1. A method for detecting conditions in a network, comprising: finding, by computer, anomalies by analyzing connection patterns, wherein anomalies are differences in connection patterns between hosts relative to some comparison period; and collecting anomalies into operationally relevant events, wherein an operationally relevant event is a collection of anomalies related to a singular cause, wherein collecting anomalies into events comprises traversing a connection table to identify and correlate anomalies by determining connection patterns that correlate with a particular event class.