A non-transitory computer-readable medium comprising computer-executable instructions that, when executed, cause a processor to perform operations including receiving a first dataset from a first automation component, the first dataset corresponds to raw data acquired by a first sensor; receiving a second dataset from a second automation component, the second dataset corresponds to raw data acquired by a second sensor; receiving data indicating an expected operation related to operations of an industrial automation system including the first and second automation components; determining a signature based on the first and second datasets and the data indicating the expected operation, wherein the signature indicates an unexpected operation as compared to the expected operation; performing a root cause analysis using the signature to determine a relationship indicating a first set of changes of the first dataset corresponding to a second set of changes in the data indicating the expected operation.