of detecting that there is a causality link, storing a causality object in a causality repository, wherein the causality object comprises an oriented link originating from the subset of k alerts of the combination of k+1 alerts identified as source alerts of the causality object, and pointing to the last alert of the combination of alerts identified as an end alert of the causality object, - filtering a possible combination of a number k+1 alerts, wherein the possible combination of a number k+1 alerts is a filtered combination of a number k+1 of alerts if the possible combination of a number k+1 alerts is a co-occurent combination of alerts in which no causality link has been detected, - iterating to the step of forming and increasing the number k by one until the number k is equal to the number of alerts of the set or until no combination of a number k+1 of alerts has been filtered.