A network and system-monitoring device or software application that evaluates activities, identifies malicious threats and policy violations, and produces reports for a management station.