Abstract: A computing system receives unlabeled datasets based on logon event data. Various features are extracted based on the unlabeled datasets. A probability score based on the various features is generated by unsupervised machine-learning models that have been trained using the unlabeled datasets. The probability score indicates whether the logon event data is anomalous. The probability score is used to label the unlabeled datasets to thereby generate labeled datasets. The various features are extracted based on the labeled datasets. A contribution score based on the various features is generated by supervised machine-learning models that have been trained using a subset of the labeled datasets. The contribution score specifies which of the various features are likely to have caused the logon event data to be labeled as anomalous. Output data is generated specifying features that likely caused the logon event data to be labeled as anomalous.