Abstract: A computer based method and system for detecting behaviors from patterns of data where sets of thresholds and ranges used within detection scenarios can be created and applied while the system is in active operation. Data is received from at least one source, and an application environment is determined. A scenario including one or more parameterized patterns indicative of one or more behaviors is retrieved. One or more sets of parameters applicable to the one or more parameterized patterns are also retrieved. A parameter set is selected based on the application environment, and a dataset including a portion of the received data, one or more events, and one or more entities is formed. Detection processing is then performed by detecting one or more matches between the dataset and the parameterized patterns using the selected parameter set.