1. A method for monitoring network traffic in a network, wherein one or more processors in a network computer execute instructions to perform actions, comprising: providing a device relation model that is comprised of a graph for two or more nodes and one or more edges stored in memory of the network computer, wherein each node represents an agent and each edge represents a relationship between two agents; and instantiating a network monitoring application to perform actions, including: detecting one or more error signals; employing network traffic from two or more non-associated agents that is correlated to add one or more phantom edges to the device relation model to associate the two or more non-associated agents with each other; traversing the device relation model to identify one or more agents that are associated with the one or more error signals and that are associated with each other in the device relation model; analyzing the network traffic associated with the one or more error signals and the one or more agents to identify a plurality of anomalies that correspond to more than one agent that is associated with a same error signal; reducing an amount of the plurality of anomalies into one or more anomalies based on the graph of the device relation model; and employing the one or more anomalies in the network traffic to update the device relation model and notifying a user of the one or more anomalies in the network.