A computer-implemented method comprising: receiving multiple query components from multiple query sources (102; 310-330; 410-420) requesting information about one or more events in an enterprise system having multiple separate data sources (112, 122, 132, 142; 360-380; 450-460), where each event includes a change in a structured data object, the data sources (112, 122, 132, 142; 360-380; 450-460) being enterprise subsystems that generate the changes; identifying two query components related to common event information from one of the data sources (112, 122, 132, 142, 360-380; 450-460), wherein the common event information is duplicate for same information; combining, for stream sharing, the two query components into a single query component; sending the single query component to an enterprise node (342, 344; 430) local to the one data source (370, 380; 450, 460) of the enterprise system that generates the common event information; sending each other query components to enterprise nodes (110-140; 342, 344, 430) local to data sources (112, 122, 132, 142; 360- 80; 450-460) that generate event information related to the other query components; receiving a response to the single query component from the enterprise node (342, 344; 430) local to the one data source (370, 380; 450, 460); duplicating the response to the query sources (310-330; 410-420) that requested the two query components; and sending the response to each query source (102; 310-330; 410-420) to provide the event information as a partial event query response, wherein receiving the multiple query components comprises receiving query components from query sources (102; 310-330; 410-420) having different levels of security access (414, 424) with respect to the common event information; and wherein sending the single query component for the common event information further comprises indicating the different levels of security access (414, 424) with respect to the common event information; wherein sending the single query component comprises: forwarding, for purpose of combining the query components, a query component to a neighboring node (342; 344) of the enterprise system that has a query component for the common event information and that generates a request to the one data source (370; 380); and wherein receiving the response to the single query comprises: receiving the response from the neighboring node (342; 344) of the enterprise. receiving multiple query components from multiple query sources (102; 310-330; 410-420) requesting information about one or more events in an enterprise system having multiple separate data sources (112, 122, 132, 142; 360-380; 450-460), where each event includes a change in a structured data object, the data sources (112, 122, 132, 142; 360-380; 450-460) being enterprise subsystems that generate the changes; identifying two query components related to common event information from one of the data sources (112, 122, 132, 142, 360-380; 450-460), wherein the common event information is duplicate for same information; combining, for stream sharing, the two query components into a single query component; sending the single query component to an enterprise node (342, 344; 430) local to the one data source (370, 380; 450, 460) of the enterprise system that generates the common event information; sending each other query components to enterprise nodes (110-140; 342, 344, 430) local to data sources (112, 122, 132, 142; 360- 80; 450-460) that generate event information related to the other query components; receiving a response to the single query component from the enterprise node (342, 344; 430) local to the one data source (370, 380; 450, 460); duplicating the response to the query sources (310-330; 410-420) that requested the two query components; and sending the response to each query source (102; 310-330; 410-420) to provide the event information as a partial event query response, wherein receiving the multiple query components comprises receiving query components from query sources (102; 310-330; 410-420) having different levels of security access (414, 424) with respect to the common event information; and wherein sending the single query component for the common event information further comprises indicating the different levels of security access (414, 424) with respect to the common event information; wherein sending the single query component comprises: forwarding, for purpose of combining the query components, a query component to a neighboring node (342; 344) of the enterprise system that has a query component for the common event information and that generates a request to the one data source (370; 380); and wherein receiving the response to the single query comprises: receiving the response from the neighboring node (342; 344) of the enterprise. forwarding, for purpose of combining the query components, a query component to a neighboring node (342; 344) of the enterprise system that has a query component for the common event information and that generates a request to the one data source (370; 380); and wherein receiving the response to the single query comprises: receiving the response from the neighboring node (342; 344) of the enterprise.