Abstract: A classifier detects anomalous activity and models a pattern of life of network entities through a series of machine learning models cooperating with multiple response and training instances, which are served by a scalable cloud platform that receives data associated with processes from multiple endpoint agents. The classifier spins up the multiple response instances to support the detection of anomalous activity through the series of machine learning models and the multiple training instances to support the creation and training of the series of machine learning models modeling of the pattern of life of network entities. The classifier spin ups the multiple response instances and the multiple training instances to automatically scale an amount of response instances and training instances needed to respond to a current data load of the data associated with the processes coming from the endpoint agents connected to the network.