Abstract: A method is provided for diagnosing probable root causes of anomalies in computing environments. The method is performed by an anomaly analytics server in networked communication with hosts. The method includes (a) receiving a topology map; (b) receiving event data associated with each host; (c) receiving an anomaly baseline defining thresholds for identifying an anomalous status in each host application; (d) analyzing the event data and the anomaly baseline to determine a host anomaly status for each host; (e) analyzing the host anomaly status and the topology map to determine a tier anomaly status for each of the host tiers; (f) identifying at least one host tier as a root cause host tier by processing the tier anomaly statuses and the set of tier dependencies; and (g) generating an alert identifying each root cause host tier as a probable root cause of an anomaly.