1. A method of monitoring for anomalies in a computing environment comprising: by a processor, building an anomaly detection system based on topology guided statistical analysis, comprising: by the processor executing a monitoring application, determining transaction and performance data of a number of configuration items in a topology of a web application executed within the computing environment correlated with data associated with the topology of the web application; and by the processor, identifying a number of metrics for each of the configuration items; and by the processor, storing, in a performance management database (PMDB), the transaction and performance data of the configuration items, correlated data associated with the topology of the web application, and the metrics of the configuration items; by the processor, determining if a first metric of the number of metrics deviates from a metric baseline; by the processor, responsive to a determination that the first metric deviates from the metric baseline, flagging the first metric as a potential malicious anomaly; by the processor, creating a number of correlation rules to detect a number of intrusions, the correlation rules based on the transaction and performance data of the configuration items, correlated data associated with the topology of the web application, the metrics of the configuration items, the flagged anomaly, and information provided by a security alerts database, the security alert database comprising stored data regarding security alerts reported from a security management software product; by the processor, applying the correlation rules to detect the intrusions in the computing environment; by the processor, determining if a suspicious session is reported within the security alerts stored in the security alert database; by the processor, responsive to a determination that the suspicious session is reported within the security alerts stored in the security alert database, classifying the flagged anomaly as a first intrusion in the computing environment and classifying the suspicious session as the first intrusion; and by the processor, responsive to a determination that the suspicious session is not reported within the security alerts stored in the security alert database, classifying the flagged anomaly as an intrusion in the computing environment detected through statistical analysis.