1. A method comprising: obtaining and storing asset domain data, the asset domain data comprising information related to one or more of an operational states of an asset deployed in a network system and the configuration of parameters related to the asset; receiving sensed network operational information associated with operation of the network system that includes the asset; identifying from the sensed network operational information an indication of a cyber-security threat to the network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system; automatically identifying a malfunction or reconfiguration event associated with the asset based upon an analysis of the asset domain data; automatically determining, by at least one processor, that the operational anomaly is a false positive with respect to the cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event; clearing the indication based on the determining that the anomaly is a false positive; and causing a record to be stored in a database, the record comprising: the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.