A server computer system comprising at least one hardware processor configured to: assign events of a training corpus to a plurality of event categories, the training corpus comprising a collection of events having occurred on a plurality of client systems; in response to assigning events to event categories, assign client systems of the plurality of client systems to a plurality of client clusters according to the plurality of event categories; and in response to assigning client systems to client clusters, transmit a client cluster membership indicator to an anomaly detector configured to determine whether a target event occurring on a target client system is indicative of a computer security threat; wherein assigning events to event categories comprises: selecting a plurality of events from the training corpus, the plurality of events having occurred on a client system of the plurality of client systems, arranging the plurality of events according to a time of occurrence to form an event sequence, and in response, assigning a selected event of the event sequence to a selected event category according to a first event preceding the selected event and further according to a second event following the selected event within the event sequence; wherein assigning client systems to client clusters comprises assigning the client system to a selected client cluster according to an event profile determined according to a count of events occurring on the client system and belonging to the selected event category; and wherein the anomaly detector is configured to determine whether the target event is indicative of the computer security threat according to a behavior model trained on a client-cluster-specific sub-corpus of events, the client-cluster-specific sub-corpus selected from the training corpus to include only events that have occurred on a plurality of members of a target cluster of the plurality of client clusters. assign events of a training corpus to a plurality of event categories, the training corpus comprising a collection of events having occurred on a plurality of client systems; in response to assigning events to event categories, assign client systems of the plurality of client systems to a plurality of client clusters according to the plurality of event categories; and in response to assigning client systems to client clusters, transmit a client cluster membership indicator to an anomaly detector configured to determine whether a target event occurring on a target client system is indicative of a computer security threat; wherein assigning events to event categories comprises: selecting a plurality of events from the training corpus, the plurality of events having occurred on a client system of the plurality of client systems, arranging the plurality of events according to a time of occurrence to form an event sequence, and in response, assigning a selected event of the event sequence to a selected event category according to a first event preceding the selected event and further according to a second event following the selected event within the event sequence; wherein assigning client systems to client clusters comprises assigning the client system to a selected client cluster according to an event profile determined according to a count of events occurring on the client system and belonging to the selected event category; and wherein the anomaly detector is configured to determine whether the target event is indicative of the computer security threat according to a behavior model trained on a client-cluster-specific sub-corpus of events, the client-cluster-specific sub-corpus selected from the training corpus to include only events that have occurred on a plurality of members of a target cluster of the plurality of client clusters.