A computing device, comprising: a processor; and a memory device including instructions embodied thereon, wherein the instructions, which when executed by the processor, cause the processor to perform operations to detect anomalies from computing system events, the operations comprising: obtaining a source event stream of data, the source event stream of data produced from operation of a computing system; converting the source event stream of data into a frequency signal, the source event stream indicating a count of events obtained from the operation of the computing system per time interval; identifying an estimated seasonality from the frequency signal; scaling the estimated seasonality to a target event stream of data, the target event stream of data produced from the operation of the computing system identifying one or more anomalies of a principal vector of the target event stream of data, based on deviation of the target event stream of data from the estimated seasonality; scaling the estimated seasonality to a subset of the target event stream of data, the subset of the target event stream of data indicating one or more minor vectors; identifying one or more anomalies of the one or more minor vectors, based on deviation of the subset of the target event stream of data from the estimated seasonality; and causing the computing system to perform an action based on the one or more identified anomalies determined from the target event stream of data, wherein the action performed in the computing system is further based upon the one or more identified anomalies of the one or more minor vectors, and wherein a primary event is tied to the principal vector and secondary events are tied to the one or more minor vectors. a processor; and a memory device including instructions embodied thereon, wherein the instructions, which when executed by the processor, cause the processor to perform operations to detect anomalies from computing system events, the operations comprising: obtaining a source event stream of data, the source event stream of data produced from operation of a computing system; converting the source event stream of data into a frequency signal, the source event stream indicating a count of events obtained from the operation of the computing system per time interval; identifying an estimated seasonality from the frequency signal; scaling the estimated seasonality to a target event stream of data, the target event stream of data produced from the operation of the computing system identifying one or more anomalies of a principal vector of the target event stream of data, based on deviation of the target event stream of data from the estimated seasonality; scaling the estimated seasonality to a subset of the target event stream of data, the subset of the target event stream of data indicating one or more minor vectors; identifying one or more anomalies of the one or more minor vectors, based on deviation of the subset of the target event stream of data from the estimated seasonality; and causing the computing system to perform an action based on the one or more identified anomalies determined from the target event stream of data, wherein the action performed in the computing system is further based upon the one or more identified anomalies of the one or more minor vectors, and wherein a primary event is tied to the principal vector and secondary events are tied to the one or more minor vectors. obtaining a source event stream of data, the source event stream of data produced from operation of a computing system; converting the source event stream of data into a frequency signal, the source event stream indicating a count of events obtained from the operation of the computing system per time interval; identifying an estimated seasonality from the frequency signal; scaling the estimated seasonality to a target event stream of data, the target event stream of data produced from the operation of the computing system identifying one or more anomalies of a principal vector of the target event stream of data, based on deviation of the target event stream of data from the estimated seasonality; scaling the estimated seasonality to a subset of the target event stream of data, the subset of the target event stream of data indicating one or more minor vectors; identifying one or more anomalies of the one or more minor vectors, based on deviation of the subset of the target event stream of data from the estimated seasonality; and causing the computing system to perform an action based on the one or more identified anomalies determined from the target event stream of data, wherein the action performed in the computing system is further based upon the one or more identified anomalies of the one or more minor vectors, and wherein a primary event is tied to the principal vector and secondary events are tied to the one or more minor vectors.