1. A method comprising: receiving event data associated with network activities, wherein the event data comprises machine data; identifying at least one anomaly automatically determined from machine learning on the event data; identifying at least one threat automatically determined from machine learning on the event data and the identified at least one anomaly, wherein a threat is associated with each identified anomaly that, individually or in combination, triggered the determination of the threat; and upon selection by a user, via a graphical user interface, of an identified threat, generating a kill chain view associated with the threat, wherein the kill chain view includes a plurality of stages, and, for each stage, the kill chain view lists each type of identified anomaly associated with each stage of the kill chain and the number of anomalies of each type.