1. A method for detecting an anomaly event in a computer network comprising a plurality of clients, comprising: determining, by a computer, a plurality of series performance metrics, each one of the series performance metrics representing a time series of performance measurements of connections made to one of the plurality of clients; spatially aggregating, by the computer, the series performance metrics according to a spatial hierarchy to create a plurality of spatial clusters; in each spatial cluster of the plurality of spatial clusters, temporally aggregating, by the computer, series performance metrics to form a time series of temporal bins; for each temporal bin of the time series of temporal bins, determining, by the computer, an actual temporal bin metric representative of time series performance metrics in the temporal bin; and for each temporal bin of the time series of temporal bins: determining, by the computer, a forecast temporal bin metric from actual temporal bin metrics determined for temporal bins preceding the temporal bin; and comparing, by the computer, an actual temporal bin metric of the temporal bin with the forecast temporal bin metric to detect the anomaly event.