1. A method of detecting anomalous behavior of a network fabric, comprising: determining a baseline vector corresponding to nominal behavior of a fabric, the baseline vector comprising at least two correlated behavior metrics; disaggregating anomaly detection criteria into a plurality of anomaly criterion to be distributed among nodes of the fabric, the anomaly detection criteria characterizing a variation from the baseline vector; aggregating anomaly criterion statuses calculated by at least some of the nodes to detect anomalous behavior; and notifying a manager of the fabric anomalous behavior.