1. A method of real-time tracking network topology changes, the method including: accessing a network topology that includes: processes running on numerous hosts grouped into local services on the hosts; the local services running on multiple hosts grouped into services; and network connections used by the services to connect the hosts grouped into service connections; receiving, in real-time, filtered network feature data and processing the received data against the network topology, including: queuing new processes in the received data that are not present in the network topology to be classified into services after a new process threshold is reached; queuing new connections in the received data that are not present in the network topology to be classified into service connections after a new connection threshold is reached; queuing new instances of services in the received data that are not present in the network topology to be added to the network topology after a new instance threshold is reached; queuing new service connections in the received data that are not present in the network topology to be added to the network topology after a new service connection threshold is reached; and matching processes, instances of services and service connections from the received data with components of the network topology and updating a timestamp in the matching components; periodically processing one or more queues from the received data to classify new processes into services after the new process threshold is reached and new connections into service connections after the new connection threshold is reached; periodically processing one or more queues from the received data to add to the network topology new instances of services after the new instance threshold is reached and to add to the network topology new service connections after the new service connection threshold is reached; periodically processing the network topology to remove out-of-date processes and self-depreciated processes, instances of services and service connections; and persisting an updated network topology after adding and removing from the network topology.