In an approach for generating differentiated workload telemetry data, a processor corresponds one or more services with a workload related telemetry generating an event emitter. A processor performs a correlation analysis of corresponding relationship and connection among connected resources and current traffic into and out of the one or more services. A processor labels domain context for each telemetry event. A processor communicates each telemetry event to a global event handler. A processor performs a cross-correlation in real-time of telemetry data with the global event handler. A processor updates a real-time differentiated workload report.