A network security system comprising: a communications server including a network interface to receive event information from a plurality of network devices (116-166, 210), wherein the event information comprises variables describing events associated with actions occurring at the network devices (116-166, 210); a database server including at least one storage device to store the event information; a network analytics server including at least one hardware processor to: determine groups of similar network devices (116-166, 210) based on the captured event information, characterized in that determining the groups includes: determining buckets for each of the variables; bucketing the events, wherein the bucketing includes placing the events in at least one of the buckets based on a subset of the variables; determining a similarity of each network device to all other of the network devices (116-166, 210) based on the bucketing; and generating the groups of similar network devices (116-166, 210) based on the similarity of each network device to all other of the network devices (116-166, 210); and detecting anomalous network device behavior associated with at least one of the network devices (116-166, 210) in a group of the groups of similar network devices (116-166, 210) based on baseline network device behavior determined for the group. a communications server including a network interface to receive event information from a plurality of network devices (116-166, 210), wherein the event information comprises variables describing events associated with actions occurring at the network devices (116-166, 210); a database server including at least one storage device to store the event information; a network analytics server including at least one hardware processor to: determine groups of similar network devices (116-166, 210) based on the captured event information, characterized in that determining the groups includes: determining buckets for each of the variables; bucketing the events, wherein the bucketing includes placing the events in at least one of the buckets based on a subset of the variables; determining a similarity of each network device to all other of the network devices (116-166, 210) based on the bucketing; and generating the groups of similar network devices (116-166, 210) based on the similarity of each network device to all other of the network devices (116-166, 210); and detecting anomalous network device behavior associated with at least one of the network devices (116-166, 210) in a group of the groups of similar network devices (116-166, 210) based on baseline network device behavior determined for the group. determine groups of similar network devices (116-166, 210) based on the captured event information, characterized in that determining the groups includes: determining buckets for each of the variables; bucketing the events, wherein the bucketing includes placing the events in at least one of the buckets based on a subset of the variables; determining a similarity of each network device to all other of the network devices (116-166, 210) based on the bucketing; and generating the groups of similar network devices (116-166, 210) based on the similarity of each network device to all other of the network devices (116-166, 210); and determining buckets for each of the variables; bucketing the events, wherein the bucketing includes placing the events in at least one of the buckets based on a subset of the variables; determining a similarity of each network device to all other of the network devices (116-166, 210) based on the bucketing; and generating the groups of similar network devices (116-166, 210) based on the similarity of each network device to all other of the network devices (116-166, 210); and detecting anomalous network device behavior associated with at least one of the network devices (116-166, 210) in a group of the groups of similar network devices (116-166, 210) based on baseline network device behavior determined for the group.