A computer-implemented method , the method comprising: accessing an instance of an activity in a computing environment, wherein the instance of the activity comprises an attribute set; receiving the instance of the activity at a malicious activity model that comprises a plurality of multi-attribute cluster-identifiers associated with previous instances of the activity, the multi-attribute cluster-identifiers comprising corresponding risk scores and attribute sets, the risk scores and the attribute sets indicate a likelihood that the instance of the activity is a malicious activity; determining , using the malicious activity model, that the instance of the activity is a malicious activity based on comparing the attribute set of the instance of the activity to the plurality of multi-attribute cluster-identifiers, wherein the attribute set of the instance of the activity matches an attribute set of at least one of the plurality of multi-attribute cluster-identifiers, a risk score and the attribute set of the at least one of the plurality of multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity; and generating a visualization of malicious activity operations data comprising the instance of the activity, wherein the visualization identifies the instance of the activity as a malicious activity, wherein the malicious activity model is a machine learning model that is generated based on processing a plurality of email messages associated with a plurality cyberattacks, wherein the processing the plurality of emails messages is based on clustering the plurality of emails based on action taken by recipients of the plurality of emails, attachments in the email, and corresponding fingerprints of the plurality of emails; and wherein the malicious activity model is configurable for processing the plurality of email messages at a tenant level, a global level, or a combined tenant-global level. accessing an instance of an activity in a computing environment, wherein the instance of the activity comprises an attribute set; receiving the instance of the activity at a malicious activity model that comprises a plurality of multi-attribute cluster-identifiers associated with previous instances of the activity, the multi-attribute cluster-identifiers comprising corresponding risk scores and attribute sets, the risk scores and the attribute sets indicate a likelihood that the instance of the activity is a malicious activity; determining , using the malicious activity model, that the instance of the activity is a malicious activity based on comparing the attribute set of the instance of the activity to the plurality of multi-attribute cluster-identifiers, wherein the attribute set of the instance of the activity matches an attribute set of at least one of the plurality of multi-attribute cluster-identifiers, a risk score and the attribute set of the at least one of the plurality of multi-attribute cluster-identifier indicate a likelihood that the instance of the activity is a malicious activity; and generating a visualization of malicious activity operations data comprising the instance of the activity, wherein the visualization identifies the instance of the activity as a malicious activity, wherein the malicious activity model is a machine learning model that is generated based on processing a plurality of email messages associated with a plurality cyberattacks, wherein the processing the plurality of emails messages is based on clustering the plurality of emails based on action taken by recipients of the plurality of emails, attachments in the email, and corresponding fingerprints of the plurality of emails; and wherein the malicious activity model is configurable for processing the plurality of email messages at a tenant level, a global level, or a combined tenant-global level. <EOS>