1. A method comprising: receiving a sequence of event feature sets corresponding to a sequence of events, wherein the event feature sets are derived from raw event machine data recorded in a computer network; measuring an anomaly count within a target event window by processing the sequence of event feature sets through an event sequence prediction model to increase the anomaly count when the event sequence prediction model identifies an event feature set within the target event window as corresponding to an anomalous event, wherein the event sequence prediction model is a machine learning model; identifying the target event window as containing a suspicious series of events by determining whether the anomaly count is beyond a baseline; and generating a computer security threat indicator or a computer security anomaly indicator based on the identification of the suspicious series of events.