Ranking alerts based on network monitoring

1. A method for monitoring network traffic using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an importance score based on the device relation model and the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity based on the one or more other entities and the entity being members of a same cluster and interacting with a same resource while non-communicating with each other: and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics;

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provided feedback; and

providing one or more ranked alerts to the one or more users based on the provided feedback from the one or more users and a ranking of the importance scores associated with one or more entities.

2. The method of claim 1 , wherein the actions of the inference engine further comprise, modifying the importance score associated with each entity based on one or more characteristics including one or more of resources accessed by an entity, resources provided by an entity, users that access an entity, users that are logged in to an entity, or an uptime of the entity.

3. The method of claim 1 , wherein the actions of the monitoring engine further comprise:

modifying the device relation model based on an addition or removal of one or more entities in the network; and

modifying the importance score associated with each entity based on the modification to the device relation model.

4. The method of claim 1 , wherein the inference engine performs further actions, comprising:

providing one or more other entities based on a traversal of the device relation model; and

modifying each importance score that is associated with the one or more other entities based on the traversal.

5. The method of claim 1 , wherein the actions of the inference engine further comprise, modifying the importance score of the entity based on one or more applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of the one or more users.

6. The method of claim 1 , wherein the actions of the inference engine further comprise, increasing the importance score for the entity based on a metric value that is associated with another entity that is linked to the entity.

7. The method of claim 1 , wherein the actions of the inference engine further comprises:

associating two or more entities that are communicating based on one or more public key infrastructure (PKI) certificates; and

increasing each importance score associated with the two or more associated entities based on one or more anomalies associated with the one or more PKI certificates.

8. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an importance score based on the device relation model and the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity based on the one or more other entities and the entity being members of a same cluster and interacting with a same resource while non-communicating with each other; and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics;

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provided feedback; and

providing one or more ranked alerts to the one or more users based on the provided feedback from the one or more users and a ranking of the importance scores associated with one or more entities.

9. The media of claim 8 , wherein the actions of the inference engine further comprise, modifying the importance score associated with each entity based on one or more characteristics including one or more of resources accessed by an entity, resources provided by an entity, users that access an entity, users that are logged in to an entity, or an uptime of the entity.

10. The media of claim 8 , wherein the actions of the monitoring engine further comprise:

modifying the device relation model based on an addition or removal of one or more entities in the network; and

modifying the importance score associated with each entity based on the modification to the device relation model.

11. The media of claim 8 , wherein the inference engine performs further actions, comprising:

providing one or more other entities based on a traversal of the device relation model; and

modifying each importance score that is associated with the one or more other entities based on the traversal.

12. The media of claim 8 , wherein the actions of the inference engine further comprise, modifying the importance score of the entity based on one or more applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of the one or more users.

13. The media of claim 8 , wherein the actions of the inference engine further comprise, increasing the importance score for the entity based on a metric value that is associated with another entity that is linked to the entity.

14. The media of claim 8 , wherein the actions of the inference engine further comprises:

associating two or more entities that are communicating based on one or more public key infrastructure (PKI) certificates; and

increasing each importance score associated with the two or more associated entities based on one or more anomalies associated with the one or more PKI certificates.

15. A system for monitoring network traffic in a network:

one or more network computers, comprising:

a transceiver that communicates over the network; a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an importance score based on the device relation model and the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity based on the one or more other entities and the entity being members of a same cluster and interacting with a same resource while non-communicating with each other; and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics;

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provided feedback; and

providing one or more ranked alerts to the one or more users based on the provided feedback from the one or more users and a ranking of the importance scores associated with one or more entities; and

one or more client computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing one or more portions of the network traffic.

16. The system of claim 15 , wherein the actions of the inference engine further comprise, modifying the importance score associated with each entity based on one or more characteristics including one or more of resources accessed by an entity, resources provided by an entity, users that access an entity, users that are logged in to an entity, or an uptime of the entity.

17. The system of claim 15 , wherein the actions of the monitoring engine further comprise:

modifying the device relation model based on an addition or removal of one or more entities in the network; and

modifying the importance score associated with each entity based on the modification to the device relation model.

18. The system of claim 15 , wherein the inference engine performs further actions, comprising:

providing one or more other entities based on a traversal of the device relation model; and

modifying each importance score that is associated with the one or more other entities based on the traversal.

19. The system of claim 15 , wherein the actions of the inference engine further comprise, modifying the importance score of the entity based on one or more applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of the one or more users.

20. The system of claim 15 , wherein the actions of the inference engine further comprise, increasing the importance score for the entity based on a metric value that is associated with another entity that is linked to the entity.

21. The system of claim 15 , wherein the actions of the inference engine further comprises:

associating two or more entities that are communicating based on one or more public key infrastructure (PKI) certificates; and

increasing each importance score associated with the two or more associated entities based on one or more anomalies associated with the one or more PKI certificates.

22. A network computer for monitoring communication over a network between two or more computers, comprising:

a transceiver that communicates over the network; a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and

instantiating an inference engine to perform actions including associating each entity in the plurality of entities with an importance score based on the device relation model and the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity based on the one or more other entities and the entity being members of a same cluster and interacting with a same resource while non-communicating with each other; and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on the one or more metrics;

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provided feedback; and

providing one or more ranked alerts to the one or more users based on the provided feedback from the one or more users and a ranking of the importance scores associated with one or more entities.

23. The network computer of claim 22 , wherein the actions of the inference engine further comprise, modifying the importance score associated with each entity based on one or more characteristics including one or more of resources accessed by an entity, resources provided by an entity, users that access an entity, users that are logged in to an entity, or an uptime of the entity.

24. The network computer of claim 22 , wherein the actions of the monitoring engine further comprise:

modifying the device relation model based on an addition or removal of one or more entities in the network; and

modifying the importance score associated with each entity based on the modification to the device relation model.

25. The network computer of claim 22 , wherein the inference engine performs further actions, comprising:

providing one or more other entities based on a traversal of the device relation model; and

modifying each importance score that is associated with the one or more other entities based on the traversal.

26. The network computer of claim 22 , wherein the actions of the inference engine further comprise, modifying the importance score of the entity based on one or more applications shared by the entity and one or more other entities, dependencies shared by the entity and the one or more other entities, or activities of the one or more users.

27. The network computer of claim 22 , wherein the actions of the inference engine further comprise, increasing the importance score for the entity based on a metric value that is associated with another entity that is linked to the entity.

28. The network computer of claim 22 , wherein the actions of the inference engine further comprises:

associating two or more entities that are communicating based on one or more public key infrastructure (PKI) certificates; and

increasing each importance score associated with the two or more associated entities based on one or more anomalies associated with the one or more PKI certificates.