1. A method comprising: receiving, at a computer system, first event data indicative of computer network activity of an entity that is part of or has interacted with a computer network, the computer system including a real-time event processing engine and a batch event processing engine; constructing a variable behavior baseline of the entity by using one of the real-time event processing engine or the batch event processing engine in the computer system, based on the first event data, the variable behavior baseline being representative of computer network activity of a particular type by the entity; sharing the variable behavior baseline between the real-time event processing engine and the batch event processing engine; receiving, at the computer system, second event data indicative of additional computer network activity associated with the entity; comparing the second event data to the shared variable behavior baseline of the entity, by the one of the real-time event processing engine and the batch event processing engine that was not used to construct the variable behavior baseline of the entity; and detecting at least one of a network security threat or a network security anomaly, when said comparing results in a determination that the second event data has a specified relationship to the shared variable behavior baseline of the entity.