In an embodiment, a data processing method comprises storing one or more generic machine operating definitions, wherein each of the generic machine operating definitions describes expected operational behavior of one or more types of machines during one or more operating states; analyzing operating data that describes past operation of a plurality of machines of a plurality of types; based at least in part on the operating data and the one or more generic machine operating definitions, generating and storing one or more machine operating models that describe expected operational behavior corresponding to a plurality of operating states of the plurality of machines; wherein the one or more machine operating models comprise a plurality of data patterns, wherein each of the data patterns is associated with a different set of one or more operating states of one or more machines; wherein the method is performed by one or more computing devices.