A method, comprising: receiving, by a device, an event entry of a telemetry data event stream, wherein the event entry is representative of an event associated with an attribute, wherein the attribute comprises an internet protocol address associated with the event; generating, by the device and using a lookup table, an event record based on the event entry, wherein the lookup table includes a mapping of the attribute to a first context value, and wherein the event record indicates that the first context value is associated with the event; storing the event record in an event record data structure; logging, by the device and in the mapping of the lookup table, a first timestamp associated with the attribute, wherein the first timestamp is included in the event entry; receiving, by the device, a context entry of a telemetry data context stream; determining that the context entry indicates that the attribute is associated with a second context value that is different from the first context value, and wherein the first context value comprises a host identifier of a first user device and the second context value comprises a host identifier of a second user device different from the first user device; determining, by the device and based on determining that the first context value is different from the second context value, whether a second timestamp, of the context entry, is before the first timestamp; and performing, by the device, an action based on whether the second timestamp is before the first timestamp, wherein, when the second timestamp is determined to be before the first timestamp, performing the action comprises: generating an error record that identifies a time period between the first timestamp and the second timestamp to indicate that any context value that was associated with the attribute during the time period is inaccurate. receiving, by a device, an event entry of a telemetry data event stream, wherein the event entry is representative of an event associated with an attribute, wherein the attribute comprises an internet protocol address associated with the event; generating, by the device and using a lookup table, an event record based on the event entry, wherein the lookup table includes a mapping of the attribute to a first context value, and wherein the event record indicates that the first context value is associated with the event; storing the event record in an event record data structure; logging, by the device and in the mapping of the lookup table, a first timestamp associated with the attribute, wherein the first timestamp is included in the event entry; receiving, by the device, a context entry of a telemetry data context stream; determining that the context entry indicates that the attribute is associated with a second context value that is different from the first context value, and wherein the first context value comprises a host identifier of a first user device and the second context value comprises a host identifier of a second user device different from the first user device; determining, by the device and based on determining that the first context value is different from the second context value, whether a second timestamp, of the context entry, is before the first timestamp; and performing, by the device, an action based on whether the second timestamp is before the first timestamp, wherein, when the second timestamp is determined to be before the first timestamp, performing the action comprises: generating an error record that identifies a time period between the first timestamp and the second timestamp to indicate that any context value that was associated with the attribute during the time period is inaccurate.