A computer-implemented method for performing anomaly detection by a server computer, the method comprising: receiving event data that indicates for individual computing events, of a plurality of computing events, individual values corresponding to a plurality of variables including one or more of a computer operation corresponding to the respective individual computing event and an IP address from where the respective individual computing event was generated; receiving rule data defining rules for triggering at least one predefined action, wherein individual rules indicate individual occurrence thresholds associated with predefined values for user-selected subsets of the plurality of variables; generating an aggregation table that includes at least: individual variable columns corresponding to individual variables of the plurality of variables, individual rule rows corresponding to the individual rules, and a count column for indicating rule satisfaction counts in association with the individual rules; analyzing the rule data to determine individual null subsets, of the plurality of variables, that correspond to the individual rules, each individual null subset identifying the variables that are not specified in the corresponding individual rule; aggregating the event data into the aggregation table by setting individual rule satisfaction counts for the individual rule rows based on the individual values, for individual computing events, matching the predefined values for the user-selected subsets of the plurality of variables, wherein the individual rule rows omit rule-inapplicable values associated with the individual null subsets that uniquely correspond to the individual rule rows; and causing performance of the at least one predefined action responsive to at least one particular rule satisfaction count, that corresponds to a particular rule, satisfying a particular occurrence threshold, wherein the at least one predefined action includes generating a notification to inform a user that an anomaly has been detected 1. 1 Basis: Paragraph, last 4 lines;, lines 1-9; paragraph, last 3 lines receiving event data that indicates for individual computing events, of a plurality of computing events, individual values corresponding to a plurality of variables including one or more of a computer operation corresponding to the respective individual computing event and an IP address from where the respective individual computing event was generated; receiving rule data defining rules for triggering at least one predefined action, wherein individual rules indicate individual occurrence thresholds associated with predefined values for user-selected subsets of the plurality of variables; generating an aggregation table that includes at least: individual variable columns corresponding to individual variables of the plurality of variables, individual rule rows corresponding to the individual rules, and a count column for indicating rule satisfaction counts in association with the individual rules; individual variable columns corresponding to individual variables of the plurality of variables, individual rule rows corresponding to the individual rules, and a count column for indicating rule satisfaction counts in association with the individual rules; analyzing the rule data to determine individual null subsets, of the plurality of variables, that correspond to the individual rules, each individual null subset identifying the variables that are not specified in the corresponding individual rule; aggregating the event data into the aggregation table by setting individual rule satisfaction counts for the individual rule rows based on the individual values, for individual computing events, matching the predefined values for the user-selected subsets of the plurality of variables, wherein the individual rule rows omit rule-inapplicable values associated with the individual null subsets that uniquely correspond to the individual rule rows; and causing performance of the at least one predefined action responsive to at least one particular rule satisfaction count, that corresponds to a particular rule, satisfying a particular occurrence threshold, wherein the at least one predefined action includes generating a notification to inform a user that an anomaly has been detected 1. 1 Basis: Paragraph, last 4 lines;, lines 1-9; paragraph, last 3 lines