13. The computer-implemented method of claim 11 , comprising: obtaining the scenario rules and the data from one or more data system coupled via one or more network connections; and applying the scenario rules to the actions by comparing each indication of an action to each scenario rule to determine whether an entity committed a scenario violation, wherein the scenario rules define activity to detect the targeted behavior.
11. A computer-implemented, comprising: obtaining scenario rules and data representing actions performed by entities; applying the scenario rules to a subset of the data to detect scenario violations based on the actions performed by the entities, the subset of the data associated with the entities of a particular entity type; grouping scenario violations into scenario clusters, each scenario cluster comprising one or more scenario violations associated with similar behavior performed by the entities indicated by similarity metrics, and each of the scenario clusters is one of a set of scenario clusters; determining predictive ability values for each of the scenario clusters, the predictive ability values to indicate relative significance between each of the scenario clusters to predict a target behavior; ranking the scenario clusters based on the predictive ability values and removing scenario clusters from the set of scenario clusters having predictive ability values below a predictive threshold; generating combinations of scenario clusters from the set of scenario clusters, each of the combinations of scenario clusters including two or more scenario clusters; determining an effectiveness factor for each of the combinations of scenario clusters, each of the effectiveness factors based on a number of entities committing the targeted behavior as a percentage of all the entities that committed at least one scenario violation for a particular combination of scenario clusters of the combinations of scenario clusters; generating scores for each of the entities of the particular entity type using the combinations of scenario clusters having the effectiveness factor at or above an effectiveness threshold; and providing results to a system to enable presentation on a display device, the results indicating one or more of the entities that committed the targeted behavior based on the scores for each of the entities.