1. A device, comprising: a memory that includes a set of instructions; and a processor that executed the instructions to cause the processor to perform operations comprising, receiving a first data stream from a first data source including a first event-series related to the network, detecting a potential anomaly in the first event-series, receiving, only if a potential anomaly is detected in the first event-series, a second data stream from a second data source including an independent second event-series related to the network, and determining whether the potential anomaly is a true anomaly or a false anomaly.