1. A method comprising: receiving at an analytics module operating at a network device, network traffic data collected from a plurality of sensors distributed throughout a network and installed in network components to obtain the network traffic data; identifying at the analytics module, Domain Name System (DNS) exchanges within the network; associating at the analytics module, said DNS exchanges with processes running on the network components, user information for network flows, and host information; and identifying at the analytics module, anomalies in said DNS exchanges; wherein the network components comprise a plurality of leaf nodes and endpoints operating in the network, the sensors installed in the network components to provide a pervasive view of network behavior and monitor said DNS exchanges from multiple perspectives within the network including host, user, and process perspectives.