1. A method comprising: identifying an operational anomaly in a network system by accessing an anomaly flag that indicates a potential cyber-security threat based on detection of the operational anomaly by a cyber-security analytics engine, the network system comprising a plurality of assets, the operational anomaly involving an operation pattern that is inconsistent with a normal operation pattern observed in the network system; in response to identifying the operational anomaly, accessing asset domain data of an asset from the plurality of assets, the asset domain data including state information related to the asset and a specific configuration of asset parameters associated with the state information; identifying, using the asset domain data, a state change of the asset resulting from a reconfiguration event involving the asset; determining, using one or more processors, that the operational anomaly is correlated with the state change resulting from the reconfiguration event involving the asset; determining that the operational anomaly is a false positive with respect to the potential cyber-security threat based on the operational anomaly being correlated with the state change of the asset resulting from the reconfiguration event involving the asset; causing the anomaly flag to be cleared in response to determining that the anomaly is a false positive based on determining the operational anomaly is correlated with the state change of the asset; and storing a record comprising the operational anomaly, the state change, and an indication of the operational anomaly being a false positive.