1. A method comprising: receiving event data associated with network activities, wherein the event data comprises machine data; evaluating event data based on a machine learning model utilizing historical data pertaining to evaluations of past events; identifying at least one anomaly automatically determined from machine learning on the event data; identifying at least one threat automatically determined from machine learning on the event data and the identified at least one anomaly, wherein a threat is associated with each identified anomaly that, individually or in combination, triggered the determination of the threat; and upon selection by a user, via a graphical user interface, of an identified threat, generating a kill chain view associated with the threat, wherein the kill chain view includes a plurality of stages, and, for each stage, the kill chain view lists each type of identified anomaly associated with each stage of the kill chain and the number of anomalies of each type, wherein the listing of comprises a link for each anomaly type; upon selection by the user, via a graphical user interface, of the link for a selected anomaly type, generating a listing of all anomalies of the selected type, including a link for each anomaly; upon selection by the user of the link for a selected anomaly, generating a prompt to tag the anomaly for subsequent tracking; and upon receiving input from the user regarding the identified threat based upon the anomalies in the generated kill chain view, providing feedback for training the machine learning model.
1. A method comprising: receiving event data associated with network activities, wherein the event data comprises machine data; evaluating event data based on a machine learning model utilizing historical data pertaining to evaluations of past events; identifying at least one anomaly automatically determined from machine learning on the event data; identifying at least one threat automatically determined from machine learning on the event data and the identified at least one anomaly, wherein a threat is associated with each identified anomaly that, individually or in combination, triggered the determination of the threat; and upon selection by a user, via a graphical user interface, of an identified threat, generating a kill chain view associated with the threat, wherein the kill chain view includes a plurality of stages, and, for each stage, the kill chain view lists each type of identified anomaly associated with each stage of the kill chain and the number of anomalies of each type, wherein the listing of comprises a link for each anomaly type; upon selection by the user, via a graphical user interface, of the link for a selected anomaly type, generating a listing of all anomalies of the selected type, including a link for each anomaly; upon selection by the user of the link for a selected anomaly, generating a prompt to tag the anomaly for subsequent tracking; and upon receiving input from the user regarding the identified threat based upon the anomalies in the generated kill chain view, providing feedback for training the machine learning model. 9. The method of claim 1 , wherein the listing of the at least one anomaly type in the kill chain view comprises a link for each anomaly type, the method further comprising: upon selection by the user, via a graphical user interface, of the link for a selected anomaly type, generating a listing of all anomalies of the selected type, including a link to the one or more entities associated with the anomaly and date of the anomaly; and upon selection by the user of the link for a selected entity, generating a view providing additional information about the selected entity.