Abstract: Infrastructure attacks based on graph edge context are identified by receiving an execution graph constructed by a central service based on behaviors monitored by a plurality of agents deployed on respective systems including a first system. The execution graph comprises a plurality of execution trails. One or more tags are applied to each edge of an execution trail of the execution graph based on at least one of temporal context or spatial context associated with the edge. One or more behaviors associated with the edge of the execution trail happen across an enterprise infrastructure involving the first system. The execution trail enriched with the one or more tags is analyzed. An action that is performed to mitigate security risks in the execution graph is determined based on the analysis.