Examples described herein generally relate to identifying a set of service events corresponding to an incident report, querying a multiple-layer relational graph to determine one or more other service events related to the set of service events, detecting a pattern in the set of service events and a subset of the one or more other service events, and indicating, via a user interface and based on the incident report, the subset of the one or more other service events as related to the incident report.