Anomaly detection to identify security threats

A computer system comprising:

• processor;
• and a
• a storage device having instructions stored thereon, which when executed by the processor cause the computer system to:
• process events associated with an information technology environment using a machine-learning anomaly detection model to generate first anomaly data indicative of a first anomaly detected in the events;
• process the events using an anomaly detection rule to generate second anomaly data indicative of a second anomaly detected in the events, the anomaly detection rule having been defined by a user;
• input the first anomaly data and the second anomaly data into a machine-learning threat indicator model;
• and
• process the first anomaly data concurrently with the second anomaly data using the machine-learning threat indicator model to identify a threat indicator associated with a potential security threat to the information technology environment.

A non-transitory computer readable medium containing instructions, execution of which in a computer system causes the computer system to:

• process events associated with an information technology environment using a machine-learning anomaly detection model to generate first anomaly data indicative of a first anomaly detected in the events;
• process the events using an anomaly detection rule to generate second anomaly data indicative of a second anomaly detected in the events, the anomaly detection rule having been defined by a user;
• input the first anomaly data and the second anomaly data into a machine-learning threat indicator model;
• and
• process the first anomaly data concurrently with the second anomaly data using the machine-learning threat indicator model to identify a threat indicator associated with a potential security threat to the information technology environment.