A method for detecting an anomaly sequence in a plurality of data streams, comprising unstructured and/or hybrid data, originating from a system or network of systems, the method comprising: collecting such data streams from the system or systems; dividing the collected data streams into a plurality of time intervals; for each of the plurality of time intervals, determining a value for a parameter associated with each data stream, wherein the parameter comprises a severity value relating to a sum of severities of events occurring in the time interval; for each of the plurality of time intervals, determining a respective expected value for the parameter; for each of the plurality of time intervals, calculating a deviation in the determined value for the parameter associated with the data stream from the expected value for the parameter; if a function of the calculated deviations representing a sequence of events is above a threshold, detecting an anomaly sequence in the collected data streams; and further comprising, when an anomaly sequence is detected: comparing the detected anomaly sequence with at least one anomaly pattern stored in a database of anomalies, wherein the database of anomalies comprises, for each anomaly pattern, a stored pattern of parameter values for a plurality of data streams during a plurality of time intervals, and the method comprises, for said detected anomaly sequence, comparing a pattern of parameter values for said plurality of data streams with the stored pattern of parameter values for said plurality of data streams during the plurality of time intervals, classifying the detected anomaly sequence by applying to the detected anomaly sequence a classification of a similar one of the stored pattern of parameter values; and assigning an action to the detected anomaly sequence, said action being pre-associated with the applied classification. collecting such data streams from the system or systems; dividing the collected data streams into a plurality of time intervals; for each of the plurality of time intervals, determining a value for a parameter associated with each data stream, wherein the parameter comprises a severity value relating to a sum of severities of events occurring in the time interval; for each of the plurality of time intervals, determining a respective expected value for the parameter; for each of the plurality of time intervals, calculating a deviation in the determined value for the parameter associated with the data stream from the expected value for the parameter; if a function of the calculated deviations representing a sequence of events is above a threshold, detecting an anomaly sequence in the collected data streams; and further comprising, when an anomaly sequence is detected: comparing the detected anomaly sequence with at least one anomaly pattern stored in a database of anomalies, wherein the database of anomalies comprises, for each anomaly pattern, a stored pattern of parameter values for a plurality of data streams during a plurality of time intervals, and the method comprises, for said detected anomaly sequence, comparing a pattern of parameter values for said plurality of data streams with the stored pattern of parameter values for said plurality of data streams during the plurality of time intervals, classifying the detected anomaly sequence by applying to the detected anomaly sequence a classification of a similar one of the stored pattern of parameter values; and assigning an action to the detected anomaly sequence, said action being pre-associated with the applied classification. comparing the detected anomaly sequence with at least one anomaly pattern stored in a database of anomalies, wherein the database of anomalies comprises, for each anomaly pattern, a stored pattern of parameter values for a plurality of data streams during a plurality of time intervals, and the method comprises, for said detected anomaly sequence, comparing a pattern of parameter values for said plurality of data streams with the stored pattern of parameter values for said plurality of data streams during the plurality of time intervals, classifying the detected anomaly sequence by applying to the detected anomaly sequence a classification of a similar one of the stored pattern of parameter values; and assigning an action to the detected anomaly sequence, said action being pre-associated with the applied classification.