Disclosed are systems, apparatuses, methods, and computer-readable media for generating a report in response to detected conditions in a network environment. A method includes: generating one or more triggering policies; determining if the one or more of the triggering policies has been satisfied; starting a netflow process in response to the determination that the one or more of the trigger policies has been satisfied; collecting in real time data for connected devices that satisfy the one or more triggering policies; generating and saving a record associated with the collected data; generating a report based on analysis of the record; displaying a link to the report.