1. A method implemented at a datacenter, comprising: receiving a first data related to as first one or more occurrences of an administrative event associated with a first one or more virtual machines associated with a first one or more users, wherein the first one or more occurrences of the administrative event are detected by a first hypervisor; receiving a second data related to a second one or more occurrences of the administrative event associated with a second one or more virtual machines associated with a second one or more users, wherein the second one or more occurrences of the administrative event are detected by a second hypervisor; storing the first data and the second data in a database; determining, based at least on the first data and the second data, that a number of occurrences oldie administrative event exceeds a probability threshold; and generating, based on the determination that the number or frequency of the occurrences of the administrative event exceeds the probability threshold, an alert indicating a possible attack on the datacenter.