1. A computer-implemented method, comprising: receiving data from an external data source, wherein the data comprises real-time machine data that reflects activity within an information technology infrastructure of an organization; generating a three-dimensional model that includes a first plurality of three-dimensional objects, wherein each three-dimensional object included in the first plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and each of the multiple attributes of the first three-dimensional object is mapped to one or more different aspects of the real-time machine data; generating a first clustering object within the three-dimensional model, wherein the first clustering object encompasses the first plurality of three-dimensional objects; determining a first state associated with a first three-dimensional object included in the first plurality of three-dimensional objects, wherein the first state comprises a variable alert state having one of at least three alert states, and wherein the first state is determined based on at least one aspect of the real-time machine data mapped to the first three-dimensional object and any corresponding aspects inherited from one or more lower level hierarchical components associated with the at least one first three-dimensional object; determining a second state associated with a second three-dimensional object included in the plurality of three-dimensional objects, wherein the second state comprises a variable alert state having one of at least three alert states, and wherein the second state determination is based on at least one aspect of real-time machine data mapped to the second three dimensional object and at least one corresponding aspect inherited from one or more lower level hierarchical components associated with the at least one second three-dimensional object, wherein the first and second three-dimensional object are different three-dimensional objects within the plurality of three-dimensional objects; determining an alert level associated with the first clustering object based on a comparison between the alert state associated with the first state and the alert state associated with the second state, wherein the alert level comprises one of at least three alert states, and wherein the first clustering object inherits the alert state from each of the first three-dimensional object and the second three-dimensional object; selecting a cluster state associated with the first clustering object based on the determined alert level, wherein the cluster state causes a visual aspect of the first clustering object to change as the cluster state changes, wherein the visual aspect is different for each of the at least three alert states; and displaying a first portion of the three-dimensional model that includes the first clustering object and a graphical representation of the cluster state.