In the enterprise distributed network system, it is becoming increasingly challenging to accurately and dynamically identify who is doing what. The current network management system mainly relies on the identity of the users reasoning. This method cannot precisely mine, find and manage the network behavior in the large scale of the network because of the rough scale of collected data. This paper discovers the content and the dynamic process for network management of host, users and applications, which provides an important help to network context visual mining.