1. A method for computer system forensics, comprising: receiving an identification of an anomalous message transmitted by a host computer in a computer network comprising multiple host computers; monitoring messages transmitted by the host computers so as to detect, for each monitored message, a respective process that initiated the message; and responsively to the identification, extracting a forensic indicator of the respective process that initiated the anomalous message.