According to some embodiments, a system and method are provided to receive a first plurality of data from a machine associated with a first time period. A normal operation of the machine is automatically determined based on the first plurality of data. A second plurality of data may be received from the machine associated with a second time period. An anomaly in the second plurality of data is determined.