A mechanisms for analyzing event based behavior of end-points of a network in an industrial system and a method performed by a control node, the method includes collecting, from the end-points, timestamped event log entries as created by the end-points within a time window. Each respective timestamped event log entry pertains to a respective event performed by one of the end-points. The method includes identifying tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed.