1. A method comprising: identifying, by a computing device, a plurality of email templates, each email template corresponding to characteristics of a received machine-generated email, the characteristics of the received machine-generated email relating to static data of the machine-generated email; and generating, by the computing device, a template causality graph by analyzing the plurality of email templates to determine a statistical causality between templates of the plurality of email templates, the determining of the statistical causality between templates comprising determining that a first received machine-generated email associated with a first template is a result of a second received machine-generated email associated with a second template.