Abstract: A report generated from analysis of a software sample is obtained and parsed. A root node of a causality tree is determined based on source-target relationships and a primary malware instance indicated in the report. Actions, behaviors, and additional malware instances are identified based on the report. Additional relationships among the data which are not explicitly represented are extracted from further parsing and processing of the report by tracing the relationships in the report data starting from the data of the entity represented by the root node, with child nodes added for processes and files discovered from the tracing. For each entity for which a node is added to the causality tree, counts of the related behaviors and actions are determined and associated with the node along with the corresponding details. A GUI depiction of the resulting causality tree is generated and displayed for visualizing and navigating the causality tree.