Embodiments described herein are directed to multiple hypothesis systems and methods for tracking observations that are domain agnostic and involves determining the probability that a given set of observations (i.e., a track) corresponds to a particular target, object or linked set of events. One embodiment described herein relates to cyber security tracking methods and systems.