1. A method of correlating software updates and indications of anomalies occurring on devices at least some of which have the software updates, the method comprising: accessing update installation information indicating which of the software updates were applied to which of the device and update times thereof; accessing a telemetry data source, the telemetry data source comprising indications of occurrences of same events on the devices, the indications of occurrences having been received from the devices via a data network, each indication of an occurrence indicating which event occurred and on which corresponding device and a time of occurrence thereof; identifying anomalies in the telemetry data source by computing counts of the events therein based on the times of occurrence of the events; identifying a set of updates by determining which of the anomalies are correlated with which of the updates according to the times of occurrence and according to the update times; accessing source code change data that indicates which source code changes are associated with which of the updates; finding correlations between the source code changes and the anomalies by, based on the identified set of updates and the source code change data, identifying source code changes associated with the identified set of updates, wherein the finding the correlations between the source code changes and the anomalies comprises applying a heuristic that computes correlation scores or probabilities for pairings of updates and anomalies; and for each anomaly, storing indications of any source code changes determined to be correlated with the anomaly.