An event anomaly analysis and prediction apparatus comprising: a processor; and a memory storing machine readable instructions that when executed by the processor cause the processor to: access at least one master directed graph that specifies known events and transitions between the known events, the events being trace log events within computer-generated log files; rank each of the known events, wherein the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and the probability of anomalousness assigned to a known event of the known events is determined relative to the other known events; cluster, by applying k-means clustering, each of the ranked known events into a plurality of anomaly categories that include at least two of a very-high, a high, a medium, a low, and a very-low probability of being an anomaly; determine, based on the plurality of anomaly categories, a plurality of rules to analyze new events, wherein each rule is composed of the event, event source, the anomaly category and the probability of anomalousness of the event, wherein rules for a very high anomaly category further include an associated action comprising deny or quarantine the source, initiate a lock-down mode or placing in a secure mode; access data that is to be analyzed for an anomaly; determine, based on an application of the plurality of rules to the data, whether the data includes the anomaly; and in response to a determination that the data includes the anomaly, control a device associated with the data according to the associated action included in the applicable rule. a processor; and a memory storing machine readable instructions that when executed by the processor cause the processor to: access at least one master directed graph that specifies known events and transitions between the known events, the events being trace log events within computer-generated log files; rank each of the known events, wherein the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and the probability of anomalousness assigned to a known event of the known events is determined relative to the other known events; access at least one master directed graph that specifies known events and transitions between the known events, the events being trace log events within computer-generated log files; rank each of the known events, wherein the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and the probability of anomalousness assigned to a known event of the known events is determined relative to the other known events; the ranking of each of the known events is based on a probability of anomalousness assigned to each of the known events, and the probability of anomalousness assigned to a known event of the known events is determined relative to the other known events; cluster, by applying k-means clustering, each of the ranked known events into a plurality of anomaly categories that include at least two of a very-high, a high, a medium, a low, and a very-low probability of being an anomaly; determine, based on the plurality of anomaly categories, a plurality of rules to analyze new events, wherein each rule is composed of the event, event source, the anomaly category and the probability of anomalousness of the event, wherein rules for a very high anomaly category further include an associated action comprising deny or quarantine the source, initiate a lock-down mode or placing in a secure mode; access data that is to be analyzed for an anomaly; determine, based on an application of the plurality of rules to the data, whether the data includes the anomaly; and in response to a determination that the data includes the anomaly, control a device associated with the data according to the associated action included in the applicable rule. determine, based on the plurality of anomaly categories, a plurality of rules to analyze new events, wherein each rule is composed of the event, event source, the anomaly category and the probability of anomalousness of the event, wherein rules for a very high anomaly category further include an associated action comprising deny or quarantine the source, initiate a lock-down mode or placing in a secure mode; wherein each rule is composed of the event, event source, the anomaly category and the probability of anomalousness of the event, wherein rules for a very high anomaly category further include an associated action comprising deny or quarantine the source, initiate a lock-down mode or placing in a secure mode; access data that is to be analyzed for an anomaly; determine, based on an application of the plurality of rules to the data, whether the data includes the anomaly; and in response to a determination that the data includes the anomaly, control a device associated with the data according to the associated action included in the applicable rule.