Add Network Map documentation

docs/agents/sematext-agent/index.md

@@ -18,4 +18,5 @@ other metric sources.
 - [Inventory tracking](/docs/monitoring/inventory) of your whole infrastructure including packages, server details, container metadata and more.
 - [Process monitoring](/docs/monitoring/processes) that helps out identifying top CPU or memory consumers.
 - [Service discovery](/docs/monitoring/autodiscovery/) and automated monitoring for vanilla Docker and Kubernetes workloads.
+- [Network Map](/docs/network-map/) for visualizing infrastructure topology and service connections using eBPF-powered network insights.
 - [Logs discovery](/docs/logs/discovery/intro/) and parsing.

docs/fleet/index.md

@@ -1,7 +1,7 @@
 title: Fleet and Discovery Overview
 description: Overview of Fleet and Discovery - Fleet & Discovery management panel
 
-[Fleet](/docs/fleet/fleet) & [Discovery](/docs/fleet/discovery) are two major components of your infrastructure [monitoring](/docs/monitoring/) and [log management](/docs/logs/). Think of them as the 'eyes and ears' of your entire infrastructure. They enable you to monitor the health, performance, and configuration changes of your infrastructure.  See the video below for a quick overview.
+[Fleet](/docs/fleet/fleet) & [Discovery](/docs/fleet/discovery) are two major components of your infrastructure [monitoring](/docs/monitoring/) and [log management](/docs/logs/). Think of them as the 'eyes and ears' of your entire infrastructure. They enable you to monitor the health, performance, and configuration changes of your infrastructure. For a visual representation of your infrastructure topology and service connections, see [Network Map](/docs/network-map/). See the video below for a quick overview.
 
 <div class="video_container">
 <iframe src="https://www.youtube.com/embed/AzWtbPJ7-aU" 

docs/monitoring/autodiscovery.md

@@ -2,7 +2,7 @@ title: Sematext Service Discovery
 description: Sematext Autodiscovery Monitoring automatically scans for services that can be monitored using Sematext Agent and, depending on your configuration, automatically sets up monitoring agents. 
 
 The centerpiece of Service Discovery is [Sematext Agent](/docs/agents/sematext-agent). When Sematext Agent is installed and running on a server/node/instance it scans for services that can be monitored by Sematext
-[supported integrations](/docs/monitoring/autodiscovery/#which-integrations-allow-autodiscovery). It also [discovers logs](/docs/logs/discovery/intro/) you can ship to Sematext and monitor.
+[supported integrations](/docs/monitoring/autodiscovery/#which-integrations-allow-autodiscovery). It also [discovers logs](/docs/logs/discovery/intro/) you can ship to Sematext and monitor. To visualize discovered services and their connections, see [Network Map](/docs/network-map/services-view/).
 
 The discovered services and logs are displayed under `Fleet & Discovery > Discovery > Services`.  From there, one can set up both monitoring and log shipping via the UI without any additional installation or configuration.  Moreover, this is where auto-monitoring of supported integrations can be enabled, allowing Sematext Agent to automatically start monitoring newly discovered instances of the service for which you've set up monitoring. For example, if you have set up monitoring for Elasticsearch and enabled automatic monitoring then any new Elasticsearch nodes that are added to the cluster will automatically get monitored.
 

docs/monitoring/infrastructure.md

@@ -76,3 +76,4 @@ Infrastructure Monitoring provides:
 - [Kubernetes](/docs/agents/sematext-agent/kubernetes/metrics/) metrics and details
 - [Inventory](/docs/monitoring/inventory)
 - [Processes details and metrics](/docs/monitoring/processes)
+- [Network Map](/docs/network-map/) - Visualize your infrastructure topology and service connections

docs/monitoring/kubernetes.md

@@ -5,4 +5,6 @@ Monitor Kubernetes clusters with a lightweight [Agent](/docs/agents/sematext-age
 
 ![Infra Kubernetes metrics](/docs/images/monitoring/infra-kubernetes-metrics.gif)
 
-For more info, check out our [Kubernetes Monitoring](/docs/integration/kubernetes/) integration that comes pre-loaded with every Infra App.
+For more info, check out our [Kubernetes Monitoring](/docs/integration/kubernetes/) integration that comes pre-loaded with every Infra App.
+
+For a visual topology of your Kubernetes clusters with drill-down from clusters to nodes, pods, and containers, see [Network Map](/docs/network-map/infrastructure-view/).

docs/network-map/filtering-search.md

@@ -0,0 +1,104 @@
+title: Filtering & Search
+description: Find and filter specific services, infrastructure, and connections in Network Map.
+
+When you're managing dozens or hundreds of services, you need ways to focus on what matters. Network Map provides powerful filtering and search capabilities that help you cut through the noise and find exactly what you're looking for.
+
+![Services Filters Panel](../images/network-map/network-map-filters.png)
+
+## Finding Services with Search
+
+The search bar at the top of Network Map lets you quickly find specific services, nodes, pods, or hosts by name. Just start typing and matching elements are highlighted on the map.
+
+## Quick Filters for Common Problems
+
+Click the Filters button to open the Services Filters panel. At the top, you'll find Quick Filters - pre-configured filters based on your [threshold settings](thresholds.md) that highlight common problem areas:
+
+**High Network** (>10MB/s) shows services with high network I/O. Use this to find services that might be bandwidth-constrained or experiencing unusual traffic.
+
+**High Disk I/O** (>70MB/s) reveals services with elevated disk activity. This helps identify storage bottlenecks or services that might benefit from caching.
+
+**High CPU** (>70% usage) filters to services consuming significant CPU. When your cluster is running hot, this immediately shows you where the load is coming from.
+
+**High Memory** (>80% usage) displays services approaching their memory limits. Catching these early helps prevent OOM kills and service disruptions.
+
+These quick filters are especially useful during incident response - instead of scanning the entire map, click "High CPU" to immediately see which services are struggling. The threshold values shown are defined in your [Threshold Settings](thresholds.md).
+
+## Filtering by Environment
+
+The Environment & Infrastructure section lets you focus on specific parts of your infrastructure:
+
+Use the **Environment Type** checkboxes to filter by **Kubernetes** or **Bare-Metal** services. Each option displays a count of matching services, so you know how many elements will appear after filtering. You can select both to see your entire infrastructure, or focus on just one environment type.
+
+## Filtering by Service Type
+
+The **Service Types** section lets you filter by specific technologies. Use the checkboxes to select one or more service types from the paginated list:
+
+Looking for database issues? Select MySQL, PostgreSQL, or MongoDB to show only your database services. Troubleshooting messaging? Filter to Kafka and RabbitMQ. Investigating web traffic? Select Nginx and Apache.
+
+The list shows counts next to each service type (like "2 services"), helping you understand your infrastructure composition at a glance. Use the search box to quickly find a specific service type, or use the pagination controls to browse through all available types.
+
+## Filtering by Performance Metrics
+
+The **Performance & Metrics** section provides sliders to filter based on resource consumption:
+
+- **Network Traffic Rate (MB/s)** - Filter by network traffic volume to find your busiest services or investigate bandwidth issues
+- **Disk I/O Rate (MB/s)** - Filter by disk throughput to identify I/O-intensive services
+- **Connection Count** - Filter by the number of active connections to find services with many connections
+
+These sliders work as minimum thresholds - services above your selected value appear on the map.
+
+## Color Coding Options
+
+The "Color By" dropdown in the top-right corner controls how services and connections are visually represented:
+
+![Color By Options](../images/network-map/network-map-color-by.png)
+
+**Nodes** (service cards and infrastructure elements):
+
+- Network I/O
+- CPU Usage
+- Memory Usage
+- Disk I/O
+
+**Edges** (connection lines):
+
+- Traffic Volume
+- Connection Health
+
+Choose the metric most relevant to your current investigation. Traffic volume helps identify your busiest connections, while connection health highlights latency or reliability issues.
+
+The color scale uses green for healthy values (below your warning threshold), yellow for warning levels (between warning and critical), and red for critical values (above your critical threshold). Gray indicates no data is available.
+
+This color coding works with your [threshold configuration](thresholds.md), so you can customize what "healthy" and "critical" mean for your environment.
+
+## Combining Filters
+
+Filters combine to narrow your view progressively. For example, you might:
+
+1. Select "Kubernetes" to focus on containerized services
+2. Filter to "PostgreSQL" service type to see only your databases
+3. Apply the "High CPU" quick filter to find which databases are working hardest
+
+The map updates immediately as you apply each filter, showing you only the services that match all your criteria.
+
+## Clearing Filters
+
+To reset your view, click "Clear All" in the filters panel or close the panel to return to showing all services. Individual filter sections also have their own clear options if you want to remove just one filter while keeping others.
+
+## Practical Examples
+
+**During an incident**: Open Quick Filters and click "High CPU" and "High Memory" to immediately see which services are resource-constrained. This is much faster than scanning the entire map.
+
+**Capacity planning**: Filter by service type to see all instances of a particular technology. Examine their resource usage to determine if you need to scale.
+
+**Investigating a namespace**: Use search to find services in a specific namespace, or filter by Kubernetes and then examine the namespace tags on each service.
+
+**Finding connection issues**: Color edges by Connection Health, then look for red lines indicating problematic connections. Click on them to see latency and error details.
+
+**Cost optimization**: Filter by low CPU and memory usage to find over-provisioned services that could be downsized. Look for services with minimal traffic that might be candidates for consolidation or removal. Identify redundant services running the same workload across multiple instances when fewer would suffice.
+
+## Next Steps
+
+- [Thresholds](thresholds.md) to customize what "High CPU" and other quick filters mean for your environment
+- [Services View](services-view.md) to understand the tier-based service layout
+- [Infrastructure View](infrastructure-view.md) to drill down into Kubernetes and bare-metal infrastructure

docs/network-map/getting-started.md

@@ -0,0 +1,81 @@
+title: Getting Started with Network Map
+description: Learn the prerequisites and how to enable Network Map for your infrastructure.
+
+Getting Network Map up and running takes just a few minutes if you already have Sematext Infra Monitoring in place. If you're new to Sematext, this guide walks you through everything you need.
+
+## What You Need
+
+Network Map requires two things:
+
+**An [Infra App](../monitoring/infrastructure.md)** to collect and store your infrastructure data. If you're already using Sematext for infrastructure monitoring, you have this. If not, you'll create one as part of the setup process.
+
+**[Sematext Agent](../agents/sematext-agent/installation/)** installed on the hosts you want to monitor. The agent collects eBPF-based network connection data that powers Network Map's topology visualization. You need version 4.1.x or later.
+
+For best results, your hosts should be running **Linux kernel 5.8 or later**. Older kernels (4.15+) work but with some limitations. Check your kernel version with `uname -r`.
+
+## Enabling Network Map
+
+Navigate to Network Map in the Sematext Cloud sidebar. What you see next depends on your current setup:
+
+### If You Don't Have an Infra App
+
+![No Infra App](../images/network-map/network-map-enable-no-infra-app.png)
+
+You'll be prompted to create an Infra App first. Click "Create New Infra App" to create one, give it a name (like "Production Infrastructure" or "Staging Environment"), and you're set.
+
+Each Infra App typically represents one environment. Many teams have separate Infra Apps for production, staging, and development.
+
+### If You Have an Infra App But No Agents
+
+You'll see instructions to install [Sematext Agent](../agents/sematext-agent/installation/). The installation is straightforward - you'll get a command to run on each host that includes your Infra App token.
+
+For Kubernetes environments, you'll deploy the agent as a DaemonSet so it runs on every node automatically.
+
+### If Everything Is Ready
+
+When you have an Infra App and agents installed, you'll see a summary of your infrastructure showing the number of hosts, Kubernetes clusters, pods, and containers that Network Map will monitor. If you've already enabled Network Map, you'll skip this screen and see your data directly.
+
+![Network Map Enable](../images/network-map/network-map-enable-ready.png)
+
+Click the Enable button to activate Network Map. There's no need to configure anything on your agents - the backend automatically enables Network Map data collection when you enable the feature. Your agents will start sending topology data right away.
+
+## What Happens After Enabling
+
+Once enabled, here's what to expect:
+
+**Data collection begins immediately.** The Sematext Agent starts observing network connections and sending topology data to Sematext Cloud.
+
+**Initial topology appears within minutes.** You'll see your first services and connections show up in Network Map. The visualization builds as the agent observes more connections.
+
+**The map becomes more complete over time.** Services that haven't made network connections yet won't appear until they do. As your infrastructure communicates, Network Map captures more of the topology.
+
+**No restart required.** Your agents don't need to restart when you enable Network Map. The feature activates dynamically.
+
+## Verifying It's Working
+
+After a few minutes, you should see:
+
+- Service nodes appearing on the map
+- Connection lines between services showing protocols and traffic
+- Your Kubernetes clusters and nodes (if applicable) in the Infrastructure view
+
+If nothing appears after 10 minutes, check the [Troubleshooting](troubleshooting.md) guide.
+
+## Using the Quick Guide
+
+Click the **Quick Guide** button in the top-right corner of Network Map to see a visual legend explaining the interface. The Quick Guide shows you what the different node colors mean (green for healthy, yellow for warning, red for critical), how connection lines are colored based on traffic volume and health, and what controls are available. It's a handy reference while you're learning the interface.
+
+![Quick Guide](../images/network-map/network-map-quick-guide.png)
+
+## Pricing
+
+For Network Map pricing details, visit [sematext.com/pricing](https://sematext.com/pricing).
+
+## Next Steps
+
+Once Network Map is running:
+
+- [Services View](services-view.md) - Explore your services organized by tier
+- [Infrastructure View](infrastructure-view.md) - Drill down into Kubernetes clusters and bare-metal hosts
+- [Filtering & Search](filtering-search.md) - Learn to find and filter specific services
+- [Thresholds](thresholds.md) - Customize warning and critical levels for your environment