A multivariate clustering-based anomaly detector can generate an event for consumption by an APM manager that indicates detection of an anomaly based on multivariate clustering analysis after topology-based feature selection. The anomaly detector accumulates time-series data across a series of time instants to form a multivariate time-series data slice or multivariate data slice. The anomaly detector then performs multivariate clustering analysis with the multivariate data slice. The anomaly detector determines whether a multivariate data slice is within a cluster of multivariate data slices. If the multivariate data slice is within the cluster and the cluster is a known anomaly cluster, then the anomaly detector generates an anomaly detection event indicating detection of the known anomaly. The anomaly detector can also determine that a multivariate data slice is within an unknown cluster and generate an event indicating detection of an unknown anomaly.