1. A method comprising: in a network security system: establishing a baseline network model for an enterprise network, the baseline network model comprising an expected nominal operational profile for the enterprise network; evolving the baseline network model over time to capture changes in the expected nominal operational profile of the enterprise network; receiving, with data ingestion circuitry, packet data, network connection data, or both from the enterprise network; executing a natural language processor on the packet data, network connection data, or both identify, in comparison with the baseline network model, a network anomaly within the enterprise network; generating a machine interface comprising an alert on the network anomaly; and communicating the machine interface to an operator system for review.