A method may include segregating an event stream that includes events associated with a cloud-based application hosted on a first remote resource and a second remote resource. The events may include metrics indicative of a state of the first remote resource and/or the second remote resource. The event stream may be segregated into a first child stream including events associated with the first remote resource and a second child stream including events associated with the second remote resource. The first child stream and/or the second child stream may be analyzed to identify a pattern indicative of a fault at the first remote resource and/or the second remote resource. An alert may be sent to in order to notify a client of the fault at the first remote resource and/or the second remote resource. Related systems and articles of manufacture are also provided.