1. A method comprising: identifying, by a system comprising a processor, an un-expected or an abnormal behavior in a first application and an un-expected or an abnormal behavior in a second application; creating, by the system, a first event associated with the identified un-expected or abnormal behavior in the first application; creating, by the system, a second event associated with the identified un-expected or abnormal behavior in the second application; accessing, by the system, a first description, a second description, and a third description of a plurality of dependencies between a plurality of applications, wherein the first description is created at a design or a development stage of the first application and the second application, the second description is created during a testing stage of the first application, and the third description is created from run-time configuration files that are associated with the first application and the second application; determining, by the system, whether there is a dependency between the first application and the second application based on a dependencies identified in at least two of the accessed first description, second description, and third description of the plurality of dependencies; in response to a determination that there is a dependency between the first application and the second application, grouping, by the system, the first event and the second event; and outputting, by the system, the first event and the second event together as a group according to the grouping.