1. A system, comprising: a plurality of virtual computing instances (VCIs) deployed in a software defined data center; and a respective monitoring agent associated with each of the plurality of VCIs, wherein the monitoring agent is configured to: collect information regarding resources used by a plurality of processes running on an associated VCI; maintain a sliding window of top resource users among the plurality of processes; analyze the top resource users among the plurality of processes for anomalous usage of the resources; and take an action in response to the anomalous usage.