1. A method, comprising: capturing a plurality of packet streams at a host device that is to centrally manage network security for a plurality of client devices to which it is coupled over a network; recreating a plurality of flows from the packet streams; analyzing the flows to identify one or more incidents, wherein the incidents identify one or more pieces of data, and wherein the packet streams are captured based on capture filters that remove certain network traffic that is not to be analyzed for the incidents; and filtering the incidents based on a search request that initiated scanning for the incidents, and wherein at least one search parameter associated with the search request includes word patterns that form a concept for which triggers are provided for performing actions related to the concepts, wherein the host device includes a display, which includes a system monitor view that displays details about the client devices including patch history information and an operating system version for each of the client devices, and wherein the system monitor view allows an end user of the host device to view existing alerts that are reported to a database and that are polled periodically, wherein the host device includes a case management view that displays particular cases, which are for particular incidents previously discovered during scanning activities, and wherein the case management view allows the end user to assign a priority for the particular cases, to assign an owner to each of the particular cases, and to assign individual responsibility to other users for helping resolve the particular cases.