A computing system configured to generate an alert related to a cyber attack against a resource, the computing system comprising: a computer readable storage medium having program instructions embodied therewith; and one or more processors configured to execute the program instructions to cause the one or more processors to: receive contextual information about a resource, the contextual information comprising information about what users are permitted to access the resource, information about ordinary hardware control request patterns, information about typical usage patterns of the resource by authorized user, or an access policy, physical location, or location of the resource in the network topology of the resource; receive a first plurality of indicators associated with an activity that is performed on a computer network; match, based at least in part on the contextual information, the first plurality of indicators against rules that correspond to different types of activity that are indicative of a cyber attack against the resource to form a set of events reflecting such activity; determine, based at least in part on the set of events and the contextual information, a risk score for each event, wherein the risk score indicates a probability that the resource is at risk from the event of a cyber attack; compare the risk score for an event to a threshold value, wherein the threshold value is based at least in part on a random value; and if the risk score for an event exceeds the threshold, generate an alert. a computer readable storage medium having program instructions embodied therewith; and one or more processors configured to execute the program instructions to cause the one or more processors to: receive contextual information about a resource, the contextual information comprising information about what users are permitted to access the resource, information about ordinary hardware control request patterns, information about typical usage patterns of the resource by authorized user, or an access policy, physical location, or location of the resource in the network topology of the resource; receive a first plurality of indicators associated with an activity that is performed on a computer network; match, based at least in part on the contextual information, the first plurality of indicators against rules that correspond to different types of activity that are indicative of a cyber attack against the resource to form a set of events reflecting such activity; determine, based at least in part on the set of events and the contextual information, a risk score for each event, wherein the risk score indicates a probability that the resource is at risk from the event of a cyber attack; compare the risk score for an event to a threshold value, wherein the threshold value is based at least in part on a random value; and if the risk score for an event exceeds the threshold, generate an alert. receive contextual information about a resource, the contextual information comprising information about what users are permitted to access the resource, information about ordinary hardware control request patterns, information about typical usage patterns of the resource by authorized user, or an access policy, physical location, or location of the resource in the network topology of the resource; receive a first plurality of indicators associated with an activity that is performed on a computer network; match, based at least in part on the contextual information, the first plurality of indicators against rules that correspond to different types of activity that are indicative of a cyber attack against the resource to form a set of events reflecting such activity; determine, based at least in part on the set of events and the contextual information, a risk score for each event, wherein the risk score indicates a probability that the resource is at risk from the event of a cyber attack; compare the risk score for an event to a threshold value, wherein the threshold value is based at least in part on a random value; and if the risk score for an event exceeds the threshold, generate an alert.