1. A method comprising: receiving log data corresponding to a plurality of processes performed by devices in a network; identifying codified parameters in the log data; filtering the log data based upon a codified parameter of the codified parameters in the log data to identify a portion of the log data, wherein the codified parameter represents a user identity, wherein filtering the log data based upon the codified parameter comprises: receiving filter data associated with the codified parameter, the filter data identifying a configuration of the codified parameter, wherein the configuration of the codified parameter represents user identities assigned to a group; identifying the portion of the log data, such that the portion of the log data comprises pieces of the log data with the codified parameter in the configuration identified by the filter data; identifying, by a processor system, a cluster of processes from the portion of the log data that have been activated a predetermined number of times in a sequence of activation; and determining a list comprising application data identifying a candidate application, the candidate application determined to have instructed performance of the cluster of processes.