A method for monitoring network traffic using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising: instantiating a monitoring engine to perform actions, including: monitoring one or more portions of the network traffic that are associated with a plurality of entities in one or more networks to provide one or more metrics; and instantiating an inference engine that performs actions, including: providing one or more activity profiles based on the plurality of entities and the one or more portions of the network traffic, wherein each activity profiles includes features based on the one or more metrics, the plurality of entities, or the one or more portions of the network traffic; determining one or more other activity profiles that correlate with the one or more activity profiles based on one or more correlation models; monitoring one or more other portions of the network traffic associated with the one or more other activity profiles, wherein the determination of the one or more other activity profiles occurs separate from the monitoring of the one or more other portions of the network traffic that are associated with the one or more other activity profiles; modifying one or more monitoring actions of the monitoring engine based on the one or more other activity profiles; and providing one or more reports based on the one or more portions of the network traffic, the one or more activity profiles, the one or more other portions of the network traffic, or the one or more other activity profiles, wherein the one or more reports are provided to one or more users. instantiating a monitoring engine to perform actions, including: monitoring one or more portions of the network traffic that are associated with a plurality of entities in one or more networks to provide one or more metrics; and instantiating an inference engine that performs actions, including: providing one or more activity profiles based on the plurality of entities and the one or more portions of the network traffic, wherein each activity profiles includes features based on the one or more metrics, the plurality of entities, or the one or more portions of the network traffic; determining one or more other activity profiles that correlate with the one or more activity profiles based on one or more correlation models; monitoring one or more other portions of the network traffic associated with the one or more other activity profiles, wherein the determination of the one or more other activity profiles occurs separate from the monitoring of the one or more other portions of the network traffic that are associated with the one or more other activity profiles; modifying one or more monitoring actions of the monitoring engine based on the one or more other activity profiles; and providing one or more reports based on the one or more portions of the network traffic, the one or more activity profiles, the one or more other portions of the network traffic, or the one or more other activity profiles, wherein the one or more reports are provided to one or more users. providing one or more activity profiles based on the plurality of entities and the one or more portions of the network traffic, wherein each activity profiles includes features based on the one or more metrics, the plurality of entities, or the one or more portions of the network traffic; determining one or more other activity profiles that correlate with the one or more activity profiles based on one or more correlation models; monitoring one or more other portions of the network traffic associated with the one or more other activity profiles, wherein the determination of the one or more other activity profiles occurs separate from the monitoring of the one or more other portions of the network traffic that are associated with the one or more other activity profiles; modifying one or more monitoring actions of the monitoring engine based on the one or more other activity profiles; and providing one or more reports based on the one or more portions of the network traffic, the one or more activity profiles, the one or more other portions of the network traffic, or the one or more other activity profiles, wherein the one or more reports are provided to one or more users.