I'm guessing that you are monitoring the interfaces. So what I do is that I've created an email alert that will email me if any of my remote links go over 90% utilisation for a continuous 10 mins. In the email I include a link that goes directly to the interface in question's page in Solarwinds. On that page I show the NTA graphs as well so it's easy to see who is hogging all the bandwidth at that moment in time.
At my old job, we used a proxy server for web access. I created an IP address group with only the IP of that proxy server, and whola! We only had one single DS3 connection, so I monitored that connection via where it came in on our Cisco ASA and of course enabled netflow on it. I remember our internet traffic was easy to spot bc it was the IP address of our proxy server. I also remember having to add the proxy server's switch port interface to be monitored by NPM.