1. A method comprising: monitoring, with a monitoring system comprising a processor in communication with a network, network traffic to and/or from an asset associated with the network; assessing, with the monitoring system, the network traffic to determine a source and/or destination for the network traffic and/or content of the network traffic; determining, with the monitoring system, whether the network traffic is suspicious network traffic based on the assessed source and/or destination and/or content; when the network traffic is determined to be suspicious network traffic, capturing, with the monitoring system, metadata associated with the suspicious network traffic and storing the metadata in a database in communication with the processor; and when the network traffic is not determined to be suspicious network traffic, disregarding, with the monitoring system, metadata associated with the network traffic.