A computer-implemented method comprising: receiving, by a computing device, logon session data associated with logon sessions that include activities performed by authorized accounts on machines of a computer network, the logon session data indicating security events that occurred during the logon sessions; accessing, by the computing device from a storage system, counts of various variables taking on particular values, wherein the counts are computed from historical security event data that was generated in response to the activities performed by authorized accounts on machines of the computer network, the counts defining different detection models associated with different types of logon session behavior; employing, by the computing device, the different detection models to score the logon sessions based on the counts and the logon session data, wherein: each different detection model outputs one or more scores for each logon session that assess whether one or more security events that occurred during the logon session are indicative of compromised behavior, and scores for each logon session that are output by different detection models provide independent assessments of whether the one or more security events that occurred during the logon session are indicative of compromised behavior based on different types of logon session behavior; combining, by the computing device, the scores for each logon session that are output by the different detection models to generate a ranking score for each logon session; and generating, by the computing device, a list of ranked alerts based on the ranking score for each logon session, wherein the list of ranked alerts identifies one or more of compromised authorized accounts and compromised machines of the computer network. receiving, by a computing device, logon session data associated with logon sessions that include activities performed by authorized accounts on machines of a computer network, the logon session data indicating security events that occurred during the logon sessions; accessing, by the computing device from a storage system, counts of various variables taking on particular values, wherein the counts are computed from historical security event data that was generated in response to the activities performed by authorized accounts on machines of the computer network, the counts defining different detection models associated with different types of logon session behavior; employing, by the computing device, the different detection models to score the logon sessions based on the counts and the logon session data, wherein: each different detection model outputs one or more scores for each logon session that assess whether one or more security events that occurred during the logon session are indicative of compromised behavior, and scores for each logon session that are output by different detection models provide independent assessments of whether the one or more security events that occurred during the logon session are indicative of compromised behavior based on different types of logon session behavior; each different detection model outputs one or more scores for each logon session that assess whether one or more security events that occurred during the logon session are indicative of compromised behavior, and scores for each logon session that are output by different detection models provide independent assessments of whether the one or more security events that occurred during the logon session are indicative of compromised behavior based on different types of logon session behavior; combining, by the computing device, the scores for each logon session that are output by the different detection models to generate a ranking score for each logon session; and generating, by the computing device, a list of ranked alerts based on the ranking score for each logon session, wherein the list of ranked alerts identifies one or more of compromised authorized accounts and compromised machines of the computer network.