Ranking alerts based on network monitoring

1. A method for monitoring network traffic using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

instantiating an inference engine to perform actions including:

associating each entity in the plurality of entities with an importance score based on the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more entities to the entity based on the one or more other entities and the entity being members of a same cluster and a user's feedback that a set of the plurality of entities interacting with a same resource is important and peer user feedback that a different set of the plurality of entities interacting with the same resource is important, wherein one or more entities of the different subset are presented to the user for additional feedback; and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on one or more of the importance score for each entity and the one or more metrics.

2. The method of claim 1 , wherein the inference engine performs further actions, comprising:

employing feedback from one or more users regarding the plurality of entities to identify one or more entities that are currently unimportant to a user while currently being important to an organization or one or more other users that are peers to the user; and

recommending at least a portion of the identified one or more entities to the user, wherein an importance score for a recommended entity is increased when the user accepts the recommendation and the importance score for the recommended entity is decreased when the user declines the recommendation.

3. The method of claim 1 , wherein the monitoring engine performs further actions, comprising:

instantiating one or more agents to perform actions, including:

selectively capturing network traffic associated with the plurality of entities;

collecting the one or more metrics associated with network traffic associated with the plurality of entities; and

selectively storing the captured network traffic.

4. The method of claim 1 , wherein the monitoring engine performs further actions, comprising:

identifying one or more network packets that flow through a same path for two or more entities, wherein common data carried in the network packets are employed to identify the one or more network packets; and

employing the use of the same path to prioritize an importance of the two or more entities to each other.

5. The method of claim 1 , wherein the alert engine performs further actions, comprising:

providing one or more alerts to one or more users from the plurality of alerts based on one or more of feedback provided by one or more users or ranked importance scores associated with one or more entities.

6. The method of claim 1 , wherein the alert engine performs further actions, comprising:

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provide feedback.

7. The method of claim 1 , wherein the monitoring engine performs further actions, comprising:

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics, wherein the importance score is based at least in part on the device relation model.

8. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

instantiating an inference engine to perform actions including:

associating each entity in the plurality of entities with an importance score based on the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity based on the one or more other entities and the entity being members of a same cluster and a user's feedback that a set of the plurality of entities interacting with a same resource is important and peer user feedback that a different set of the plurality of entities interacting with the same resource is important, wherein one or more entities of the different subset are presented to the user for additional feedback; and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on one or more of the importance score for each entity and the one or more metrics.

9. The media of claim 8 , wherein the inference engine performs further actions, comprising:

employing feedback from one or more users regarding the plurality of entities to identify one or more entities that are currently unimportant to a user while currently being important to an organization or one or more other users that are peers to the user; and

recommending at least a portion of the identified one or more entities to the user, wherein an importance score for a recommended entity is increased when the user accepts the recommendation and the importance score for the recommended entity is decreased when the user declines the recommendation.

10. The media of claim 8 , wherein the monitoring engine performs further actions, comprising:

instantiating one or more agents to perform actions, including:

selectively capturing network traffic associated with the plurality of entities;

collecting the one or more metrics associated with network traffic associated with the plurality of entities; and

selectively storing the captured network traffic.

11. The media of claim 8 , wherein the monitoring engine performs further actions, comprising:

identifying one or more network packets that flow through a same path for two or more entities, wherein common data carried in the network packets are employed to identify the one or more network packets; and

employing the use of the same path to prioritize an importance of the two or more entities to each other.

12. The media of claim 8 , wherein the alert engine performs further actions, comprising:

providing one or more alerts to one or more users from the plurality of alerts based on one or more of feedback provided by one or more users or ranked importance scores associated with one or more entities.

13. The media of claim 8 , wherein the alert engine performs further actions, comprising:

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provide feedback.

14. The media of claim 8 , wherein the monitoring engine performs further actions, comprising:

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics, wherein the importance score is based at least in part on the device relation model.

15. A system for monitoring network traffic in a network, comprising:

one or more network computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

instantiating an inference engine to perform actions including

associating each entity in the plurality of entities with an importance score based on the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity based on the one or more other entities and the entity being members of a same cluster and a user's feedback that a set of the plurality of entities interacting with a same resource is important and peer user feedback that a different set of the plurality of entities interacting with the same resource is important, wherein one or more entities of the different subset are presented to the user for additional feedback; and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on one or more of the importance score for each entity and the one or more metrics; and

one or more client computers comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing one or more portions of the network traffic.

16. The system of claim 15 , wherein the inference engine performs further actions, comprising:

employing feedback from one or more users regarding the plurality of entities to identify one or more entities that are currently unimportant to a user while currently being important to an organization or one or more other users that are peers to the user; and

recommending at least a portion of the identified one or more entities to the user, wherein an importance score for a recommended entity is increased when the user accepts the recommendation and the importance score for the recommended entity is decreased when the user declines the recommendation.

17. The system of claim 15 , wherein the monitoring engine performs further actions, comprising:

instantiating one or more agents to perform actions, including:

selectively capturing network traffic associated with the plurality of entities;

collecting the one or more metrics associated with network traffic associated with the plurality of entities; and

selectively storing the captured network traffic.

18. The system of claim 15 , wherein the monitoring engine performs further actions, comprising:

identifying one or more network packets that flow through a same path for two or more entities, wherein common data carried in the network packets are employed to identify the one or more network packets; and

employing the use of the same path to prioritize an importance of the two or more entities to each other.

19. The system of claim 15 , wherein the alert engine performs further actions, comprising:

providing one or more alerts to one or more users from the plurality of alerts based on one or more of feedback provided by one or more users or ranked importance scores associated with one or more entities.

20. The system of claim 15 , wherein the alert engine performs further actions, comprising:

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provide feedback.

21. The system of claim 15 , wherein the monitoring engine performs further actions, comprising:

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics, wherein the importance score is based at least in part on the device relation model.

22. A network computer for monitoring communication over a network between two or more computers, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

instantiating a monitoring engine to perform actions, including:

monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics; and

instantiating an inference engine to perform actions including:

associating each entity in the plurality of entities with an importance score based on the one or more metrics, wherein each importance score I based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity based on the one or more other entities and the entity being members of a same cluster and a user's feedback that a set of the plurality of entities interacting with a same resource is important and peer user feedback that a different set of the plurality of entities interacting with the same resource is important, wherein one or more entities of the different subset are presented to the user for additional feedback; and

instantiating an alert engine to perform actions, including:

generating a plurality of alerts associated with the plurality of entities based on one or more of the importance score for each entity and the one or more metrics.

23. The network computer of claim 22 , wherein the inference engine performs further actions, comprising:

employing feedback from one or more users regarding the plurality of entities to identify one or more entities that are currently unimportant to a user while currently being important to an organization or one or more other users that are peers to the user; and

recommending at least a portion of the identified one or more entities to the user, wherein an importance score for a recommended entity is increased when the user accepts the recommendation and the importance score for the recommended entity is decreased when the user declines the recommendation.

24. The network computer of claim 22 , wherein the monitoring engine performs further actions, comprising:

instantiating one or more agents to perform actions, including:

selectively capturing network traffic associated with the plurality of entities;

collecting the one or more metrics associated with network traffic associated with the plurality of entities; and

selectively storing the captured network traffic.

25. The network computer of claim 22 , wherein the monitoring engine performs further actions, comprising:

identifying one or more network packets that flow through a same path for two or more entities, wherein common data carried in the network packets are employed to identify the one or more network packets; and

employing the use of the same path to prioritize an importance of the two or more entities to each other.

26. The network computer of claim 22 , wherein the alert engine performs further actions, comprising:

providing one or more alerts to one or more users from the plurality of alerts based on one or more of feedback provided by one or more users or ranked importance scores associated with one or more entities.

27. The network computer of claim 22 , wherein the alert engine performs further actions, comprising:

providing feedback from one or more users regarding the plurality of entities, wherein the feedback includes one or more of user interaction history with one or more of the plurality of entities, importance of the user interaction with the one or more entities, or one or more roles of the one or more users that provide feedback.

28. The network computer of claim 22 , wherein the monitoring engine performs further actions, comprising:

providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics, wherein the importance score is based at least in part on the device relation model.