Automatic provisioning of new users of interest for capture on a communication network

A method of monitoring data, the method comprising:

• receiving at a metadata processing device, a metadata portion of a data stream from a user not currently of interest in a network;
• evaluating the metadata portion of the data stream;
• and
• creating a relationship between the metadata portion of the data stream of the user not currently of interest and any data of a known user of interest.

A network monitoring system comprising:

• an access device for retrieving data from a network;
• a metadata processing engine coupled to the access device, wherein the metadata processing engine determines a new user of interest using metadata from a user not currently of interest of the network, and wherein the metadata processing engine is operative to:
• retrieve the data to be monitored from the network;
• evaluate the data retrieved from the network;
• create a new user of interest on the network based on the evaluation of the data retrieved from the network;
• communicate an identification (ID) for the new user of interest to the access device;
• and
• monitor the network for data related to the new user of interest.

A method of provisioning a user to be monitored in a network, the method comprising:

• retrieving data to be monitored from the network;
• evaluating the data retrieved from the network;
• creating a new user of interest on the network based on the evaluating of the data retrieved from the network;
• communicating an identification (ID) for the new user of interest to the access device;
• and
• monitoring the network for data related to the new user of interest.