First event data is obtained from a first computer system and second event data is obtained from a second computer system. A first shape of the first event data is identified, and a second shape of the second event data is identified. A shape similarity between the first shape and the second shape is calculated. The shape similarity is determined to be above a similarity threshold. Training features are generated from the first event data and the second event data based on the determining. The training features are input into an anomaly-detection model.