1. A method comprising: monitoring, with a rules engine, a network service at one or more network devices in a network to detect a device-level event; in response to detecting a first device-level event, inserting a first data set of dependencies associated with the first device-level event into a working memory, wherein the first data set of dependencies inserted in the working memory comprises a first subset of a plurality of dependencies for the network service, and wherein the first data set of dependencies defines links between the first device-level event and actions triggered by the first device-level event; applying, with the rules engine, a set of network service rules to the first data set of dependencies inserted in the working memory to determine a first service-level impact of the detected first device-level event; in response to detecting a second device-level event, inserting a second data set of dependencies associated with the second device-level event into the working memory, wherein the second data set of dependencies inserted in the working memory comprises a second subset of the plurality of dependencies for the network service; and applying, with the rules engine, the set of network service rules to the second data set of dependencies inserted in the working memory to determine a second service-level impact of the second device-level event.