Methods, computer-readable media, and apparatuses may be configured to detect anomalous activity. Electronic information utilized to detect anomalous activity may be consolidated from multiple data feeds. This electronic information may relate to: extrusion violations, failed logins, sensitive fields access, sensitive objects access, escalation of privileges, or activity during a specific time frame within a time period, and combinations of one or more of these. A de-duplication module may be configured to detect duplicate information or activity events, wherein the duplicate data may be removed and/or consolidated.