1. A method comprising: identifying an operational anomaly in a network system, the network system comprising a plurality of assets, the operational anomaly signaling a potential cyber-security threat and involving an operation pattern that is inconsistent with a normal operation pattern observed in the network system; in response to identifying the operational anomaly, accessing asset domain data of an asset from the plurality of assets, the asset domain data including information related to a state change of the asset; determining, using one or more processors, that the anomaly is correlated with the state change of the asset; and determining that the anomaly is a false positive with respect to the potential cyber-security threat based on the anomaly being correlated with the state change.