A computer-implemented method for detecting trigger points to identify root cause failure and fault events is provided. The method includes collecting, by a monitoring agent, entity metrics data and system key performance indicator (KPI) data, integrating the entity metrics data and the KPI data, constructing an initial system state space, detecting system state changes by calculating a distance between current batch data and an initial state, and dividing a system status into different states.