1. A computer-executable method for multi-domain clustering, comprising: receiving, by a computing device, from one or more computing devices over a network, domain data for at least two domains associated with users, wherein a domain is a source type describing observable activities of a plurality of users, and wherein a respective user is associated with a respective user role in an organization; determining a hyperparameter value for a respective prior distribution of a probability distributing associated with a domain; estimating a probability distribution for generating a multi-domain probability model; generating a multi-domain probability model that includes variables for two or more domains, based on the hyperparameter value and the estimated probability distribution; analyzing the domain data with the generated multi-domain probability model to assign a first user to a plurality of cluster indices associated with the first user's corresponding user role; and determining that an activity being performed by a second user is anomalous, based on a comparison between one or more of the second user's cluster indices to one or more of the first user's plurality of cluster indices.