A system comprising: a plurality of access point, AP, devices in a wireless network; and a network management system comprising: a memory storing network event data received from the AP devices, wherein the network event data is indicative of operational behavior of the wireless network, and wherein the network event data defines a series of network events of one or more event types over a plurality of observation time periods; and one or more processors coupled to the memory and configured to: apply an unsupervised machine learning model to the network event data to dynamically determine, for a most recent one of the observation time periods: (i) predicted counts of occurrences of the network events for each of the event types, and (ii) an estimated minimum, MIN, threshold and an estimated maximum, MAX, threshold for each event type, wherein the MIN thresholds and MAX thresholds define ranges of expected occurrences for the network events of the corresponding event types; and identify, based on the estimated minimum thresholds and estimated maximum thresholds and actual network event data for the most recent one of the observation time periods, one or more of the network events as indicative of abnormal network behavior. a plurality of access point, AP, devices in a wireless network; and a network management system comprising: a memory storing network event data received from the AP devices, wherein the network event data is indicative of operational behavior of the wireless network, and wherein the network event data defines a series of network events of one or more event types over a plurality of observation time periods; and one or more processors coupled to the memory and configured to: apply an unsupervised machine learning model to the network event data to dynamically determine, for a most recent one of the observation time periods: (i) predicted counts of occurrences of the network events for each of the event types, and (ii) an estimated minimum, MIN, threshold and an estimated maximum, MAX, threshold for each event type, wherein the MIN thresholds and MAX thresholds define ranges of expected occurrences for the network events of the corresponding event types; and identify, based on the estimated minimum thresholds and estimated maximum thresholds and actual network event data for the most recent one of the observation time periods, one or more of the network events as indicative of abnormal network behavior. a memory storing network event data received from the AP devices, wherein the network event data is indicative of operational behavior of the wireless network, and wherein the network event data defines a series of network events of one or more event types over a plurality of observation time periods; and one or more processors coupled to the memory and configured to: apply an unsupervised machine learning model to the network event data to dynamically determine, for a most recent one of the observation time periods: (i) predicted counts of occurrences of the network events for each of the event types, and (ii) an estimated minimum, MIN, threshold and an estimated maximum, MAX, threshold for each event type, wherein the MIN thresholds and MAX thresholds define ranges of expected occurrences for the network events of the corresponding event types; and identify, based on the estimated minimum thresholds and estimated maximum thresholds and actual network event data for the most recent one of the observation time periods, one or more of the network events as indicative of abnormal network behavior. apply an unsupervised machine learning model to the network event data to dynamically determine, for a most recent one of the observation time periods: (i) predicted counts of occurrences of the network events for each of the event types, and (ii) an estimated minimum, MIN, threshold and an estimated maximum, MAX, threshold for each event type, wherein the MIN thresholds and MAX thresholds define ranges of expected occurrences for the network events of the corresponding event types; and identify, based on the estimated minimum thresholds and estimated maximum thresholds and actual network event data for the most recent one of the observation time periods, one or more of the network events as indicative of abnormal network behavior.