1. A method for identifying a security entity in a computing environment, comprising: monitoring a communication between a user computer and at least one destination computer by a security appliance executed on a computing device; extracting a plurality of selective information from the communication by the security appliance; identifying at least one security entity based on a subset of the selective information, wherein the subset of the selective information belonging to a first time interval; confirming an identity of the identified at least one security entity as valid for the first time interval, based on an association between a decisive identifier and the identified at least one security entity during the first time interval; evaluating another subset of selective information belonging to a second time interval and detecting the identified at least one security entity during the second interval, based on an association between the decisive identifier and the identity of the identified at least one security entity during the second time interval; extending the association between the identified at least one security entity and the associated decisive identifier from the first time interval to the second time interval, based on the detection; generating a knowledge graph for the identified at least one security entity based on the associated decisive identifier for a period extending from the first time interval to the second time interval; and analyzing a network communication between the user computer and the at least one destination computer to detect a potential threat based on information included in the knowledge graph, wherein a result of analyzing the communication is utilized to generate information to update priority of analysis of incoming packets in further network communications between the user computer and the at least one destination computer.