1. A method, comprising: analyzing, by a device in a network, data indicative of a behavior of the network using a supervised anomaly detection model, wherein the supervised anomaly detection model was trained using a set of labels applied to a set of input network metrics from a second network; determining, by the device, whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data; and training, by the device, an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model, wherein training the unsupervised anomaly detection model comprises: observing, by the device, network behavior, in response to the determination that no anomalies were detected by the supervised anomaly detection model, and using the observed network behavior of the network as a non-anomalous baseline for the unsupervised anomaly detection model.