Network Operation Application Monitoring

A method, comprising:

• collecting network information from a server, wherein the network information is associated with a flow transmitted from the node;
• collecting application information from the server, wherein the application information is associated with an application that caused the server to transmit the flow;
• and
• storing the network information and the application information, wherein the stored network information and the application information identify an anomaly in the network caused by the flow.

A system, comprising:

• a non-transitory memory storing instructions;
• and
• one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising:
• receiving a request message indicating an anomaly in a network, wherein the request message includes a network information associated with the anomaly;
• comparing the network information from the request message with a network information and application information collected from a node that generated a flow, wherein the network information collected from the node is associated with a source IP information and the application information is associated with the application that generated the flow;
• and
• determining the application based on the comparison.