1. A method comprising: computing in real-time a score by processing a stream of events through a first version of a machine learning model, wherein the stream of events corresponds to a time slice and includes time stamped machine data produced by a component within an information environment and reflects activity within the information technology environment, and wherein the machine learning model is configured to be trained by computer network activity characterized by the stream of events involving at least one entity; training, in parallel with said processing the stream of events, a second version of the machine learning model with the time slice that is being processed through the first version for scoring, wherein said training includes retraining a model state of the second version of the machine learning model when a group-specific stream of events provides additional event feature sets; invoking a model readiness logic to determine whether the second version of the machine learning model has sufficient training; and performing live-swapping in the second version of the machine learning model to replace the first version of the machine learning model as an active version to compute another score, said live-swapping being based on a determination of whether the second version of the machine learning model is ready for active deployment.