1. A method of real-time tracking network topology changes, the method including: accessing from a network topology tracker a database that rolls up a network topology that includes the following components: processes running on numerous hosts and grouped into local services on the hosts; the local services running on multiple hosts and grouped into services; and network connections used by the services to connect the hosts and grouped into service connections; receiving at a network topology tracking queue, in real-time, filtered network feature data from data fetchers and processing the received data against the network topology, including: queuing new processes in the received data that are not present in the network topology to be classified into services after a new process threshold is reached; queuing new connections in the received data that are not present in the network topology to be classified into service connections after a new connection threshold is reached; queuing new instances of services in the received data that are not present in the network topology to be added to the network topology after a new instance threshold is reached; queuing new service connections in the received data that are not present in the network topology to be added to the network topology after a new service connection threshold is reached; and matching processes, instances of services and service connections from the received data with the components of the network topology and updating a timestamp in the matching components; periodically processing one or more queues from the received data to classify new processes into services after the new process threshold is reached and new connections into service connections after the new connection threshold is reached; periodically processing by the network topology tracker one or more queues from the received data to add to the network topology new instances of services after the new instance threshold is reached and to add to the network topology new service connections after the new service connection threshold is reached; periodically processing by the network topology tracker the network topology to remove out-of-date processes and self-depreciated processes, instances of services and service connections; and persisting an updated network topology after adding and removing from the network topology.