1. A method of correlating software updates and indications of anomalies occurring on devices at least some of which have the software updates, the method comprising: accessing update installation information indicating which devices have which updates; accessing a telemetry data source, the telemetry data source comprising indications of occurrences of same events on the devices, the indications of occurrences having been received from the devices via a data network, each indication of an occurrence indicating which event occurred and on which corresponding device and when; identifying anomalies in the telemetry data source; determining which of the anomalies are correlated with which of the updates; and for each anomaly, storing indications of any updates determined to be correlated with the anomaly.