A method comprising: in a network security system: establishing a baseline network model for an enterprise network, the baseline network model comprising an expected nominal operational profile for the enterprise network; evolving the baseline network model over time to capture changes in the expected nominal operational profile of the enterprise network; receiving, with data ingestion circuitry, real-time network data from the enterprise network; converting a format of the real-time network data to common event format, CEF; executing a natural language processor on the real-time network data to identify, in comparison with the baseline network model, a network anomaly within the enterprise network by using principal component analysis to reduce the dimensionality of the CEF formatted network data, wherein, before using principal component analysis to reduce the dimensionality, each dimension corresponds to a field mapping to a name in the CEF formatted network data; generating a machine interface comprising an alert on the network anomaly; and communicating the machine interface to an operator system for review. in a network security system: establishing a baseline network model for an enterprise network, the baseline network model comprising an expected nominal operational profile for the enterprise network; evolving the baseline network model over time to capture changes in the expected nominal operational profile of the enterprise network; receiving, with data ingestion circuitry, real-time network data from the enterprise network; converting a format of the real-time network data to common event format, CEF; executing a natural language processor on the real-time network data to identify, in comparison with the baseline network model, a network anomaly within the enterprise network by using principal component analysis to reduce the dimensionality of the CEF formatted network data, wherein, before using principal component analysis to reduce the dimensionality, each establishing a baseline network model for an enterprise network, the baseline network model comprising an expected nominal operational profile for the enterprise network; evolving the baseline network model over time to capture changes in the expected nominal operational profile of the enterprise network; receiving, with data ingestion circuitry, real-time network data from the enterprise network; converting a format of the real-time network data to common event format, CEF; executing a natural language processor on the real-time network data to identify, in comparison with the baseline network model, a network anomaly within the enterprise network by using principal component analysis to reduce the dimensionality of the CEF formatted network data, wherein, before using principal component analysis to reduce the dimensionality, each dimension corresponds to a field mapping to a name in the CEF formatted network data; generating a machine interface comprising an alert on the network anomaly; and communicating the machine interface to an operator system for review. generating a machine interface comprising an alert on the network anomaly; and communicating the machine interface to an operator system for review.