1. A system, comprising: interface hardware to receive current behavior data representing events occurring within a process; and at least one processor to: generate a graphical user interface (GUI) to display a reference statistical model of the process, along with a first graph representing current behavior of the process, wherein the reference statistical model is to be displayed as a hierarchical, segmented time series event stream graph; accept requests to display further detail in a hierarchy respecting discrepancies between the reference statistical model and the current behavior, each element in the hierarchy having a distinct corresponding reference statistical model; and display, in response to a request to display further detail in the hierarchy including identification of an element in a different level of the hierarchy, a second graph including the current behavior of the process corresponding to the element and a second reference statistical model corresponding to the element, the GUI enabling a time machine module to recall and re-create a state of the process at a past time, to include prior metrics and prior contextual event attributes, wherein the prior contextual event attributes include at least one of a source address activity values or destination address activity values, the values stored in a non-transitory memory.