A computing system comprising: one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive an indication of a security alert (140, 214) and a context for the security alert, the context including one or more entities related to the context and a timestamp for the security alert; search one or more data sources (150, 224, 225, 226) for the one or more entities during a time window around the timestamp to determine which of the one or more data sources are associated with the one or more entities; execute one or more anomaly detection models to identify anomalies that are related to the security alert based on the context, wherein the one or more anomaly detection models perform anomaly detection on the one or more data sources determined to be associated with the one or more entities; and output identified anomalies for investigation of the security alert; wherein the anomaly detection model comprises: calculating, for each value in groupings of data for the one or more entities, an earliest occurrence and summarizing counts of new values per time bin; determining a baseline window excluding the last day; and splitting the baseline window to two parts, an earlier part being dropped to reduce noise, and a later part being used to evaluate mean and variance of a number of new entities expected per day. one or more processors; and one or more computer-readable media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to: receive an indication of a security alert (140, 214) and a context for the security alert, the context including one or more entities related to the context and a timestamp for the security alert; search one or more data sources (150, 224, 225, 226) for the one or more entities during a time window around the timestamp to determine which of the one or more data sources are associated with the one or more entities; execute one or more anomaly detection models to identify anomalies that are related to the security alert based on the context, wherein the one or more anomaly detection models perform anomaly detection on the one or more data sources determined to be associated with the one or more entities; and output identified anomalies for investigation of the security alert; wherein the anomaly detection model comprises: calculating, for each value in groupings of data for the one or more entities, an earliest occurrence and summarizing counts of new values per time bin; determining a baseline window excluding the last day; and splitting the baseline window to two parts, an earlier part being dropped to reduce noise, and a later part being used to evaluate mean and variance of a number of new entities expected per day. receive an indication of a security alert (140, 214) and a context for the security alert, the context including one or more entities related to the context and a timestamp for the security alert; search one or more data sources (150, 224, 225, 226) for the one or more entities during a time window around the timestamp to determine which of the one or more data sources are associated with the one or more entities; execute one or more anomaly detection models to identify anomalies that are related to the security alert based on the context, wherein the one or more anomaly detection models perform anomaly detection on the one or more data sources determined to be associated with the one or more entities; and output identified anomalies for investigation of the security alert; wherein the anomaly detection model comprises: calculating, for each value in groupings of data for the one or more entities, an earliest occurrence and summarizing counts of new values per time bin; determining a baseline window excluding the last day; and splitting the baseline window to two parts, an earlier part being dropped to reduce noise, and a later part being used to evaluate mean and variance of a number of new entities expected per day. calculating, for each value in groupings of data for the one or more entities, an earliest occurrence and summarizing counts of new values per time bin; determining a baseline window excluding the last day; and splitting the baseline window to two parts, an earlier part being dropped to reduce noise, and a later part being used to evaluate mean and variance of a number of new entities expected per day.