1. A computer system for monitoring a data communication network comprising: at least one processor configured for: receiving security event data from a sensor, the sensor operatively coupled to the data communication network and operative for determining the existence of a client/server connection on the data communication network; transmitting a notification to a particular user of a machine on the data communication network associated with the client of the client/server connection, the notification comprising the indication of the nature of a security event represented in the security event data and a query as to the nature of the particular user's network activity relating to a server of the client/server connection, wherein the security event comprises a determination that the server involved in the client/server connection possesses a security indication characteristic, and wherein the security indication characteristic includes data indicating: (a) that the server presents a known security risk to the network, (b) that the server has not been seen in previous communications on the network, (c) that characteristics of the communication between the client and the server exhibits characteristics indicative of possible security risk; receiving the particular user's response to the query; based upon the particular user's response to the query, generating a security alert based on the response to the query and the security event data; communicating the security alert to a security analyst computer system associated with the data communication network; and employing user responses in connection with pre-stored data obtained by logging of information derived from one or more prior communications with a particular server, to enable the security analyst computer system to analyze historical traffic data with the particular server and use that historical traffic data to assess a security risk for the particular server.