1. A computer-implemented method comprising: scanning a network, by a processor, for an instance of an anomalous event detection module, wherein the network includes one or more sub-networks; creating the instance if no instance exists; determining whether one or more additional instances need to be created based on a change in configuration of the network; and automatically creating the one or more additional instances based on the determined change in configuration.