Techniques for generating a multi-layer network topology on a managed network are described herein. In an embodiment, data that was collected from a plurality of network devices within a managed network is received and analyzed within a multi-layered plurality of decision trees. The plurality of decision trees include a plurality of nodes, one overlay decision tree, and at least one underlay decision tree. The plurality of nodes include a set of logic nodes that communicatively couples the at least one underlay tree to one of the logic nodes on the overlay tree. The received data is then classified by the plurality of multi-layered decision trees.