1. A method comprising: identifying an indication of a cyber-security threat to a network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system; identifying a malfunction or reconfiguration event associated with an asset; determining, by at least one processor, that the operational anomaly is a false positive with respect to the potential cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event; clearing the indication based on the determining that the anomaly is a false positive; and causing a record to be stored in a database, the record comprising: the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.