Ranking alerts based on network monitoring
Embodiments are directed to monitoring network traffic. A monitoring engine may monitor network traffic associated with a plurality of entities in networks to provide metrics. And provide a device relation model based on the plurality of entities, the network traffic, and the metrics. An inference engine may associate each entity in the plurality of entities with an importance score based on the device relation model and the metrics such that each importance score is associated with a significance of an entity to operations of the networks. An alert engine may generate a plurality of alerts associated with the plurality of entities based on the metrics. And provide one or more alerts from the plurality of alerts to one or more users based on one or more ranked importance scores associated with one or more entities.
1. A method for monitoring network traffic using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:
monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics;
associating each entity in the plurality of entities with an importance score based on the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more other entities to the entity;
presenting one or more of the plurality of entities to a user to acquire user feedback and updating the importance score for the one or more of the plurality of entities based on the user feedback and a role of the user;
generating a plurality of alerts associated with the plurality of entities based on the importance score for each entity.
2. The method of claim 1 , further comprising:
determining the importance of the one or more other entities to the entity based on one or more of:
a same cluster having the one or more other entities and the entity as members;
a user's feedback that a set of different entities interacting with a same resource as the one or more entities is important; or
a peer user's feedback that the set of different entities interacting with the same resource is important.
3. The method of claim 1 , further comprising:
determining one or more portions of the plurality of entities that are both currently unimportant to the user and currently important to an organization or one or more peer users; and
recommending the one or more portions of the plurality of entities to the user, wherein an importance score for a recommended entity is increased based on user acceptance of the recommendation or the importance score for the recommended entity is decreased based on user non-acceptance of the recommendation.
4. The method of claim 1 , further comprising:
employing one or more agents to perform actions, including one or more of:
selectively monitoring network traffic associated with the plurality of entities;
determining one or more metrics associated with the selectively monitored network traffic; and
storing the selectively monitored network traffic.
5. The method of claim 1 , further comprising:
providing the one or more other entities based on a traversal of a device relation model; and
modifying each importance score that is associated with the one or more other entities based on the traversal.
6. The method of claim 1 , further comprising:
in response to one or more anomalies associated with one or more Public Key Infrastructure (PKI) certificates, increasing each importance score associated with each entity associated with the one or more PKI certificates.
7. The method of claim 1 , further comprising:
in response to one or more of an application shared by the entity and the one or more other entities, a dependency shared by the entity and the one or more other entities, or activities of one or more users, modifying the importance score of the entity.
8. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more network computers perform the method comprising:
monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics;
associating each entity in the plurality of entities with an importance score based on the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more entities to the entity;
presenting one or more of the plurality of entities to a user to acquire user feedback and updating the importance score for the one or more of the plurality of entities based on the user feedback and a role of the user; and
generating a plurality of alerts associated with the plurality of entities based on the importance score for each entity.
9. The processor readable non-transitory storage media of claim 8 , further comprising:
determining the importance of the one or more other entities to the entity based on one or more of:
a same cluster having the one or more other entities and the entity as members;
a user's feedback that a set of different entities interacting with a same resource as the one or more entities is important; or
a peer user's feedback that the set of different entities interacting with the same resource is important.
10. The processor readable non-transitory storage media of claim 8 , further comprising:
determining one or more portions of the plurality of entities that are both currently unimportant to the user and currently important to an organization or one or more peer users; and
recommending the one or more portions of the plurality of entities to the user, wherein an importance score for a recommended entity is increased based on user acceptance of the recommendation or the importance score for the recommended entity is decreased based on user non-acceptance of the recommendation.
11. The processor readable non-transitory storage media of claim 8 , further comprising:
employing one or more agents to perform actions, including one or more of:
selectively monitoring network traffic associated with the plurality of entities;
determining one or more metrics associated with the selectively monitored network traffic; and
storing the selectively monitored network traffic.
12. The processor readable non-transitory storage media of claim 8 , further comprising:
providing the one or more other entities based on a traversal of a device relation model; and
modifying each importance score that is associated with the one or more other entities based on the traversal.
13. The processor readable non-transitory storage media of claim 8 , further comprising:
in response to one or more anomalies associated with one or more Public Key Infrastructure (PKI) certificates, increasing each importance score associated with each entity associated with the one or more PKI certificates.
14. The processor readable non-transitory storage media of claim 8 , further comprising:
in response to one or more of an application shared by the entity and the one or more other entities, a dependency shared by the entity and the one or more other entities, or activities of one or more users, modifying the importance score of the entity.
15. A system for monitoring network traffic in a network: one or more network computers, comprising:
a memory that stores at least instructions; and one or more processors that execute instructions that cause performance of actions, including:
monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics;
associating each entity in the plurality of entities with an importance score based on the one or more metrics, wherein each importance score is based on a significance of an entity to one or more operations of the one or more networks and an importance of one or more entities to the entity;
presenting one or more of the plurality of entities to a user to acquire user feedback and updating the importance score for the one or more of the plurality of entities based on the user feedback and a role of the user; and
generating a plurality of alerts associated with the plurality of entities based on the importance score for each entity.
16. The system of claim 15 , further comprising:
determining one or more portions of the plurality of entities that are both currently unimportant to the user and currently important to an organization or one or more peer users; and
recommending the one or more portions of the plurality of entities to the user, wherein an importance score for a recommended entity is increased based on user acceptance of the recommendation or the importance score for the recommended entity is decreased based on user non-acceptance of the recommendation.
17. The system of claim 15 , further comprising:
employing one or more agents to perform actions, including one or more of:
selectively monitoring network traffic associated with the plurality of entities;
determining one or more metrics associated with the selectively monitored network traffic; and
storing the selectively monitored network traffic.
18. The system of claim 15 , further comprising:
providing the one or more other entities based on a traversal of a device relation model; and
modifying each importance score that is associated with the one or more other entities based on the traversal.
19. The system of claim 15 , further comprising:
in response to one or more anomalies associated with one or more Public Key Infrastructure (PKI) certificates, increasing each importance score associated with each entity associated with the one or more PKI certificates.
20. The system of claim 15 , further comprising:
in response to one or more of an application shared by the entity and the one or more other entities, a dependency shared by the entity and the one or more other entities, or activities of one or more users, modifying the importance score of the entity.