1. A method for insider threat detection in a network, comprising: monitoring the network to collect network traffic associated with a set of network protocols; generating information-use events based on the collected network traffic; generating contextual information associated with the network; processing the information-use events in view of the generated contextual information to generate alerts for a user of the network when network activity of said user substantially matches one or more types of targeted behaviors; processing the generated alerts to determine a threat score for said user.