1. A method comprising: extracting, from a model registry, a model type definition that includes a reference to model execution code and a processing mode specifier of a processing mode for a model deliberation workflow or a model training workflow, the processing mode specifier specifying at least one of a real-time processing mode or a batch processing mode; implementing a model execution engine in a distributed computation system to execute processes that use machine learning to detect computer security related anomalies or threats in a computer network; assigning, by the model execution engine, the model training workflow or the model deliberation workflow to the distributed computation system based on the processing mode specifier; and scheduling, according to the model training workflow or the model deliberation workflow, a model processing thread, that corresponds to a portion of the model execution code and that is either a model training thread or a model deliberation thread, to a computing node for parallel processing in the distributed computation system.