A processing pipeline for supporting machine-learning processes for network monitoring and information management as well as specific analytics for particular use cases. The processing pipeline 500 takes in system data (502) and pre-processes (504) the system data. The system data (502) may include any of the types of data described above including text log files, and categorical data from various sources. The illustrated processing pipeline 500 includes two branches; a data fitting branch (506) where a model is developed for the data and a data transformation branch (508) where the developed model is leveraged to transform live data. For certain event detection use cases, the output of the data transformation branch (508) includes a score (510) (e.g., a threat level score) and an attribution (512).