Abstract: A first instance of an event management system monitors event data corresponding to a first group of users in a cloud computing system. Using a first machine learning (ML) algorithm, the first instance detects an anomalous event from the event data. The first ML algorithm is trained using historical event data. A second instance of the event management system is created and a copy of the first ML algorithm is added to the second instance. The second instance monitors second event data corresponding to a second group of users in the cloud computing system. Using the copy of the first ML algorithm, the second instance detects a second anomalous event from the second event data.

Abstract: A processing device receives a request to create a second account in a cloud computing system having multiple web services. The request specifies an organization unit (OU) associated with a first account of the cloud computing system. A first instance of a threat detection service monitors activity data associated with the first account and detects anomalous activity by the first account using a first machine learning (ML) model. The processing device creates the second account and attaches the second account to the OU. The processing device generates a second ML model for the second account using at least a portion of the first ML model and monitors subsequent activity data associated with the second account using the second ML model to detect anomalous activity by the second account.