1. A system for providing network security monitoring in a computer network, comprising: a security monitoring server device; a data collector, implemented on the security monitoring server device, configured to: gather and process network configuration data from a plurality of network devices within the computer network; and provide the processed network configuration data to a data analyzer; and an agent, implemented on a client device within the computer network, configured to: collect network configuration data on the client device; provide the network configuration data on the client device to the data collector; detect a privileged authentication event on the client device, wherein the detected privileged authentication event comprises event data; initiate live collection of network metadata, distinct from the event data, on the client device related to the detected privileged authentication event upon detecting the privileged authentication event; and provide the network metadata to the data analyzer.