1. A method comprising: receiving, by a system having a processor, a plurality of events; identifying, by the system, plural occurrences of a pattern of event types in the received events; analyzing, by the system, information of configuration items related to the events associated with the pattern of event types; and creating, by the system, a correlation rule defining a relationship between the event types in response to the analyzing determining a relationship between the corresponding configuration items.