Embodiments of a cyber threat defense system protects a system from cyber threats with the following operations: Identifying unusual patterns of behavior within the plotted individual alerts and/or events in the multiple dimension space; Clustering the individual alerts and events that form the unusual pattern into a distinct item for cyber threat analysis of that cluster of distinct alerts and/or events; Applying machine learning models to infer for the cyber threat analysis what is possibly happening with the distinct item of the cluster, which came from the unusual pattern, and then assign a threat risk associated with that distinct item of the cluster; and Projecting on a user interface, based on the analysis by the one or more machine learning models, the assigned threat risk associated with that distinct item of the cluster of alerts and/or events forming the unusual pattern.