1. A method of monitoring for anomalies in a computing environment comprising, with a processor: building an anomaly detection system based on topology guided statistical analysis; and creating a number of correlation rules based on a number of detected anomalies and information provided by a security alerts database.