A method performed by a monitoring tool in a computer system, the method including: for a set of network nodes in a computer system: applying a correlation formula on an input based on performance data of the set, and determining a correlation score based on applying the correlation formula, the correlation score indicating a correlation between network nodes in the set; determining, based on the correlation scores, a first list including a first plurality of network nodes having a correlation score that satisfies a first threshold; identifying a second plurality of network nodes included in the first list, the second plurality of network nodes having a correlation score that satisfies a second threshold, which indicates a correlation that is higher than the first threshold; analyzing the performance data of the second plurality against a constancy metric; and removing, based on the analyzing, the second plurality from the first list.