Automated weighting is performed that includes transforming a behavior of each respective dimension of multiple dimensions of a selected group of events to a respective weight, the respective weight determined based on a distribution of values of the respective dimension, and where the weight determined for a first of the plurality of dimensions is greater than the weight determined for a second of the plurality of dimensions. Similarity values are computed indicating similarities between further events and the selected group of events, the similarity values based on a combination of the weights and distances between the further events and the selected group of events. Cohorts of the further events are generated by performing multi-level ranking that comprises ranking groups of the further events based on the similarity values, and applying merging to the groups to produce merged groups. The cohorts are visualized in a graphical visualization.