One or more embodiments may include techniques to identify anomalies based on computer-generated results. Moreover, embodiments may include applying scenario rules to data to detect scenario violations and grouping the scenario violations into scenario clusters based on similar behavior performed by entities indicated by similarity metrics. embodiments include determining predictive ability values for each of the scenario clusters, ranking the scenario clusters based on the predictive ability values, and removing scenario clusters having predictive ability values below a threshold. In embodiments combinations of scenario clusters may be generated from the set of scenario clusters and the combinations of scenario clusters may be evaluated for effectiveness. Embodiments include generating scores for entities of the combinations of scenario clusters deemed effective, and provide results indicating whether one or more of the entities committed an anomaly based on the scores for each of the entities.