Abstract: Systems, methods, and software are disclosed herein relating to processing telemetry data of a storage environment for anomaly detection in various implementations. In an implementation, a computing apparatus detects a sequence of missing data in telemetry data associated with a user of a data storage environment and verifies the user was active during a time period of the sequence of missing data. Upon verification, the computing apparatus generates synthetic data to replace the sequence of missing data; the synthetic data is based on activity data of users similar to the given user. The computing apparatus generates augmented data with the telemetry data and the synthetic data and incorporates the augmented data into a historical user activity profile. The computing apparatus detects anomalous behavior in the storage environment based on a comparison of new telemetry data with the historical user activity profile and takes corrective action associated with the anomalous behavior.