Modeling Distributed Systems

A modeling system including a data processing device in communication with a non-transitory memory storing a model modeling interactions of resources of a distributed system. The data processing device executes instructions that cause the data processing device to implement a system monitor that monitors interactions of the resources of the distributed system and builds the model. The system monitor detects a state change of a first resource of the distributed system and identifies an entity causing the state change of the first resource. The system monitor determines whether a second resource of the distributed system changes state within a threshold period of time after the first resource changed state. The system monitor updates the model to indicate a relationship between the first resource, the second resource and the identified entity, in response to the first resource and the second resource changing state within the threshold time period.