1. A method comprising: creating, by a processor, a context graph with a plurality of nodes connected by a plurality of edges based, at least in part, on a topology which indicates physical connections between components in a network, wherein the plurality of nodes corresponds to the components and the plurality of edges corresponds to the physical connections; receiving a first event indication generated by an agent monitoring a first component in the network; analyzing, by the processor, the first event indication based, at least in part, on a first event analysis rule; determining that the first event indication indicates a relationship between the first component and a second component; based on a determination that the first component and the second component are not indicated in the context graph, adding a first node for the first component and a second node for the second component to the plurality of nodes in the context graph; based on a determination that the first event indication indicates a relationship between the first and the second components and based on a first action indicated in the first event analysis rule, identifying, by the processor, a relationship indication threshold in the first event analysis rule which specifies a minimum number of event indications that indicate a relationship to be satisfied before indicating a component relationship; and based on a determination that the first event indication satisfies the relationship indication threshold, adding a first edge to the plurality of edges in the context graph to indicate the relationship between the first component and the second component; and utilizing the context graph to identify relationships among components for root cause analysis of operational anomalies in the network.