A method for monitoring network traffic using one or more network computers, wherein execution of instructions by the one or more network computers causes the one or more network computers to perform the method comprising: instantiating a monitoring engine to perform actions, including: monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics, wherein the entities include one or more of a source entity and one or more of a target entity; and providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and instantiating an inference engine, to perform actions, including: associating the plurality of entities with one or more privilege levels based on the device relation model and the one or more metrics, wherein a value for each of the one or more privilege levels is based on one or more of an amount of access or an amount of control that the one or more source entities exert over the one or more target entities; and increasing the one or more privilege levels for a source entity based on one or more metric values that are associated with the one or more target entities that are linked to the source entity; and instantiating an anomaly engine to perform actions, including: determining one or more interactions between the one or more source entities and the one or more target entities based on the monitored network traffic; generating one or more escalation events based on the one or more interactions and the one or more privilege levels associated with the one or more source entities and the one or more target entities, wherein the one or more interactions or the one or more target entities are associated with a privilege level that exceeds the one or more privilege levels associated with the one or more source entities; and providing the one or more escalation events to one or more users. instantiating a monitoring engine to perform actions, including: monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics, wherein the entities include one or more of a source entity and one or more of a target entity; and providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and monitoring network traffic associated with a plurality of entities in one or more networks to provide one or more metrics, wherein the entities include one or more of a source entity and one or more of a target entity; and providing a device relation model based on the plurality of entities, the network traffic, and the one or more metrics; and instantiating an inference engine, to perform actions, including: associating the plurality of entities with one or more privilege levels based on the device relation model and the one or more metrics, wherein a value for each of the one or more privilege levels is based on one or more of an amount of access or an amount of control that the one or more source entities exert over the one or more target entities; and increasing the one or more privilege levels for a source entity based on one or more metric values that are associated with the one or more target entities that are linked to the source entity; and associating the plurality of entities with one or more privilege levels based on the device relation model and the one or more metrics, wherein a value for each of the one or more privilege levels is based on one or more of an amount of access or an amount of control that the one or more source entities exert over the one or more target entities; and increasing the one or more privilege levels for a source entity based on one or more metric values that are associated with the one or more target entities that are linked to the source entity; and instantiating an anomaly engine to perform actions, including: determining one or more interactions between the one or more source entities and the one or more target entities based on the monitored network traffic; generating one or more escalation events based on the one or more interactions and the one or more privilege levels associated with the one or more source entities and the one or more target entities, wherein the one or more interactions or the one or more target entities are associated with a privilege level that exceeds the one or more privilege levels associated with the one or more source entities; and providing the one or more escalation events to one or more users. determining one or more interactions between the one or more source entities and the one or more target entities based on the monitored network traffic; generating one or more escalation events based on the one or more interactions and the one or more privilege levels associated with the one or more source entities and the one or more target entities, wherein the one or more interactions or the one or more target entities are associated with a privilege level that exceeds the one or more privilege levels associated with the one or more source entities; and providing the one or more escalation events to one or more users.