8. A threat detection system comprising: a non-transitory data storage that stores security events associated with network devices, and an actor category model including a plurality of levels arranged in a hierarchy and each level is associated with a subcategory for a category of the actor category model, wherein the actor category model comprises an attribute for users, and the actor category model comprises parent-child relationships between the plurality of levels, and child levels inherit rules from their parent levels; and at least one physical processor that correlates security events with the actor category model, wherein to correlate the security events the at least one processor: identifies a user for each security event; determines the actor category model is applicable to the user for each security event and any of the security events associated with the user by matching the attribute for users in the actor category model with a user attribute of the user in a user data model; identifies a level in the actor category model associated with the user for each security event; and determines whether a security threat exists based on the correlating, wherein to determine whether the security threat exists, the at least one processor: determines a security rule for the identified level; and applies the security rule to determine whether the security threat exists.
13. The threat detection system of claim 8 , wherein the physical processor provides notification responsive to a determination being made that the network security threat exists.