A method for monitoring a facility including a plurality of computer systems is disclosed. The method includes receiving an event stream from the plurality of computer systems, assigning a numerical value to each of the plural events to produce a real-time operation numerical event stream, and comparing the real-time operation numerical event stream to a previously collected normal operation numerical event stream. The event stream includes plural events provided during real-time operation.