A method for monitoring network traffic in a network (108, 110), wherein one or more processors in a network computer execute instructions to perform actions, comprising: employing a network monitoring engine to perform further actions, including: passively monitoring the network to collect a plurality of characteristics associated with one or more network flows without interfering and/or participating in the network flows and without expensive or intrusive deep packet inspection that may require decryption of encrypted network traffic; identifying one or more entities on the network based on one or more of the plurality of characteristics associated with the one or more network flows, wherein identifying the one or more entities comprises identifying one or more network devices or one or more network applications based on a network footprint, wherein the network footprint is comprised of one or more metrics collected without having to perform deep inspection of network packets in the one or more network flows; providing one or more entity profiles based on the identified entities and the one or more characteristics; and employing a configuration management engine to perform actions, including: comparing the one or more entity profiles with one or more configuration item entries in a database corresponding to IT assets in an organisation's IT infrastructure; providing one or more discrepancy notices based on differences in the comparison, wherein each discrepancy notice is associated with one or more differences between the one or more entity profiles and corresponding CI entries; and employing the network monitoring engine to execute one or more policies to perform one or more additional actions based on the one or more discrepancies notices. employing a network monitoring engine to perform further actions, including: passively monitoring the network to collect a plurality of characteristics associated with one or more network flows without interfering and/or participating in the network flows and without expensive or intrusive deep packet inspection that may require decryption of encrypted network traffic; identifying one or more entities on the network based on one or more of the plurality of characteristics associated with the one or more network flows, wherein identifying the one or more entities comprises identifying one or more network devices or one or more network applications based on a network footprint, wherein the network footprint is comprised of one or more metrics collected without having to perform deep inspection of network packets in the one or more network flows; providing one or more entity profiles based on the identified entities and the one or more characteristics; and passively monitoring the network to collect a plurality of characteristics associated with one or more network flows without interfering and/or participating in the network flows and without expensive or intrusive deep packet inspection that may require decryption of encrypted network traffic; identifying one or more entities on the network based on one or more of the plurality of characteristics associated with the one or more network flows, wherein identifying the one or more entities comprises identifying one or more network devices or one or more network applications based on a network footprint, wherein the network footprint is comprised of one or more metrics collected without having to perform deep inspection of network packets in the one or more network flows; providing one or more entity profiles based on the identified entities and the one or more characteristics; and employing a configuration management engine to perform actions, including: comparing the one or more entity profiles with one or more configuration item entries in a database corresponding to IT assets in an organisation's IT infrastructure; providing one or more discrepancy notices based on differences in the comparison, wherein each discrepancy notice is associated with one or more differences between the one or more entity profiles and corresponding CI entries; and comparing the one or more entity profiles with one or more configuration item entries in a database corresponding to IT assets in an organisation's IT infrastructure; providing one or more discrepancy notices based on differences in the comparison, wherein each discrepancy notice is associated with one or more differences between the one or more entity profiles and corresponding CI entries; and employing the network monitoring engine to execute one or more policies to perform one or more additional actions based on the one or more discrepancies notices.