Aspects of the disclosure relate to monitoring an automatic teller machine (ATM) network and determining anomalous fault behavior in the ATM network. A computing device may determine historical fault volumes in the ATM network and generate a time-series model of the fault volumes. The computing platform may predict future fault volumes based on the generated time-series model. Based on the predicted future fault volumes and actual future fault volumes, the computing platform may determine anomalous fault behavior. The time-series model may be based on exogenous factors associated with ATM network operations.