1. A method comprising: receiving, by a computer system, first event data indicative of computer network activity of a plurality of users and network devices in a computer network; generating, by the computer system, classification metadata for each of the network devices and users, based on the first event data, to indicate relevance in a network security context of each of the users and network devices; identifying, by the computer system, usage relationships between one or more of the users and one or more of the network devices, based on first event data; assigning, by the computer system, usage similarity scores to the network devices based on the identified usage relationships, the usage similarity scores being indicative of which of the network devices have been used by the same or similar group of users; receiving, by the computer system, second event data indicative of computer network activity of a particular user of the plurality of users; and detecting, by the computer system and in response to the second event data, an anomaly indicative that the particular user has interacted with a particular network device with which the particular user does not normally interact, based on the usage similarity scores and the classification metadata.
1. A method comprising: receiving, by a computer system, first event data indicative of computer network activity of a plurality of users and network devices in a computer network; generating, by the computer system, classification metadata for each of the network devices and users, based on the first event data, to indicate relevance in a network security context of each of the users and network devices; identifying, by the computer system, usage relationships between one or more of the users and one or more of the network devices, based on first event data; assigning, by the computer system, usage similarity scores to the network devices based on the identified usage relationships, the usage similarity scores being indicative of which of the network devices have been used by the same or similar group of users; receiving, by the computer system, second event data indicative of computer network activity of a particular user of the plurality of users; and detecting, by the computer system and in response to the second event data, an anomaly indicative that the particular user has interacted with a particular network device with which the particular user does not normally interact, based on the usage similarity scores and the classification metadata. 28. The method of claim 1 , wherein said generating classification metadata or said assigning usage similarity scores are performed in batch mode based on the first event data being retrieved from a persistent storage facility.