Adaptive network monitoring with tuneable elastic granularity

A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network monitoring computers, wherein execution of the instructions by the one or more network computers perform actions, comprising:

• passively monitoring information that is associated with network traffic associated with one or more networks;
• in response to a determination that one or more conditions associated with activating one or more triggers for the monitored information has occurred, employing available resources to perform a deep packet level of inspection on packets that were communicated in the network traffic during the occurrence of the one or more conditions, wherein the resources include one or more of compute, data storage or network;
• and
• providing analysis of the network traffic based on the monitored information and the deep packet level of inspection for the packets.

A network computer for monitoring communication over a network between two or more computers, comprising:

• a memory that stores at least instructions;
• and
• one or more processors that execute instructions that perform actions, including:
• passively monitoring information that is associated with network traffic associated with one or more networks;
• in response to a determination that one or more conditions associated with activating one or more triggers for the monitored information has occurred, employing available resources to perform a deep packet level of inspection on packets that were communicated in the network traffic during the occurrence of the one or more conditions, wherein the resources include one or more of compute, data storage or network;
• and
• providing analysis of the network traffic based on the monitored information and the deep packet level of inspection for the packets.