A system, comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: collecting network information and corresponding timestamps from multiple nodes in a network, wherein the network information is associated with flows transmitted from the multiple nodes; collecting application information from the multiple nodes, wherein the application information is associated with at least one application that executes on the multiple nodes and causes the multiple nodes to transmit the flows; receiving a request message (302, 308), wherein the request message indicates an anomaly at a node in the multiple nodes or in the network and includes network information that corresponds to the anomaly and a message timestamp; identifying network information candidates by comparing the network information in the request message (302, 308) to the network information from the multiple nodes; identifying a narrowed set of network information candidates by comparing the message timestamp to corresponding timestamps of the identified network information candidates; correlating the narrowed set of network information candidates to the collected application information; and based on the correlating, identifying an application from the at least one application that caused the anomaly. a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising: collecting network information and corresponding timestamps from multiple nodes in a network, wherein the network information is associated with flows transmitted from the multiple nodes; collecting application information from the multiple nodes, wherein the application information is associated with at least one application that executes on the multiple nodes and causes the multiple nodes to transmit the flows; receiving a request message (302, 308), wherein the request message indicates an anomaly at a node in the multiple nodes or in the network and includes network information that corresponds to the anomaly and a message timestamp; identifying network information candidates by comparing the network information in the request message (302, 308) to the network information from the multiple nodes; identifying a narrowed set of network information candidates by comparing the message timestamp to corresponding timestamps of the identified network information candidates; correlating the narrowed set of network information candidates to the collected application information; and based on the correlating, identifying an application from the at least one application that caused the anomaly. collecting network information and corresponding timestamps from multiple nodes in a network, wherein the network information is associated with flows transmitted from the multiple nodes; collecting application information from the multiple nodes, wherein the application information is associated with at least one application that executes on the multiple nodes and causes the multiple nodes to transmit the flows; receiving a request message (302, 308), wherein the request message indicates an anomaly at a node in the multiple nodes or in the network and includes network information that corresponds to the anomaly and a message timestamp; identifying network information candidates by comparing the network information in the request message (302, 308) to the network information from the multiple nodes; identifying a narrowed set of network information candidates by comparing the message timestamp to corresponding timestamps of the identified network information candidates; correlating the narrowed set of network information candidates to the collected application information; and based on the correlating, identifying an application from the at least one application that caused the anomaly.