Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an attack where the vector(s) are unknown, but there is an awareness of the exploit's occurrence: Verifying that I have fully removed a WordPress hack?
If you have zero trace of what happened then you can only make assumptions as to what happened.
Standard practice is to identify all platforms and versions, then to look at vulnerability databases to see if there are known weaknesses in your environment.
Then look at all information flows and transforms - identifying entrance points.
The above are common initial steps in identifying vulnerabilities, but I don't understand what your question means regarding isolating relationships etc.
Hope this helps.