Monitoring system analytics

A method comprising:

• receiving, at a server, a selection of a particular time period;
• identifying, by the server, security events detected by a monitoring system during the selected time period;
• classifying, by the server, a subset of the identified security events as abnormal events;
• generating, by the server, a density of the identified security events over the selected time period;
• generating, by the server, a density of the subset of the identified security events classified as abnormal events;
• identifying, by the server, monitoring system data associated with the selected time period;
• generating, by the server, a graphical representation of the density of the identified security events, the density of the subset of the identified security events classified as abnormal events, and the identified monitoring system data;
• and
• providing, by the server, the graphical representation for display.

At least one computer-readable storage medium encoded with executable instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

• receiving a selection of a particular time period;
• identifying security events detected by a monitoring system during the selected time period;
• classifying a subset of the identified security events as abnormal events;
• generating a density of the identified security events over the selected time period;
• generating a density of the subset of the identified security events classified as abnormal events;
• identifying monitoring system data associated with the selected time period;
• generating a graphical representation of the density of the identified security events, the density of the subset of the identified security events classified as abnormal events, and the identified monitoring system data;
• and
• providing the graphical representation for display.