Technologies are disclosed herein for enhancing machine learning (“ML”)-based anomaly detection systems using knowledge graphs. The disclosed technologies generate a connected graph that defines a topology of infrastructure components along with associated alarms generated by a ML component. The ML component generates the alarms by applying ML techniques to real-time data metrics generated by the infrastructure components. Scores are computed for the infrastructure components based upon the connected graph. A root cause of an anomaly affecting infrastructure components can then be identified based upon the scores, and remedial action can be taken to address the root cause of the anomaly. A user interface is also provided for visualizing aspects of the connected graph.