7. The apparatus of claim 1 , the processing circuitry to determine one or more combinations of scenario clusters having overlapping scenario clusters, and to discard combinations of scenario clusters that are entirely overlapped by two or more other scenario clusters or entirely overlapped by another combination of scenario cluster.
1. An apparatus, comprising: processing circuitry; and memory to store instructions that, when executed by the processing circuitry, cause the processing circuitry to: obtain scenario rules and data representing actions performed by entities; apply the scenario rules to a subset of the data to detect scenario violations based on the actions performed by the entities, the subset of the data associated with the entities of a particular entity type; group scenario violations into scenario clusters, each scenario cluster comprising one or more scenario violations associated with similar behavior performed by the entities indicated by similarity metrics, and each of the scenario clusters is one of a set of scenario clusters; determine predictive ability values for each of the scenario clusters, the predictive ability values to indicate relative significance between each of the scenario clusters to predict a target behavior; rank the scenario clusters based on the predictive ability values and remove scenario clusters from the set of scenario clusters having predictive ability values below a predictive threshold; generate combinations of scenario clusters from the set of scenario clusters, each of the combinations of scenario clusters including two or more scenario clusters; determine an effectiveness factor for each of the combinations of scenario clusters, each of the effectiveness factors based on a number of entities committing the targeted behavior as a percentage of all the entities that committed at least one scenario violation for a particular combination of scenario clusters of the combinations of scenario clusters; generate scores for each of the entities of the particular entity type using the combinations of scenario clusters having the effectiveness factor at or above an effectiveness threshold; and provide results to a system to enable presentation on a display device, the results indicating one or more of the entities that committed the targeted behavior based on the scores for each of the entities.