A computer system comprising at least one hardware processor configured to: in response to receiving a cluster membership indicator indicating a grouping of a plurality of client systems into a plurality of client clusters, select a client cluster from the plurality of client clusters, the selected client cluster comprising multiple client systems; in response to selecting the client cluster, select a training corpus of events from an event collection according to whether the selected events have occurred on members of the selected client cluster; in response to selecting the training corpus of events, train a behavior model to encode a collective behavior of members of the selected client cluster according to the training corpus of events, the behavior model having a set of adjustable parameters; and in response to training the behavior model, transmit a set of values of the adjustable parameters to an anomaly detector configured to determine whether a target event occurring on a target client system is indicative of a computer security threat; wherein: the behavior model is configured to input a selected event of an event sequence and in response, to determine a prediction indicator indicative of a likelihood that another event of the event sequence is of a selected event type; the event sequence comprises a plurality of events of the training corpus, corpus, the plurality of events ordered according to a time of occurrence of each event of the plurality of events; and training the behavior model comprises adjusting the set of configurable parameters according to the prediction indicator. in response to receiving a cluster membership indicator indicating a grouping of a plurality of client systems into a plurality of client clusters, select a client cluster from the plurality of client clusters, the selected client cluster comprising multiple client systems; in response to selecting the client cluster, select a training corpus of events from an event collection according to whether the selected events have occurred on members of the selected client cluster; in response to selecting the training corpus of events, train a behavior model to encode a collective behavior of members of the selected client cluster according to the training corpus of events, the behavior model having a set of adjustable parameters; and in response to training the behavior model, transmit a set of values of the adjustable parameters to an anomaly detector configured to determine whether a target event occurring on a target client system is indicative of a computer security threat; wherein: the behavior model is configured to input a selected event of an event sequence and in response, to determine a prediction indicator indicative of a likelihood that another event of the event sequence is of a selected event type; the event sequence comprises a plurality of events of the training corpus, corpus, the plurality of events ordered according to a time of occurrence of each event of the plurality of events; and training the behavior model comprises adjusting the set of configurable parameters according to the prediction indicator. the behavior model is configured to input a selected event of an event sequence and in response, to determine a prediction indicator indicative of a likelihood that another event of the event sequence is of a selected event type; the event sequence comprises a plurality of events of the training corpus, corpus, the plurality of events ordered according to a time of occurrence of each event of the plurality of events; and training the behavior model comprises adjusting the set of configurable parameters according to the prediction indicator.